1. Metasploit – Embedded PDF Exploit Presented by: Jesse Lucas

2. Tools / Assumptions Attacker – BackTrack 4.2 Metasploit Framework 3.0 PDF file for embedding Victim – Windows XP File and Printer Sharing Adobe Reader 8.0 – 9.0

3. Exploit Concept Attacker embeds exploit in a PDF file Victim opens the PDF file –Unknowingly saves and runs exploit Attacker takes control of victim machine

7. Exploit Demos Live Demo Offline Demo

8. Start BackTrak

9. Open 2 Terminals

10. Open msfconsole in both Terminals

11. Setup Exploit

12. Setup Exploit Handler

13. Wait for Victim to Open PDF

14. Prey on their Ignorance

15. Victim is now a Victim

16. Attacker now has Access

17. Example of Control

18. Example of Control (cont)

19. Setup Exploit 2

20. Setup Handler 2

21. Wait for Victim to Open

22. Prey on Victim’s Ignorance

23. Ta Da! Attacker has a VNC Session

24. Example of Control

25. Example of Control (cont)

26. Prevent the Attack DO NOT open files from people you don’t know DO NOT allow firewall exceptions for applications you don’t know KEEP popular programs up to date DISABLE File and Printer Sharing if you aren’t using it

27. Questions?