‫Embedding malware into the documents.
‫It's very common for malicious software to be embedded in a widely used document such as a PDF for office
‫document.
‫Let's look and see what metastable framework has for this purpose in MSF Shell.
‫And you already know how to open the MSF shell simply type MSF console in the terminal screen of Calli.
‫If you search for Adobe in PDF words, you see that Métis framework has two exploits to embed a malware
‫into a PDF file.
‫And thankfully the ranks of the exploits are excellent, which means they will look very good and stable
‫in the ideal circumstances.
‫Of course, you need an appropriate payload for the exploit.
‫When you look at the options of the exploit using show options command, you see that the target of
‫the exploit is Adobe Reader with versions eight or nine, which is running Windows XP, Vista or seven.
‫When you gather information about the target company, you probably find this information which operating
‫systems are used, which readers are preferred, which versions are used, et cetera.
‫Suppose that you don't have any clue that the target operating systems and or readers are used in this
‫company still, isn't it worth it to try?
‫Now is the question.
‫Can you find any device running an old version of operating system and an old version of the reader?
‫Answer is, of course.
‫Do you remember the want to cry ransomware attacks?
‫The attack affected more than 300000 computers across 150 countries, including the UK's NHS health
‫systems.
‫The malware was using a vulnerability where Microsoft had already released a patch for it two months
‫before the want to cry attack, but the attack affected hundreds of thousands of computers because they
‫are always out of date.
‫If you could find a few machines that fit these conditions, it might be enough for you to hack the
‫entire company.
‫The next step is to set the options.
‫Set the template PDF file in filename, if you don't, metabolite framework will use its own template,
‫set the output PDF file name, file name.
‫If you don't need exploit framework will name it as evil dot pdf.
‫Now set the options of the payload you choose if you choose reverse https interpreter payload like me
‫set the IP address of the listener host set the listener port.
‫If you don't want to use the default one airport when you're finished setting your options.
‫You can use, exploit or run commands to generate the file.
‫Now you must bring the file and computer users, I mean victims together, send the file in a phishing
‫email, copy the file and flash drives and give them as gifts, write the file and CDs and spread them
‫in the company if you can, etc..
‫By merging a malicious PDF with another arbitrary PDF file, you can make it more difficult for antivirus
‫is to recognize it in the first picture, a windows slash mateparae to slash reverse underscore TCP
‫payload embedded PDF file is scanned in virus total dot com.
‫No obfuscation or customization was performed, so 30 of 47 antivirus programs detected it in the second
‫pick.
‫A custom payload using windows slash interpretor slash reverse underscore http.
‫S payload of Métis.
‫Foyt was created by Vayle and embedded into the PDF file.
‫17 of 47 antivirus programs detected the malware in the third picture.
‫The document used in the second picture was merged with a clean PDF file.
‫In this time, only 10 of 47 antivirus programs detected the malware.