PDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2)
summary
Step-by-step manual techniques for extracting obfuscated JavaScript from PDFs, decoding chained stream filters, and recovering hidden older object versions; demonstrates extracting an embedded EXE and a base64 image payload, brute‑forcing an XOR key from a raw stream, and handling missing cross‑reference tables. Uses peepdf (included in REMnux/BackTrack/Kali) with its update, interactive console, and library API; switches SpiderMonkey → V8/Pemu emulation for more reliable JS execution; shows killing infinite loops with -M and a working encrypt‑then‑embed trick to hide malicious code inside a benign PDF.
AI-written summary · about
chapters (4)
related talks
01h 03mEffects Malware hunting in Cloud environment
33mPDF - Mess With The Web
48mDiscovering C&C in Malicious PDF with Obfuscation, Encoding and Other Techniques
25mCommSec D1 - A Deep Dive Into Malicious Documents
44mHow to Break PDF Encryption
37mAbusing Adobe Reader’s JavaScript APIs
02h 27mHow hacking works (Workshop edition)
01h 01mHow to Break AI Systems (Before Someone Else Does)