0

We are running a purple team which includes attempting to run a malicious PDF on the target system. The targeted user is well aware of the exercise so there is no concerns about an AV picking the payload up, or about prompts (the user can simply agree to them).

However, they have the latest version of Adobe Reader installed. It was my impression that there were ways to execute commands or files using PDF files, similar to how a macro can execute commands within Word or Excel.

However all of the information I have found online targets specific vulnerabilities within readers, rather than abusing legitimate built in functionality. Is it impossible to run arbitrary code using a PDF file without abusing any specific vulnerability?

2
  • I believe postscript (and therefor pdf) do have a exec instruction of some kind. However most readers disregard it I think. I’ll try and look up the exact details later, if I do not forget.
    – LvB
    Sep 23 '20 at 6:35
  • @LvB Thanks! Let me know what you find, I couldn't find anything
    – trallgorm
    Sep 23 '20 at 15:59
2

Adobe Reader allows javascript in PDF to be interpreted (initially to allow features like form validation).

You can manually edit your PDF in notepad++ to add scripts in javascript.

One time I made a phishing campaign exercise based on this usecase. The script asked for a login password in a form to "open the protected document" and then they are sent over internet to my C&C (the action to send data to internet raise a warning to the user).

This resource should help you : https://www.decalage.info/file_formats_security/pdf

2
  • Yeah as if I would open a PDF by you :D
    – MechMK1
    Sep 24 '20 at 13:11
  • lol it's not a .pdf but a /pdf
    – Sibwara
    Sep 24 '20 at 13:14
0

There are some commands in Postscript that allow you to load in additional data from the VM. depending on how the VM is implemented this can include executing files.

regardless you can load in and write out data through the VM to the local system.. (this should be limited by the VM but is out of scope for the Language itself.

So you probably need to trick the VM into doing something it normally shouldn't in order to get anything useful.

Theoretically though you should not require an exploit like that to do something on your target.

Postscript Refrence Manual Portable Document format Specification 1.7 (PDF)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.