Embedding malware into the documents.
It's very common for malicious software to be embedded in a widely used document such as a PDF or office
document.
Let's look and see what Métis framework has for this purpose in MSF Shell.
And you already know how to open the MSF shell simply type MSF console in the terminal screen of Calli.
If you search for Adobe in PDF words, you see that Métis fluked framework has two exploits to embed
a malware into a PDF file.
And thankfully the ranks of the exploits are excellent, which means they will work very good and stable
in the ideal circumstances.
Of course, you need an appropriate payload for the exploit.
When you look at the options of the exploit using show options command, you see that the target of
the exploit is Adobe Reader with versions eight or nine, which is running Windows XP, Vista or seven.
When you gather information about the target company, you probably find this information which operating
systems are used, which readers are preferred, which versions are used, et cetera.
Suppose that you don't have any clue that the target operating systems and or readers are used in this
company still, isn't it worth it to try?
Now is the question.
Can you find any device running an old version of operating system and an old version of the reader?
Answer is, of course.
Do you remember the want to cry ransomware attacks?
The attack affected more than 300000 computers across 150 countries, including the UK's NHS health
systems.
The malware was using a vulnerability where Microsoft had already released a patch for it two months
before the want to cry attack, but the attack affected hundreds of thousands of computers because they
are always out of date.
If you could find a few machines that fit these conditions, it might be enough for you to hack the
entire company.
The next step is to set the options.
Set the template PDF file in filename, if you don't, Métis split framework will use its own template,
set the output PDF file name, file name.
If you don't need a separate framework, will name it as evil dot pdf.
Now set the options of the payload you choose if you choose reverse https interpreter payload like me
set the IP address of the listener l'Est set the listener port.
If you don't want to use the default one airport when you're finished setting your options.
You can use, exploit or run commands to generate the file.
Now you must bring the file and computer users.
I mean victims together send the file in a phishing email, copy the file and flash drives and give
them as gifts, write the file and CDs and spread them in the company if you can, etc..
By merging a malicious PDF with another arbitrary PDF file, you can make it more difficult for antivirus
is to recognize it in the first picture, a windows slash mateparae to slash reverse underscore TCP
payload embedded PDF file is scanned in virus total dot com.
No obfuscation or customization was performed, so 30 of 47 antivirus programs detected it in the second
pick.
A custom payload using windows slash interpretor slash reverse underscore htp.
S payload of Métis Voit was created by Vayle and embedded into the PDF file.
17 of 47 antivirus programs detected the malware in the third picture.
The document used in the second picture was merged with a clean PDF file.
In this time, only 10 of 47 antivirus programs detected the malware.