I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working with opening Motepad at victim's PC (a virtual machine running Windows 10 PRO x64 1607). But nothing more.
We have tried to use shellcode from here but it doesnt work. It should download and run our virus from server, but it does nothing. We have disabled firewall, defender etc. and still nothing. Also we tested some shellcodes in VisualStudio(C/C++) and when we had a shellcode working there (opening something else than Notepad, like calc.exec) but when we put it to out JS it did nothing (yes we changed it to format %u...).
If you have some ideas what might be wrong, or if you have some hints please let me know.