0

I have searched and found those posts how to embed exe file to pdf? and https://stackoverflow.com/questions/2941700/can-i-embed-an-exe-payload-in-a-pdf-doc-ppt-or-any-other-file-format, but they are all years ago. I have also found some recent blogs such as https://medium.com/purple-team/embedding-backdoor-into-pdf-files-1781dfce62b1, but I followed all the steps without success.

Is it still possible to use tools such as metaspolit to embed malware into a PDF, and to what extent should we still be cautious to, say, PDF attachments from a spam email? What's the worst can happen if I clicked open a PDF attachment on a well-patched computer with up-to-date anti-virus applications installed?

2 Answers 2

2

The problem is not "embed executables" - since arbitrary files can be embedded into a PDF. The problem instead would be to cause actual code execution. Such code execution is not a generic feature of PDF readers but security issues in specific products.

A simple search for pdf arbitrary code execution 2022 leads to several of such security issues found in 2022: several bugs in Adobe InDesign, bugs in Google Chrome, bugs in various other Adobe Products, bugs in MacOs, bugs in Foxit PDF reader.

So yes, the problems of just opening a PDF leading to code execution still remain. But it got harder to exploit issues since the bugs are more obscure today (quality of PDF readers improved) and since several products include sandboxes etc to limit the impact of a successful exploit.

... on a well-patched computer

Patches are issued after bugs are found and fixed. This means that the problem existed before and was likely exploitable before. In the best case the issue gets found by the vendor themselves or some researcher which reports it to the vendor and thus gets fixed before it is widely known.

But attackers are well financed to search for vulnerabilities themselves, so it is not uncommon that issues gets exploited before they get known and fixed by the vendor (i.e. zero day attacks).

... with up-to-date anti-virus applications installed?

Today's anti-virus products can provide some help when detecting and blocking unusual behavior. But since not everything unusual is malicious and not everything malicious shows up as unusual, there is fine line between blocking too much (false positives) and annoying the user and blocking to few (false negatives). The balance is usually to not annoy users too much since otherwise they will simply disable the protection. But this comes with the cost of also detecting less.

Thus, anti-virus helps a bit but it does not provide 100% security either. Nothing does.

1

I can't speak for the success of any specific tools these days, as it has been a long time since I've tried. As far as I know, most of those tools work by using JavaScript (or other scripting languages for other document formats/readers) to ultimately execute a payload for reverse shells or otherwise. Many modern PDF readers are very hesitant about running JavaScript, largely due to the fact that it has been abused so much. Programs may make use of JavaScript sandboxes to further restrict what scripts are capable of. With that in mind, I suspect the well-known methods of Metasploit would at least require a user clicking through warnings or changing settings, if the methods still work at all.

That said, there could always be a zero day in a piece of software, such as a PDF reader or the libraries it uses. Such exploitation could be successful regardless of how patched you are and how good your AV is, though you probably wouldn't be targeted with a zero day unless someone is very motivated to go after you specifically (and can afford to buy or research zero days).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .