Ethical Hacking and Penetration Testing Guide

Introduction
Before we actually get into creating a malicious PDF document, we will learn about the basics, 
which include the structure of a PDF document, using it for performing reconnaissance. So let’s 
begin.
The language of PDF is very descriptive, which gives us a wide variety of attack surface, so 
before jumping into the reconnaissance, first, let’s look at the basic structure of a PDF file. 
In-case if you open up a PDF document inside wordpad or a notepad editor, you would see the 
following sections:
1. Header
2. Body
3. Cross reference table
4. Trailer

---

202
◾ 
Ethical Hacking and Penetration Testing Guide
Header
The header, indicated in green, specifies the version of the PDF document, %PDF-1.1 in this case. 
The versions may vary from 1.0 to 1.7.
Body
The body is the part of a PDF document where all the objects, names, etc., are located.
Cross Reference Table
The cross reference table is indicated in purple. It has a highly defined structure and specifies 
where an object is located in a PDF document.
Trailer
The trailer will always begin from %%EOF as PDFs are always rendered from bottom up, so 
whenever you open up, it will start reading it from %%EOF and then it will jump and start to 
locate the line “Start Xref”, which is always followed by a number.
These definitions might look a bit complicated, but once you get into some advanced PDF 
attacks, you will get a hang of them.
PDF Launch Action
PDF launch action is one of the most useful features of a PDF document. With PDF launch 
action, you can actually launch other things along with PDF. PDF launch action was widely 
abused in the older version of Adobe Reader in which PDF launch action was used to spread 
malware and botnets such as Zeus.
This discovery was first made by M86 Security researchers. According to them, users would 
receive an e-mail with the subject “Royal mail delivery invoice.”

---

Client Side Exploitation
◾ 
203
The document contained an attached PDF that when downloaded by the users installed a Zeus 
bot on the victim’s computer.
The following dialog box appeared when the PDF document was opened. On pressing “Ok”, 
Zeus bot would be installed and executed in the PDF document.