The vulnerability exists in HP LoadRunner Controller when handling a specially crafted LRS file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module exploits when sending specially crafted argument to makeMeasurement leaving objects in an inconsistent state. This produces a leak via a call to dumpMeasureData storing a file to a share folder with importante addresses and can later be retrieved .Finally using NSendApprovalToAuthorEnabled method it is possible to bypass the Javascript API restrictions and resend a new crafted PDF to the browser to produce buffer overflow and complete exploitation. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site.

This module exploits an integer overflow vulnerability in Adobe Flash Player. The signed integer overflow exists inside the AS3 Function.apply() method and allows an attacker to take control of a vulnerable target and execute arbitrary code.

Certain Javascript APIs in Adobe Acrobat Pro can only be executed in a privileged context. By adding specially crafted Javascript code to a PDF file it's possible to bypass security restrictions and invoke privileged Javascript APIs, allowing for arbitrary code execution. This exploit takes advantage of the AFParseDate() trusted function, which can call eval() with attacker-controlled input, in order to bypass the security restrictions and ultimately call Collab.uriPutData() to write arbitrary files into the victim's filesystem. The exploit will try to gain code execution on the victim's machine by potentially dropping two files: A DLL named updaternotifications.dll will be written into the same folder where the crafted PDF file is located in the victim's machine. This DLL will be automatically loaded by Adobe Acrobat Pro a few seconds after the crafted PDF file has been opened, as long as the Updater settings of Adobe Acrobat Pro is set to any option different than "Do not download or install updates automatically". An EXE file will be written into the %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup folder, if possible. This executable containing the agent code will be automatically executed upon next user logon into the vulnerable machine. In order for this EXE file to be dropped, the PDF file needs to infer the location of the %USERPROFILE% folder (typically something like C:\Users\JohnDoe) by inspecting the current path of the PDF file. This means that the EXE file will be dropped only if the PDF file is loaded from a path under the %USERPROFILE% folder in the victim's machine, such as the Desktop, the "My Documents" folder, or the "Downloads" folder.

This module exploits a vulnerability in the Windows Packager COM object (packager.dll). This module runs a web server waiting for vulnerable clients to connect to it. When the client connects, it will try to install an agent by exploiting the previous vulnerability.

This module exploits a Use-After-Free vulnerability in Adobe Flash Player. The specific flaw exists within the processing of AS3 ConvolutionFilter objects. By manipulating the matrix property of a ConvolutionFilter object, an attacker can force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. This vulnerability was one of the 2015's Pwn2Own challenges.

This module exploits a Use-After-Free vulnerability in Adobe Flash Player. The specific flaw is in the opaqueBackground property within the setter of the flash.display.DisplayObject class. This vulnerability was found in the HackingTeam's leak on July 2015.

This module exploits a Use-After-Free vulnerability in Adobe Flash Player. This vulnerability was found on the HackingTeam's leak on July 2015.

This module exploits a buffer overflow vulnerability in Adobe Flash Player when parsing malformed FLV objects. Attackers exploiting the vulnerability can corrupt memory and gain remote code execution.

This module exploits a Use-After-Free vulnerability in Adobe Flash Player. The specific flaw exists when the suscriber is not notified if a ByteArray assigned to the ApplicationDomain is freed from an ActionScript worker. By forcing a reallocation by copying more contents than the original capacity to the shared buffer by using the ByteArray::writeBytes method call, the ApplicationDomain pointer is not updated leading to a use-after-free vulnerability. This allows to overwrite different objects like vectors and finally accomplish remote code execution.