PDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 1/2)
summary
Hands‑on walkthrough of extracting and deobfuscating exploit‑kit JavaScript to reach the second‑stage payloads, focused on PDF exploits and using peepdf plus JavaScript engines (pv8, Rhino/SpiderMonkey) to hook eval/replace with print and beautify output. Demonstrates simple Python helpers that pull <script> content and download exploit paths, reveals typical kits carry six or seven exploits (Java, PDF, Flash, IE), and documents anti‑analysis tricks (user‑agent/VM checks, one‑time URLs, TDS). Includes exercises to modify/obfuscate PDFs and test AV bypasses; shows the techniques reliably extract and identify the actual exploit used.
AI-written summary · about
chapters (21)
- 0:00Intro
- 2:50Pamplona
- 3:30What you need
- 5:40Statistics
- 6:48Most Wanted Split Kids
- 7:28Traffic Distribution System
- 8:38Filtering
- 10:15VM Detection
- 11:15How to Analyze
- 14:00Getting the Code
- 15:05Example Email
- 16:12Example Page
- 16:59Remove HTML
- 18:58If Window Document
- 20:22PDF Muse
- 21:33Document Create Element
- 23:30Global Context
- 25:13Second Stage
- 28:00Detect
- 29:57Scripts
- 46:54IE Exploit Code
related talks
01h 03mEffects Malware hunting in Cloud environment
33mPDF - Mess With The Web
48mDiscovering C&C in Malicious PDF with Obfuscation, Encoding and Other Techniques
33mOffensive Javascript Techniques for Red Teamers
25mCommSec D1 - A Deep Dive Into Malicious Documents
02h 27mHow hacking works (Workshop edition)
01h 01mHow to Break AI Systems (Before Someone Else Does)
01h 06mHow hacking works