Stack-based buffer overflow in Adobe Acrobat and Reader util.printf

This repository is a small proof-of-concept lab for CVE-2008-2992 centered on malicious PDF delivery against vulnerable Adobe Reader on a Windows 7 victim. It contains two code files and two documentation files. The main attacker workflow is in scripts/automated_hack.sh, a Bash automation script for Linux/Kali that installs gnome-terminal, derives the local IP address, uses Metasploit's exploit/windows/fileformat/adobe_pdf_embedded_exe module to generate a malicious PDF named myresume.pdf with a windows/meterpreter/reverse_tcp payload, launches a multi/handler listener on TCP port 4444, waits for the handler to initialize, and then uploads the PDF to the victim via anonymous FTP at 10.80.76.3. The exploit capability is therefore automated weaponization and delivery of a malicious PDF plus listener setup for a reverse shell. The victim-side helper is scripts/automated_user_behavior.py, a Windows Python script that continuously monitors C:\Users\vboxuser\Documents for new PDF files, opens them with the default application, and simulates keyboard input using ctypes/user32 keybd_event to navigate and confirm dialog boxes. Its purpose is to emulate user behavior and ensure the malicious PDF is opened and prompts are accepted, increasing exploit reliability in the lab. The documentation explains that the project targets CVE-2008-2992 and provides a prepared Windows 7 VM image with vulnerable Adobe Reader, Python, FTP server, and website components. Overall, this is a real exploit repository rather than a detector: it automates payload generation, delivery, and session handling, while relying on a controlled lab configuration and Metasploit modules for the actual exploitation mechanics.

This repository contains a single Metasploit module exploit targeting a buffer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions prior to 8.1.3 (CVE-2008-2992). The exploit works by generating a specially crafted PDF file (default name: msf.pdf) containing obfuscated JavaScript that triggers a buffer overflow via the util.printf() function. When a victim opens the malicious PDF with a vulnerable version of Adobe Reader/Acrobat on Windows, the embedded shellcode is executed, allowing arbitrary code execution with the user's privileges. The module is fully integrated into the Metasploit framework, allowing for customizable payloads. The attack vector is local, requiring the victim to open the malicious file. The only fingerprintable endpoint is the generated PDF file itself. The code is mature and weaponized, suitable for real-world exploitation within the Metasploit ecosystem.

This repository contains a single Metasploit module (adobe_utilprintf.rb) that exploits a buffer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions prior to 8.1.3 (CVE-2008-2992). The exploit works by serving a specially crafted PDF file containing malicious JavaScript that triggers a buffer overflow via the util.printf() function, allowing arbitrary code execution. The module is written in Ruby and leverages Metasploit's HttpServer::HTML mixin to deliver the PDF to victims who visit the attacker's web server. The payload is customizable and can be any Metasploit-compatible shellcode, typically resulting in a reverse shell or Meterpreter session on the victim's Windows machine. The exploit targets users who open the malicious PDF in a vulnerable version of Adobe Reader/Acrobat on Windows. The repository structure is typical for a Metasploit exploit module, with all logic contained in a single Ruby file.