rapid7/metasploit-framework — pull request #1531 by wchen-r7 (2013-02-28 17:45:56+00:00)
Title: Adds new function js_property_spray

This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty) function to trigger allocations by ntdll!RtlAllocateHeap. It is based on Corelan's publication on "DEPS – Precise Heap Spray on Firefox and IE10".

It has been tested on IE 8, 9, and 10. Also on Firefox.

Here's a very basic example on how to test the new function:

def load_exploit_html(cli, req)
spray = js_property_spray

html = %Q|

|

return html
end