├── README.md ├── LICENSE └── exploit └── jscript_win10_jit.html /README.md: -------------------------------------------------------------------------------- 1 | # jscript9.dll TypedArray/DataView Memory Corruption 2 | Proof-of-Concept exploit for jscript9 bug (MS16-063) w/ CFG bypass 3 | 4 | Tested on Windows 10 IE11 (modern.ie). 5 | 6 | ### Write-up 7 | http://theori.io/research/chakra-jit-cfg-bypass 8 | 9 | ### To run 10 | 1. Download exploit/jscript\_win10\_jit.html to a directory. 11 | 2. Serve the directory using a webserver (or python's simple HTTP server). 12 | 3. Browse with a victim IE to `jscript_win10_jit.html`. 13 | 4. (Re-fresh or re-open in case it doesn't work; It's not 100% reliable.) 14 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2016 Theori 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /exploit/jscript_win10_jit.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 173 | 174 | 175 | --------------------------------------------------------------------------------