{"id":1595,"date":"2020-06-18T12:25:20","date_gmt":"2020-06-18T10:25:20","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1595"},"modified":"2025-03-19T13:00:45","modified_gmt":"2025-03-19T12:00:45","slug":"pdf","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1595","title":{"rendered":"PDF<\/span>"},"content":{"rendered":"\n

This is how a PDF<\/span> doc\u00adu\u00adment looks \u2014 with a JavaScript exe\u00adcu\u00adtion. Note that with Ope\u00adn\u00adAc\u00adtion 6 (object block 6) this block is exe\u00adcut\u00aded when the doc\u00adu\u00adment is opened.<\/p>\n\n\n\n

%PDF-1.6\n1 0 obj\n<< \/Type \/Catalog\n   \/Pages 2 0 R\n   \/OpenAction 6 0 R\n>>\nendobj\n2 0 obj\n<< \/Type \/Pages\n   \/Kids [3 0 R]\n   \/Count 1\n>>\nendobj\n3 0 obj\n<< \/Type \/Page\n   \/Parent 2 0 R\n   \/MediaBox [0 0 595 842]\n   \/Contents 4 0 R\n   \/Resources << \/Font << \/F1 5 0 R >> >>\n>>\nendobj\n4 0 obj\n<< \/Length 44 >>\nstream\nBT\n\/F1 20 Tf\n100 700 Td\n(Hello World) Tj\nET\nendstream\nendobj\n5 0 obj\n<< \/Type \/Font\n   \/Subtype \/Type1\n   \/BaseFont \/Helvetica\n>>\nendobj\n6 0 obj\n<< \/S \/JavaScript\n   \/JS (app.alert(\"Hello\");)\n>>\nendobj\n7 0 obj\n<< \/Type \/Action\n   \/S \/JavaScript\n   \/JS 6 0 R\n>>\nendobj\nxref\n0 8\n0000000000 65535 f \n0000000010 00000 n \n0000000060 00000 n \n0000000110 00000 n \n0000000210 00000 n \n0000000266 00000 n \n0000000322 00000 n \n0000000381 00000 n \ntrailer\n<< \/Size 8\n   \/Root 1 0 R\n>>\nstartxref\n450\n%%EOF\n<\/pre>\n\n\n\n
Oth\u00ader way to cre\u00adate a mali\u00adcious PDF<\/span>:<\/p>\n\n\n\n
    \n
  1. Pre\u00adpare \/ down\u00adload a trust\u00adwor\u00adthy look\u00ading PDF<\/span>.<\/li>\n\n\n\n
  2. Use exploit\/windows\/fileformat\/adobe_utilprintf to cre\u00adate a PDF<\/span> with a shell listener.<\/li>\n\n\n\n
  3. Open a listener<\/li>\n\n\n\n
  4. Bring the vic\u00adtim to open the file.<\/li>\n<\/ol>\n\n\n\n
    Analyse a PDF<\/span> file<\/h2>\n\n\n\n
    If a PDF<\/span> file is com\u00adpressed, decom\u00adpress it first.<\/p>\n\n\n\n
    pdftk input.pdf output output.pdf uncompress<\/pre>\n\n\n\n
    Get details with Pdfin\u00adfo<\/a><\/p>\n\n\n\n
    pdfinfo file.pdf<\/pre>\n\n\n\n
    Get infos with Pdf-parser.py<\/p>\n\n\n\n
      \n
    1. Get gen\u00ader\u00adal infos
      pdf-parser.py file.pdf<\/code>
      pdf-parser 2020-12-15-upload.pdf | grep \/Creator<\/code><\/li>\n\n\n\n
    2. At a object (obj 10 0) there could be bina\u00adry files attached, which are not in the out\u00adput. If you see some\u00adthing like a check\u00adsum or an indi\u00adca\u00adtion that a file could be includ\u00aded at this object, try the fol\u00adlow\u00ading:
      pdf-parser.py -o 10 -d out file.pdf<\/code><\/li>\n<\/ol>\n\n\n\n
      Check for inte\u00adgrat\u00aded streams, vari\u00adant with pdfde\u00adtach. (If the file is com\u00adpressed, try it with both ones!)<\/p>\n\n\n\n
        \n
      1. Use pdfdetach -list $file<\/code> to get the includ\u00aded streams.<\/li>\n\n\n\n
      2. Extract a stream with pdfdetach -save $streamId $file<\/code><\/li>\n<\/ol>\n\n\n\n
        Check for inte\u00adgrat\u00aded streams, vari\u00adant with base64dump<\/a>.: (If the file is com\u00adpressed, try it with both ones!)<\/p>\n\n\n\n
          \n
        1. Check streams:
          base64dump.py -e bc file.pdf<\/code><\/li>\n\n\n\n
        2. Extract stream 1 in a file:
          base64dump.py -e bx -s 1 -d file.pdf > stream1.exe_<\/code><\/li>\n<\/ol>\n\n\n\n
          Check for inte\u00adgrat\u00aded\u2026 files with bin\u00adwalk; it could be, that files are inte\u00adgrat\u00aded which are not stored as a stream: (If the file is com\u00adpressed, try it with both ones!)<\/p>\n\n\n\n
            \n
          1. Check for inte\u00adgrat\u00aded files:
            binwalk file.pdf<\/code><\/li>\n\n\n\n
          2. Extract files:
            binwalk --dd '.*' file.pdf<\/code>
            Now, the cur\u00adrent direc\u00adto\u00adry has sub\u00addi\u00adrec\u00adto\u00adries with the extract\u00aded files.<\/li>\n<\/ol>\n\n\n\n
            Get the pdf source<\/p>\n\n\n\n
            pdftosrc file.pdf<\/pre>\n\n\n\n
            Injection in PDF<\/span> files<\/h2>\n\n\n\n
            Include oth\u00ader files via anno\u00adta\u00adtion: See https:\/\/github.com\/mpdf\/mpdf\/issues\/356 <\/p>\n","protected":false},"excerpt":{"rendered":"
            This is how a PDF<\/span> doc\u00adu\u00adment looks \u2014 with a JavaScript exe\u00adcu\u00adtion. Note that with Ope\u00adn\u00adAc\u00adtion 6 (object block 6) this block is exe\u00adcut\u00aded when the doc\u00adu\u00adment is opened. Oth\u00ader way to cre\u00adate a mali\u00adcious PDF<\/span>: Analyse a PDF<\/span> file If a PDF<\/span> file is com\u00adpressed, decom\u00adpress it first. pdftk input.pdf out\u00adput output.pdf uncom\u00adpress Get details with Pdfinfo [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468],"tags":[9],"class_list":["post-1595","post","type-post","status-publish","format-standard","hentry","category-general","tag-pdf"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1595","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1595"}],"version-history":[{"count":18,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1595\/revisions"}],"predecessor-version":[{"id":4689,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1595\/revisions\/4689"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1595"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1595"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1595"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}