‫Embedding malware into the documents.
‫It's very common for malicious software to be embedded in a widely used document, such as a PDF or
‫office document.
‫Let's look and see what Metasploit Framework has for this purpose in MSFT Shell.
‫And you already know how to open the MSFT shell.
‫Simply type MSFT console in the terminal screen of Carly.
‫If you search for Adobe and PDF, would you see that Metasploit Framework has two exploits to embed
‫a malware into a PDF file?
‫And thankfully, the ranks of the exploits are excellent, which means they will look very good and
‫stable in the ideal circumstances.
‫Of course, you need an appropriate payload for the exploit.
‫When you look at the options of the exploit using show options command, you see that the target of
‫the exploit is Adobe Reader with versions eight or nine, which is running Windows XP Vista or seven
‫when you gather information about the target company.
‫You probably find this information which operating systems are used, which readers are preferred,
‫which versions are used, etc..
‫Suppose that you don't have any clue that the target operating systems and or readers are used in this
‫company, still, isn't it worth it to try?
‫Now is the question.
‫Can you find any device running an old version of operating system and an old version of the reader?
‫Answer is, of course.
‫Do you remember the WannaCry ransomware attacks?
‫The attack affected more than 300000 computers across 150 countries, including the UK's NHS health
‫systems.
‫The malware was using a vulnerability where Microsoft had already released a patch for it two months
‫before the WannaCry attack, but the attack affected hundreds of thousands of computers because they
‫are always out of date.
‫If you could find a few machines that fit these conditions, it might be enough for you to hack the
‫entire company.
‫The next step is to set the options.
‫Set the template PDF file in file name.
‫If you don't, Metasploit Framework will use its own template, set the output PDF, file name, file
‫name.
‫If you don't, Metasploit Framework will name it as Evil Dot PDF.
‫Now, set the options of the payload you choose if you choose a reverse https interpreter and payload
‫like me, set the IP address of the listener L host set the listener port.
‫If you don't want to use the default one L port when you're finished setting your options.
‫You can use, exploit or run commands to generate the file.
‫Now you must bring the file and computer users.
‫I mean, victims together send the file in a phishing email.
‫Copy the file and flash drives and give them as gifts.
‫Write the file in CDs and spread them in the company, if you can.
‫Etc..
‫By merging a malicious PDF with another arbitrary PDF file, you can make it more difficult for anti-virus
‫is to recognize it in the first picture, a windows slash interpreter slash reverse underscore TCP payload
‫embedded PDF file is scanned in VirusTotal dot com.
‫No obfuscation or customization was performed, so 30 of 47 antivirus programs detected it in the second
‫pick.
‫A custom payload using windows slash metaphor to slash reverse underscore HTTP s payload of Metasploit
‫was created by Veille and embedded into the PDF file.
‫17 of 47 antivirus programs detected the malware in the third picture.
‫The document used in the second picture was merged with a clean PDF file.
‫In this time, only 10 of 47 antivirus programs detected the malware.