Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS

vendor:

Acrobat Reader

by:

w3bd3vil and abh1sek

7,8

CVSS

HIGH

Bypass

CWE

Product Name: Acrobat Reader

Affected Version From: 9.5

Affected Version To: 11.0.1

Patch Exists: YES

Related CWE: CVE-2013-0640/1

CPE: a:adobe:acrobat_reader:11.0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 (32 bit), Windows 7 (64 bit) and Windows XP

2013

Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS

This exploit is a rip of the original exploit which works most of the times. It is a script which requires Ruby 1.9.x and Gems: origami, metasm. It is supported on Adobe Reader Versions 11.0.1, 11.0.0, 10.1.5, 10.1.4, 10.1.3, 10.1.2, 10.1, 9.5 and tested on Windows 7 (32 bit), Windows 7 (64 bit) and Windows XP. It is used to inject a PE executable into a PDF file.

Mitigation:

Update to the latest version of Adobe Acrobat Reader and use a reliable anti-virus software.

Source

Exploit-DB raw data:

CVE-2013-0640/1
Somehow, our script got on to the Russian forums :/

@w3bd3vil and @abh1sek

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29881.tar.gz

Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS
=================================================================

Supported Adobe Reader Versions:

* 11.0.1
* 11.0.0

* 10.1.5
* 10.1.4
* 10.1.3
* 10.1.2
* 10.1

* 9.5

Tested on:

* Windows 7 (32 bit)
* Windows 7 (64 bit)
* Windows XP

Script Requirements:

* Run on Windows :-)
* Ruby 1.9.x (http://rubyforge.org/frs/download.php/76752/rubyinstaller-1.9.3-p385.exe)
* Gems: origami, metasm (In command prompt type, gem install metasm && gem install origami -v "=1.2.5")

FYI:
a. It's a rip, of the original exploit.
b. Works most of the times.
c. We never really got into completing our script options though.

ruby xfa_MAGIC.rb -h
Usage: xfa_MAGIC.rb [options]
    -i, --input [FILE]               Input PDF. If provided, exploit will be injected into it (optional)
    -p, --payload [FILE]             PE executable to embed in the payload
        --low-mem                    Use Heap spray suitable for low memory environment
    -o, --output [FILE]              File path to write output PDF
    -h, --help                       Show help
(Some commands are not supported at the moment)

ruby xfa_MAGIC.rb -p example.exe -o poc.pdf