The document discusses various client-side exploits that can be carried out using PDF files. It describes how launch actions, AcroJS (Adobe JavaScript), and embedded executables can be used to exploit vulnerabilities in PDF readers. Specific vulnerabilities and a proof-of-concept example using a hex-encoded executable embedded in comments are presented. The document also covers obfuscation techniques used to evade detection, such as modifying the PDF format and using JavaScript obfuscation.

1. BY, ANKUR BHARGAVA (INFOSYS TECHNOLOGIES LIMITED) TAMAGHNA BASU (SECURITY RESEARCHER) Client Side Exploits using PDF C0C0N Security & Hacking Conference

2. Contents About PDF Launch Action Exploits AcroJs Exploits Road Ahead Tools and References

6. Adobe PDF – Security Issues

7. 2010: Still Continuing…

8. 2010: Still Continuing… March April May June

12. Popular in malwaredomainlist.com

16. PDF Document Structure PDF Header Objects Trailer Body Cross reference Table

22. Launch Action Vulnerability

24. Launch Action Vulnerability Confidential Data!! If You are Authorized Click on 'Open'. Check 'Do Not Show This Message Again' to avoid this dialog next time

25. Launch Action Vulnerability

26. Launch Action in 9.3.3

27. Launch Action Vulnerability

31. Evading Antivirus

40. Acrojs examples launchURL Alertbox

41. Acrojs examples

42. Acrojs examples

47. Javascript Obfuscations : Unlearn Coding Ethics

48. Distorting format Normal Code Obfuscated Code function execute(data, time) { Timelag=5000; if (time > Timelag) { // some code } } function overflow(hex, loop) { for (i=0;i<loop;i++) { hex = hex + hex; } } function overflow(hex, loop){for (i=0;i<loop;i++){hex = hex + hex;}} function overflow(hex, loop) {for i=0;i<loop;i++){hex = hex + hex;} }

49. Obfuscating Identifiers Normal Code Obfuscated Code function execute(data, time) { Timelag=5000; if (time > Timelag) { // some code } } function overflow(hex, loop) { for (i=0;i<loop;i++) { hex = hex + hex; } } function aeiou(lIlIIlI, O0OOOO0OO000OO) { WWMWMMWMWMWMW=5000; if (O0OOOO0OO000OO > WWMWMWMWMWMW) { // some code } } function aimpq(xxwmnnx, pqrtxw) { for (dqweaa=0; dqweaa < pqrtxw; dqweaa ++) { xxwmnnx = xxwmnnx + xxwmnnx;; } }

50. Obfuscating Identifiers – Even Worse Differentiating with number of underscore characters function _____(____,__________) { ______________=5000; if (__________>______________) { // some code } } function ___(_______, ______) { for(________________=0; ________________<______; ________________ ++) { _______ = _______ + _______; } }

51. Obfuscating Identifiers – Even Worse Differentiating with number of underscore characters function _____(____,__________){______________=5000;if (__________>______________){// some code}}function ___(_______, ______){for(________________=0; ________________<______; ________________ ++){_______ = _______ + _______;}}

52. Chain of Eval Normal Code Obfuscated code app.alert(“c0c0n”) func=&quot;eval&quot;; one='app.alert(&quot;c0c0n&quot;)'; two=eval(one); three=eval(two); eval(func(three));

53. Splitting Javascript Normal code Obfuscated Code app.alert(“hello world”); Rt=“);”; Td=“ert(hel”; Ab=“ap”; Qw=“ld”; Kg=“p.al”; Gh=“lo wor”; Eval(“hh=Ab+Kg+Td+Gh+Qw+Rt”); Eval(hh);

54. Callee Trick Function accesses its own source and uses it as a key to decrypt code or data function decrypt(cypher) { var key = arguments.callee.toString(); for (var i = 0; i < cypher.length; i++) { plain = key.charCodeAt(i) ^ cypher.charCodeAt(i); } ... }

57. Virus total Reports 5/42(11.90%)

63. Word Editor

64. Decoded the script

65. Formatted using jsbeautifier.org

66. Replacing with meaningful identifiers and removing unnecessary comments

69. Shellcode Analysis Connecting to… http://bigiqwars.ru/ppp/exe.php?spl=PDF (newPlayer)&user=admin&exe_acces=on

73. Tools And References