CVE-2015-5122 (HackingTeam 0d two - Flash up to 18.0.0.203) and Exploit Kits

Another 0d ( Patch expected in the coming week) was part of the files leaked from the HackingTeam compromission.

#HackingTeam So you said everything was patched ? @Adobepic.twitter.com/ER56kb2oqI

— dummys (@dummys1337) July 10, 2015

Code was fast disclosed, integrated to MetaSploit and as we were all expecting again, integration in Exploit Kits was a matter of hours.

Angler EK:
2015-07-11
Thanks Peter Pi from TrendMicro for CVE Id confirmation

Flash 18.0.0.203 exploited by Angler EK via CVE-2015-5122 in Firefox 2015-07-11

Sample in that pass : fcecd6b624bb50301a17d5aa423e135d
(out of topic payload : bedep calling additional malware [ 44ddbe75d4bca0097f84005969d5e671 Andromeda C&C : - adm-serv.com - 5.255.67.108 -- df1a4963f1b40592cf416b3b70980071 - pony news.php - 46f4b368a761d76a7f6d08cbfccd9ab6 Zeprox.B C&C 92.63.88.8]- and performing adfraud )

Files: Fiddler (password is malware)