Prototype Pollution RCE in Adobe Acrobat Reader

This repository is a small, self-contained research PoC for an Adobe Acrobat exploit chain centered on malicious PDF JavaScript execution and post-exploitation file theft. It contains 4 files: a Python PDF generator (CVE-2026-34621.py), a Python HTTP collection server (c2.py), the main Acrobat JavaScript payload (payload_steal.js), and documentation (ReadMe.md). The main exploit flow is: the operator embeds payload_steal.js into a PDF using CVE-2026-34621.py; the generated PDF sets /OpenAction to a JavaScript action so code runs when the document is opened; the JavaScript then abuses Acrobat-specific internal functions and trust mechanisms to obtain privileged execution; finally it reads a local Windows file and exfiltrates it over HTTP in chunks. CVE-2026-34621.py is not itself the vulnerability trigger beyond embedding arbitrary JavaScript into a PDF. It is a helper utility that reads an external JS file, escapes it for PDF syntax, and writes a minimal PDF object structure with /OpenAction pointing to a /JavaScript action. This makes it the delivery builder for the exploit document. payload_steal.js contains the actual exploit logic. It defines a privileged file-stealing routine using app.beginPriv(), util.readFileIntoStream(), and app.launchURL(). It hardcodes the victim file path /C/Windows/System32/drivers/etc/hosts and exfiltrates the resulting hex data to http://192.168.56.1:45191/exfil. The script also contains the exploit chain primitives described in the README: injection through ANFancyAlertImpl with a crafted button key, prototype pollution using Object.prototype.__defineGetter__('swConn', ...), trusted function registration via app.trustedFunction.bind, fake object methods for path processing, and invocation of ANShareFile/SilentDocCenterLogin to redirect privileged workflow execution. c2.py is a simple operational support component rather than the exploit itself. It listens on 0.0.0.0:45191, accepts GET requests to /exfil, reconstructs chunked hex data into binary, and saves recovered files under exfiltrated_files/. It prints progress and validates whether the recovered file begins with a PDF header. Overall, this is a real exploit PoC repository rather than a detector. It demonstrates a file-based attack vector against vulnerable Adobe Acrobat Reader environments, with a hardcoded but functional payload and a matching receiver, making it operational rather than a bare conceptual proof.