0

I am learning *MSF on Kali but I ran into a problem.

I am trying a simple adobe_pdf_embedded_exe and when I set INFILENAME to something simple such as nutrition.pdf it cannot find the file, so obviously I need a path, right?

So I tried to set INFILENAME (directory). This indeed worked and let the process complete but when I type show options, it shows /root/downloads/nutrition.pdf as the INFILENAME.

I am confused how to set infilename and filename to nutrition.pdf without it showing the path in the show options. The guide I am following doesn't show how to set the path to the original PDF you want to target.

0
1

With the module loaded, type info at the console prompt. You'll see what it expects. The INFILENAME is the path with the existing PDF to use and the FILENAME is the filename to export the malicious PDF as.

msf exploit(adobe_pdf_embedded_exe) > info

       Name: Adobe PDF Embedded EXE Social Engineering
     Module: exploit/windows/fileformat/adobe_pdf_embedded_exe
   Platform: Windows
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2010-03-29

Provided by:
  Colin Ames <amesc@attackresearch.com>
  jduck <jduck@metasploit.com>

Available targets:
  Id  Name
  --  ----
  0   Adobe Reader v8.x, v9.x / Windows XP SP3 (English/Spanish) / Windows Vista/7 (English)

Basic options:
  Name            Current Setting                                                                                     Required  Description
  ----            ---------------                                                                                     --------  -----------
  EXENAME                                                                                                             no        The Name of payload exe.
  FILENAME        evil.pdf                                                                                            no        The output filename.
  INFILENAME      /pentest/exploitation/metasploit/data/exploits/CVE-2010-1240/template.pdf                           yes       The Input PDF filename.
  LAUNCH_MESSAGE  To view the encrypted content please tick the "Do not show this message again" box and press Open.  no        The message to display in the File: area

Payload information:
  Space: 2048

Description:
  This module embeds a Metasploit payload into an existing PDF file.
  The resulting PDF can be sent to a target as part of a social
  engineering attack.

References:
  http://cvedetails.com/cve/2010-1240/
  http://www.osvdb.org/63667
  http://blog.didierstevens.com/2010/04/06/update-escape-from-pdf/
  http://blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/
  http://blog.didierstevens.com/2010/03/29/escape-from-pdf/
  http://www.adobe.com/support/security/bulletins/apsb10-15.html
4
  • Ahh okay so the fact that it shows path in show options that is just noting where the original file is and will not show up on the end product? Gotcha. Thanks so much! Now what is the best/safest way to dig into this file to see the exploit and how it is coded? – SteelToe530 Jul 23 '16 at 21:43
  • Get yourself a copy of the SIFT virtual machine from SANS and use the forensics tools in there to analyze it, it will make sure that you don't compromise your host OS. – HashHazard Jul 24 '16 at 3:53
  • Thanks everyone! I can tell this site and the community here will be a great asset. – SteelToe530 Jul 25 '16 at 4:28
  • If the answer satisfied your question. Don't forget to accept it, helps others out as well. Welcome to Information Security. – HashHazard Jul 25 '16 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.