Log in

View Full Version : Please help analysing new SWF exploit!

Marcos
July 14th, 2009, 08:07
Hi everyone!

In attached zip:

swf.swf - original swf file
swf-unpacked.swf - unpacked swf file (zlib)
BinaryData.as, Main.as - results of Sothink SWF Decompiler
data.bin - binary results of XOR in ActionScript

From that point I can't find shellcode and the URL, from where executable is downloading.

Please help! Thanks!
disavowed
July 14th, 2009, 09:05
in this case, Flasm (http://www.nowrap.de/flasm.html) might be more useful than SWF Decompiler
Marcos
July 14th, 2009, 09:15
Quote:
[Originally Posted by disavowed;81747]in this case, Flasm (http://www.nowrap.de/flasm.html) might be more useful than SWF Decompiler


Thanks, but I've used it and it outputs:

Code:
movie 'swf-unpacked.swf' // flash 9, total frames: 1, frame rate: 24 fps, 1x1 px

  

  fileAttributes attrUseNetwork,attrActionScript3

  

  scriptLimits recursion 1000 timeout 60

  

  // unknown tag 82 length 27271

  

  // unknown tag 76 length 9

end


so, the problem is not in decompiling swf file.
The problem is to analyze binary data, that AS3 puts in memory (loadBytes)
and to find shellcode there!
evaluator
July 14th, 2009, 16:11
binarydata.as shold decrypted again to SWF. tomorrow will see

ps. data.bin is invalid unicode
evaluator
July 15th, 2009, 00:09
ok, did it. finally we have little different SWF, which we discussed before here in forum.
evaluator
July 15th, 2009, 02:05
here are run_able shellcodes. but internet-address not responds with Malware.
Bad!?
NCR
July 20th, 2009, 08:03
Hi!,

i would like to know if you have any information about the vulnerability this swf is trying to exploit (CVE perhaps).

Thanks in advanced!.
NCR
July 20th, 2009, 08:29
Quote:
[Originally Posted by evaluator;81779]ok, did it. finally we have little different SWF, which we discussed before here in forum.


can you provide me the link to the previous discussion thread?.
evaluator
July 20th, 2009, 09:51
NO-NO-NO! previous discussion thread is strictly secure ~=)
btw, THAT "Marcos", no said even single "thanks" ?! whu_ze_fu!?
NCR
July 20th, 2009, 09:55
Quote:
[Originally Posted by evaluator;81943]NO-NO-NO! previous discussion thread is strictly secure ~=)
btw, THAT "Marcos", no said even single "thanks" ?! whu_ze_fu!?


ok, so can you tell me if this is a known and public vulnerability or a 0-day?, do you have any information, link to adv, cve?.
evaluator
July 20th, 2009, 14:18
NO-NO-NO! << you not guess joke.
http://www.woodmann.com/forum/showthread.php?t=12399
NCR
July 20th, 2009, 14:25
Quote:
[Originally Posted by evaluator;81950]NO-NO-NO! << you not guess joke.
http://www.woodmann.com/forum/showthread.php?t=12399


hahaha ok!, thanks!!!