(Jan 29, 2024 12:57 AM)Spammino Wrote:  Hi guys, i'm kinda new to this so go easy on me 🙃
Is it possible to access to the content stored in a password protected pdf in any way?

(Jan 29, 2024 01:57 AM)eirian Wrote:  https://www.kali.org/tools/pdfcrack/
ez stuff :)

not to hijack the thread, but if anyone has any info on whether or not injects still work on pdfs/word docs i would appreciate that. i know it depends on the reader but typically people just open in chrome or office, but that's the extent of my knowledge

(Jan 29, 2024 06:59 AM)resetti Wrote:  By "injects", do you mean like shit that is built into Reader (like JS functionality) or Word (like VBA/Macro funcionality)??? In the case of Adobe Reader, there is no publicly available exploit which will execute a payload after opening a PDF file currently, the last publicly disclosed one was https://hacksys.io/blogs/adobe-reader-resetform-cagg-rce-cve-2023-21608
And the JS shit that u used to be able to do, they got rid of, so theres no type of "pdf macro" you can do.

Either way, it wouldnt be useful since 90% of computers now use Microsoft Edge as a default PDF reader, so now you need a sandbox escape zero day and an browser RCE zero day.

Regarding Macros, they have been disabled by default by Microsoft since 2019, but XLS and XLSM files still accept macros considering their file extensions. Though Word Macros dont work as well anymore since they disabled it.

Overall, your question is kinda vague and im not quite sure what you mean by "Injects", maybe you could elaborate.

Apart from that, i'll say the same thing i say to every kid who asks for a "silent pdf/word exploit", they do not exist without zero day exploits, and a zero day exploit that can silently execute code from a real PDF/Word document, would be worth upwards of $75,000-$150,000+, possibly and most likely raising to a higher price depending on the reliability and maturity of the exploit.

Good luck.

(Jan 29, 2024 01:50 PM)eirian Wrote:  just needed some pointers since im curious about vulnerabilities ive heard about before. that does make sense for something that easy of access to be in that sort of demand. same with the sandbox escapes, although would it be possible to extract browser cache/cookies without one? i had a vague understanding of how they worked, so thank you for the information :)