Tuesday, March 15, 2011

CVE-2011-0609 - Adobe Flash Player ZeroDay

First information about new zero day in adobe flash player was published 03/11/2010 at

Then after 3 days Adobe confirmed bug and released advisory

Filename: crsenvironscan.xls
Size:126,444 bytes
MD5 Hash: 4BB64C1DA2F73DA11F331A96D55D63E2

My analysis of  crsenvironscan.xls
There are no vulnerabilities in MS Office, there is a vulnerability in embeded swf as was described below.

1) There are embeded swf
(target file name f:\sm.swf)

This swf provide heap spray and then load second swf
view source code

it allocates memory
NOP Slide =14141414

then loads second swf.

2) second.swf consist bug

File created possibly by using a fuzzer from

looks like there are bugs exist when flash player attempts to parse a swf file.
Unknown opcode 152.
Unknown opcode 84. 
(detailed analysis will be provided soon) 
3) Shellcode
this is EmbededExec shellcode,not encrypted.
decompiled shellcode 
Shellcode search for exe between
       cmp     dword ptr [eax], 47422E43h
       cmp     dword ptr [eax+4], 19890604h
hex code "432e424704068919" and
      cmp     dword ptr [eax], 4B635546h
      cmp     dword ptr [eax+4], 19820424h 
hex code "4655634b24048219"

if point view on this
as for me, that looks like some string and date

C.GB  1989/06/04    -  it may mean 1989-06-04 Tiananmen, Beijing, China

FucK 1982/04/24    - ?

If you have any ideas, post in comments

Encryption of exe is interesting. 
First 4 bytes of exe header writed from shellcode
then encrypted date decrypts using this algo
 where eax - size of exe
       xor     [ebx], al
       inc     ebx
       dec     eax
       inc     ebx
       dec     eax
       cmp     eax, 0 
       jmp  decrypt
This is for the first time I see such encryption in exploits found in the wild.
This is used to bypass scanners, which searches for the exe header.
4) Exe 
size 46,048 bytes
MD5: 1e09970c9bf2ca08ee48f8b2e24f6c44
Download Payload File   a.exe 
pass: infected  Virustotal 0/43

Information from PEiD InstallShield AFW [CAB SFX]

Sample download link
password : infected

Other samples you can get from Mila Parkour site:


  1. http://www.savetibet.org/policy-center/chronology-tibetan-chinese-relations-1979-2008

    April 24, 1982 - A high level Tibetan delegation arrives in Beijing to hold exploratory talks with Chinese officials. The delegation, composed of P.T. Taklha, Juchen Thubten Namgyal and Lodi Gyari, made no substantive headway.

  2. April 24, 1982 - Initial Release and Review date of "Chan is Missing" the first movie to be released in the United States about Chinese Americans living in Chinatown San Fransisco (Director Wayne Wang). Haven't seen it but reviews suggest it is offensive to some.

  3. from twitter:
    yuange1975 Yuange
    @villys777 19820424 is the birthday of my friend. btw, shellcode contains a error where jnz should be jmp after free-ing a heap.

  4. crsenvironscan.xls download link?

  5. samples download link, will be provided after adobe patch.

  6. Dear Villay, i tried to execute above sample (CVE 2010-0609) but it is not working

  7. Excellent goods from you, man. I have understood your stuff previous to and you're just extremely great. I actually like what you have acquired here, really like what you’re saying and the way in which you say it. You make it enjoyable and you still care for} to keep sensible.

    EV SSL | Wildcard SSL Certificate

  8. Interactive home security systems from Protection Concepts based in Marietta and serving Atlanta, Georgia. Monitoring starts at $14.95 a month.

    Atlanta Security provider

  9. Removewat is my fav one in computers category..please share it :)

    1. Hello Zubair!! removewat 2.2.9 is also my fvrt but me use also latest one ;)

  10. Please also share about Removewat ..Waiting :)

    1. you can easily download removewat here and if you need this latest tool then download Latest version of removewat 2.2.9 from here Enjoy!!!!

  11. Should you be thinking of writing a blog, this information has some good concepts to assist you make something great. Regardless of whether you need to make money with it, or simply just communicate with your loved ones, operating a blog might be a wonderful approach to conversation. Read on to understand how to make the most of your running a blog practical experience.

  12. Hello just wanted to give you a quick heads up and let you know a few of the images aren’t loading correctly.
    I’m not sure why but I think its a linking issue.


    1. Hello just wanted to give you a quick heads up and let you know a few of the images aren’t loading correctly.
      I’m not sure why but I think its a linking issue

      IDM 6.21 Full Crack

  13. I am ?egular reader in your blog, how are you everybody? This piece of writing posted
    at this web page is truly pleasant.

    Corel AfterShot Crack

  14. I am actually happy to read this webpage posts which carries
    tons of useful data, thanks for providing these kinds
    of data. Thanks for sharing. . . . . . .

  15. Thanks for your nice article. Please keep sharing in the future!
    happy wheels
    car games

  16. Thank you so much for this article. I've been finding it :) It will helps me much. I hope to see more and more posts of yours in the future :)
    car parking games | car games | game online | starcraft web | starcraft online | starcraft html5 | starcraft

  17. I just want to say : why you do not click to play
    minecraft games

  18. Good post however , I was wondering if you could write a litte more on this subject?
    - happy wheels
    - happy wheels
    - tetris
    - brain games
    - puzzle games
    - agario
    - abcya
    - fnaf

  19. You shall not worry anything, Do not know what to say to you about this blog,Very liked your article have many entries or more connect with a respected provider developer’s to more post come.
    cool math games and fun math activities
    Cubefield 2 Game
    give you opportunity to enjoy Happy
    Take out car insurance

  20. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    earn to die
    Hi! I’ve been reading your blog for a while now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    tank trouble
    tank trouble

    earn to die 1

    earn to die 2

    earn to die 3

    tank trouble 4
    tank trouble 3
    tank trouble 2

  21. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!

    hotmail sign in Hotmail is an email account of Microsoft Corporation. Like Google’s Gmail, it is full of the features of a regular email.

    hotmail login Hotmail was previously a quite popular email service. It has the features and utilities similar to other email services, but users encountered many annoying issues, and even lost fees they had paid for this service.

    recover hotmail password Therefore, there are many users who have a registered Hotmail account but no longer wish to use it as they are unhappy with the service.

    sign in to Hotmail  At this time, some users sought to remove their Hotmail account, but has some difficulties as it is a complicated process.

  22. I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again..

    wings.io | happy wheels unblocked | unblockedgames | sesxebi online | unblocked games at school
    | wings.io skins | wingsio | wings.io | wings.io

  23. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success!
    slitherio | unfair mario 2 | age of war 2
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    cubefield | tank trouble | happy wheels |earn to die 1 |
    earn to die 6 |earn to die 6| duck life


  24. In your blog I was happy to see your article, better than last time, and have made great progress, I am very pleased. I am looking forward to your article will become better and better.

    Geometry dash

  25. This is the game so players feel very fierce , adventurous . You try to join and play this game , you will feel great like.
    | tank trouble | learn to fly
    gun mayhem | can your pet
    | happ wheels

  26. I found a lot of information here to create this actually best for all newbie here. Thank you for this information.
    red ball 4 | ninjago games | strike force kitty 2 | red ball 3 | ninjago games

  27. I would like to thank you for the efforts you have made in writing this article.
    super smash flash 2 unblocked | strike force kitty | super smash flash | super smash flash 2

  28. This research is practically done by you and gives good ideas.
    visit here some useful content here
    Adobe phone help NumberUSA+1-844-442-0111

  29. Well Blog We Provides Adobe Flash Player Support, Adobe Flash Player Help, fix Adobe Flash player problems, Issues, Errors visit now Adobe Flash Player Support Toll Free Phone Number 1-888-221-6490 Phone Number 1-888-221-6490

  30. This is one of the cult game now, a lot of people enjoy playing them . Also you can refer to the game :
    animal jam 2 | five nights at freddys 2 | hotmail login

  31. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. Great work.
    friv baby game
    friv racing game
    friv shooting game
    game for girl 2
    girl games 3
    girl game school

  32. The information you have posted is very useful. The sites you have referred was good. Thanks for sharing.. Check out Best garbage disposal reviews

  33. Hey, Nice piece of information about Adobe. If you come to face any difficulty while using Adobe Flash, then our experts will guide you at Adobe Helpline Number UK

  34. I really need to look over come to visit here. FIFA 17 Crack

  35. I really need this information, thanks for sharing, nice article.

  36. Adobe flash player is necessary to play videos online on web. IDM Serial Key

  37. Great post I would like to thank you for the efforts you have made in writing this interesting and knowledgeable article.
    hotmail sign

  38. Hey admin your sharing way is unique. This is fantastic site…I enjoyed reading your articles. This is truly a great read for me.
    TunnelBear 3.6.0 Cracked

  39. puffgamesHere are the most popular online games to play for free. Puffgames is the best place to play high-class browser games; Also you can find all most played game on it.

  40. its really great website, thanks for shearing.

  41. I am really happy to visiting your site, such an beautiful site it is.Thanks for shearing whit us