More doc updates

GSoC/Meterpreter_Web_Console
Jacob Robles 2018-08-29 10:59:36 -05:00
parent 88c908665d
commit d5ad683ba6
No known key found for this signature in database
GPG Key ID: 3EC9F18F2B12401C
2 changed files with 5 additions and 1 deletions

View File

@ -1,6 +1,6 @@
## Description
Foxit Reader v9.0.1.1049 and earlier are affected by use-after-free and uninitialzed memory vulnerabilities that can be used to gain code execution. This module uses Uint32Array uninitialized memory and text annotation use-after-free vulnerabilities to call WinExec with a share file path to download and execute the specified exe. The module has been tested against Foxit Reader v9.0.1.1049 running on Windows 7 x64 and Windows 10 Pro x64 Build 17134. Later builds of Windows 10 Pro x64 may need insecure logons enabled for the module to work.
Foxit Reader v9.0.1.1049 and earlier are affected by use-after-free and uninitialzed memory vulnerabilities that can be used to gain code execution. This module uses Uint32Array uninitialized memory and text annotation use-after-free vulnerabilities to call WinExec with a share file path to download and execute the specified exe. The module has been tested against Foxit Reader v9.0.1.1049 running on Windows 7 x64 and Windows 10 Pro x64 Build 17134. Windows 10 Enterprise needs to have [insecure logons enabled](https://support.microsoft.com/en-ca/help/4046019) for the exploit to work as expected.
## Vulnerable Application

View File

@ -20,6 +20,10 @@ class MetasploitModule < Msf::Exploit::Remote
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.
This module has been tested on Windows 7 x64, Windows 10 Pro x64
Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise
must have insecure logons enabled for the exploit to work as expected.
},
'License' => MSF_LICENSE,
'Author' =>