Use-after-free in Adobe Reader and Acrobat Doc.media.newPlayer

This repository contains a single Metasploit module exploit targeting a use-after-free vulnerability (CVE-2009-4324) in Adobe Reader and Adobe Acrobat Professional up to version 9.2 on Windows. The exploit works by generating a malicious PDF file (default name: msf.pdf) containing JavaScript that performs a heap spray and triggers the vulnerable 'media.newPlayer' method, leading to arbitrary code execution. The module allows the user to select a Metasploit payload, which is embedded in the PDF and executed when a vulnerable user opens the file. The code is written in Ruby and leverages Metasploit's FILEFORMAT exploit mixin. No network endpoints are involved; the attack vector is purely file-based, requiring social engineering to convince a target to open the crafted PDF. The repository is operational and provides a working exploit with customizable payloads.

This repository contains a single Metasploit module exploit targeting a use-after-free vulnerability (CVE-2009-4324) in Adobe Reader and Adobe Acrobat Professional up to version 9.2 on Windows. The exploit works by serving a maliciously crafted PDF file via an HTTP server. When a victim opens the PDF in a vulnerable version of Adobe Reader (typically via a browser), embedded JavaScript performs a heap spray and triggers the vulnerability using the 'media.newPlayer' method, leading to arbitrary code execution. The module allows the attacker to deliver a customizable Metasploit payload (such as a reverse shell) to the victim. The code is written in Ruby and leverages Metasploit's HttpServer::HTML mixin to serve the exploit. The only fingerprintable endpoints are the served PDF file and a reference to Adobe's official security bulletin. The exploit is weaponized, as it is part of the Metasploit framework and supports customizable payloads.