metasploit-framework

Msf::Exploit::Remote::HttpServer::HTML#js_property_spray

This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty)
function to trigger allocations by ntdll!RtlAllocateHeap.  It is based on Corelan's
publication on "DEPS – Precise Heap Spray on Firefox and IE10".  In IE, the shellcode
should land at address 0x0c0d2020, as this is the most consistent location across
various versions.

The "sprayHeap" JavaScript function supports the following arguments:
  shellcode     => The shellcode to spray in JavaScript.  Note: Avoid null bytes.
  objId         => Optional. The ID for a <div> HTML tag.
  offset        => Optional. Number of bytes to align the shellcode, default: 0x00
  heapBlockSize => Optional. Allocation size, default: 0x80000
  maxAllocs     => Optional. Number of allocation calls, default: 0x350

Example of using the 'sprayHeap' function:
  <script>
  #{js_property_spray}

  var s = unescape("%u4141%u4141%u4242%u4242%u4343%u4343%u4444%u4444");
  sprayHeap({shellcode:s, heapBlockSize:0x80000});
  </script>

Source | Google | Stack overflow