Adobe has released a new Adobe Reader version with a fix for my /Launch action PoC PDF.
Before version 9.3.3:
Since version 9.3.3:
Not only is the dialog box fixed, but the /Launch action is also disabled by default.
Tuesday 29 June 2010
Friday 25 June 2010
Solving the Win7 Puzzle
The Win7 puzzle is actually a “PDF bomb”, something I’ve hinted at long ago but I hadn’t published a sample.
The PDF contains a doubly compressed object stream, which is around 100 MB large when uncompressed. Some of you might have experienced problems opening this PDF file in your favorite PDF reader, this is because it couldn’t handle an uncompressed stream of 100 MB. Which isn’t actually that large, a PDF bomb of 1 GB or 10 GB isn’t that much larger in compressed form…
If you used my pdf-parser, you’ve also encountered a problem. The objects lack the endobj keyword. A simple solution: add the missing keyword and extract the stream with my parser. The stream is 100 MB of spaces, with a small text in the middle: “De Ultieme Hallucinatie”. One way to extract this text is to trim the spaces of the 100 MB string.
If you’re interested in different solutions, be sure to read the comments of the Win7 Puzzle.
De Ultieme Hallucinatie (The Ultimate Hallucination) was a nice Art Nouveau cafe/restaurant in Brussels. But the Windows 7 Ultimate license won by Vincent is no ultimate hallucination 😉
Thursday 3 June 2010
A Win7 Puzzle…
I’m presenting you a little puzzle…
The prize is a Windows 7 Ultimate license. Unless you don’t care for Windows, then you get a sticker 😉
The puzzle contains a text. Find it and post it in a comment to this post. You don’t have to be the first with the correct text to win. This challenge will run for a week, and I’m randomly selecting a winner from all the correct entries.
Comments are moderated and will not appear as long as the challenge is on.
Download the puzzle and find the text.
Tuesday 18 May 2010
Quickpost: More Malformed PDFs
Here’s a heads up for some malicious PDF samples that are deliberately malformed to avoid detection.
The most important case is the missing endobj keyword:
Adobe Reader will happily parse a PDF where the object are not terminated with endobj, but my pdf-parser won’t. I’ll have to update the parser to deal with this case.
The cross-reference table can also be omitted:
This is not an issue for my parser.
And then I also received a sample with a stream object, where the case of the endstream object was wrong: Endstream. First we assumed Adobe Reader was not case-sensitive for the endstream keyword, but I found out it can actually parse a stream object with missing endstream keyword:
This is an issue for my parser.
Tuesday 4 May 2010
Writing WIN32 Shellcode With a C-compiler
I wrote an article in Hakin9 magazine how to write shellcode with a C-compiler.
People before me have worked out methods to do this; the advantage of my method is that you can debug your shellcode inside the Visual Studio IDE.
The template can be found here.
Thursday 29 April 2010
Update: PDFiD Version 0.0.11 to Detect /Launch
Now that malicious PDFs using the /Launch action become more prevalent, I release a new PDFiD version to detect (and disarm) the /Launch action.
Tuesday 13 April 2010
.NET Shellcode
As it is easy to instantiate the CLR in a process and load an assembly from C-code, I developed shellcode to load a .NET assembly in the injected process.
This allows you to leverage the extended Framework Class Library in your penetration tests.
Tuesday 6 April 2010
Update: Escape From PDF
Some new info after last week’s Adobe and Foxit escapes.
Foxit Software has release a new version to issue a warning when using a /Launch action, like Adobe Reader does:
The interesting thing about this fix is that it breaks my Foxit PoC, but that the Adobe PoC works for Foxit now!
This means that Foxit Software changed the way arguments are passed to the launched application (in the previous version, it didn’t work per the PDF standard, and that’s why I had to use a workaround). I draw some interesting conclusions from this:
- Nobody used the /Launch action in Foxit Reader with arguments. It didn’t work, and I assume Foxit would have received bug reports about this and fixed it by now.
- Nobody used the /Launch action in Foxit Reader with arguments via the workaround. Because this fix breaks the workaround, and I assume Foxit would not have broken a feature used by some of its users.
- From 1. and 2., I can say nobody used the /Launch action in Foxit Reader with arguments.
Adobe Reader has a Trust Manager setting to disable opening non-PDF attachments with external applications.
This setting also disables the /Launch action:
For more details about the PoC, I refer to my interview on the Eurotrash Security podcast.
Wednesday 31 March 2010
“Escape From Foxit Reader”
Thanks to a tip from @riotz, I got my PoC PDF working on Foxit Reader. Remember, Foxit Reader issues no warning when launching a command! So I get to execute an embedded .EXE without any user interaction (except for the opening of the PDF document).
Monday 29 March 2010
Escape From PDF
This is a special PDF hack: I managed to make a PoC PDF to execute an embedded executable without exploiting any vulnerability!
I use a launch action triggered by the opening of my PoC PDF. With Adobe Reader, the user gets a warning asking for approval to launch the action, but I can (partially) control the message displayed by the dialog. Foxit Reader displays no warning at all, the action gets executed without user interaction.
PDF viewers like Adobe Reader and Foxit Reader don’t allow embedded executables (like binaries and scripts) to be extracted and executed:
But I found another way to launch a command (/Launch /Action), and ultimately run an executable I embedded using a special technique. With Adobe Reader, a launch action needs to be approved by the user:
But I can partially control the message displayed by this dialog box:
I can use this to social-engineer users to “Open” the file:
Do you believe this could this mislead some of your users? Or maybe you can come up with a better message to fool your users.
With Foxit Reader, no warning is displayed:
I’m not publishing my PoC PDF yet, but you can download a PDF that will just launch cmd.exe here. Use it to test your PDF reader.
With Adobe Reader, the only thing preventing execution is a warning. Disabling JavaScript will not prevent this (I don’t use JavaScript in my PoC PDF), and patching Adobe Reader isn’t possible (I’m not exploiting a vulnerability, just being creative with the PDF language specs).
I shared my PoC with Adobe’s PSIRT. Maybe they will come up with a solution to prevent this, should they consider that the protection offered by the warning dialog is not sufficient. BTW, preventing Adobe Reader from creating new processes blocks this trick.
In this case, Foxit Reader is probably worse than Adobe Reader, because no warning gets displayed to prevent the launch action. My PoC PDF requires some changes for Foxit Reader, because ultimately, the executable doesn’t run. But that’s probably due to some variation in the PDF language supported by Foxit Reader.
Tested with Adobe Reader 9.3.1 on Windows XP SP3 and Windows 7.
Didier Stevens 