Metasploit CVE-2015-5122 Flash Exploit Tutorial


In this tutorial we will be importing the CVE-2015-5122 (Adobe Flash opaqueBackground Use After Free) zero day Flash Exploit module in Metasploit and have a vulnerable setup download the malicious Flash file. Recent versions of Adobe Flash Player contain critical vulnerabilities within the ActionScript 3 ByteArray, opaqueBackground and BitmapData classes. Exploiting one of these vulnerabilities could allow a remote attacker to execute arbitrary code on the vulnerable system. CVE-2015-5122 is the 3rd zero-day exploit from the Hacking Team data breach and targets the Adobe Flash Player ( on Windows 7, Windows 8.1 and Google Chrome on Linux based computers. By the time of writing Adobe has already released security updates for Windows, Mac and Linux. This tutorial is for informational purposes only.

Metasploit CVE-2015-5122 Tutorial

First download the exploit code and make it available to Metasploit by creating an empty document and name it:


Than download the payload here:

And add it to the following directory:


Now copy the exploit code and paste it into the document.

Metasploit CVE-2015-5122 Flash Exploit 1

Use the following command to copy the file from the desktop to the Metasploit modules folder (create the flash folder first if needed:
mv /root/Desktop/Adobe_Flash_HackingTeam_exploit.rb /usr/share/metasploit-framework/modules/exploits/windows/flash/

Use the following command to check if the file has been actually copied to the destination folder:

ls /usr/share/metasploit-framework/modules/exploits/windows/flash/

Metasploit CVE-2015-5122 Flash Exploit 2

Let’s open a new terminal and start Metasploit (and services if not already started) using the following command(s):
service postgresql start
service metasploit start

Metasploit CVE-2015-5122 Flash Exploit 3

Now we’ve got Metasploit up and running with our newly imported exploit loaded, we use the following command to search for it:

search hackingteam

Now use the following command to use the newly added exploit:

use exploit/windows/flash/Adobe_Flash_HackingTeam_Exploit

Let’s check the options for Metasploit CVE-2015-5122 module with the following command:

show options

Metasploit CVE-2015-5122 Flash Exploit 4

We will keep the default options and type “run” or “exploit” to start the exploit:


Metasploit CVE-2015-5122 Flash Exploit 5

Let’s open the link from a Windows 8.1 virtual machine with a vulnerable browser (Firefox) and a vulnerable version of Flash Player ( installed.

Metasploit CVE-2015-5122 Flash Exploit 6

How to avoid getting infected by CVE-2015-5122 and other exploits…

– Update Flash Player and keep it up-to-date.
– Install security patches and keep your OS up-to-date.
– Install a virus scanner and firewall and keep it updated.
– Keep your browser up-to-date.
– Do not install unneeded plug-ins.

Metasploit CVE-2015-5122 Video Tutorial

Thanks for watching and please subscribe to our YouTube channel for more hacking tutorials :)



  1. Hi,

    Nice tuto, but, what’s the next step after the “magic” line :

    [*] adobe_flash_hacking_team_uaf – Sending SWF…

    Should I run a payload before running the exploit? I don’t really understand how to use this exploit…

  2. I used the payload correctly (meterpreter reverse tcp) but i’m stuck after this line:
    [*] adobe_flash_hacking_team_uaf – Sending SWF…
    The meterpreter session never appear.

Leave A Reply