Internet Explorer JScript Engine Memory Corruption RCE

This repository contains a working exploit for CVE-2020-0674, a use-after-free vulnerability in the legacy JScript engine of Internet Explorer. The exploit is implemented as a single HTML file (exploit.html) containing heavily commented JScript code. The exploit targets 64-bit versions of Internet Explorer (8, 9, 10, 11) on Windows 7, and leverages a flaw in the Array.sort comparator function to achieve arbitrary code execution. The provided payload launches the Windows calculator (calc.exe) to demonstrate successful exploitation, but the payload can be modified for arbitrary command execution. The README.md provides detailed background, configuration requirements, and usage notes. The exploit does not fully bypass all EMET mitigations but works under certain configurations. The main attack vector is through a malicious web page viewed in a vulnerable version of Internet Explorer. Notable fingerprintable endpoints include the path to calc.exe and the TabProcGrowth registry key, which is relevant for enabling the x64 process required for exploitation.