Ring0VBA CVE-2018-6606 using VBA - https://disrel.com/posts/Ring0VBA-Getting-Ring0-Using-a-Goddamn-Word-Document/