GetPDF lab | Cyber Defenders walkthrough

today I will walk through the lab GET PDF lab in cyberdefenders. this is malware analysis lab. and we will use the following tools in order to get this job done:

• Wireshark
• pdfID
• peepdf
• PDFStreamDumper
• CyberChef
• scdbg

Before you enter this lab. I would recommend you to know more about the PDF structure. one of the resources I learned from the following write-up + some help from our friend ChatGPT to understand more.

[embed]The Structure of a PDF File Introductionmedium.com

Lab Description and URL:

Reconstruct a multi-stage PDF malware attack by analyzing network traffic, dissecting PDF objects, deobfuscating JavaScript, and emulating shellcode to identify payloads and exploited CVEs.

Scenario

PDF format is the de-facto standard in exchanging documents online. Such popularity, however, has also attracted cyber criminals in spreading malware to unsuspecting users. The ability to generate malicious pdf files to distribute malware is a functionality that has been built into many exploit kits. As users are less cautious about opening PDF files, the malicious PDF file has become quite a successful attack vector. The network traffic is captured in lala.pcap contains network traffic related to a typical malicious PDF file attack, in which an unsuspecting user opens a compromised web page, which redirects the user’s web browser to a URL of a malicious PDF file. As the PDF plug-in of the browser opens the PDF, the unpatched version of Adobe Acrobat Reader is exploited and, as a result, downloads and silently installs malware on the user’s machine.

As a soc analyst, analyze the PDF and answer the questions.

lab cyberdefender’s URL:

https://cyberdefenders.org/blueteam-ctf-challenges/getpdf/

Q1: How many URL path(s) are involved in this incident?

ok now when you download the zip file for the lab you would expect that you will have the malicious PDF directly. but no they provided us a PCAP file. so let’s see what we need to do with it

• first we open the pcap file using wireshark
• second we need to look for the urls
• to narrow the packets down I typed the filter http.request then hit the enter button

now as you can see we have 6 urls here. making it our answer.

Q2: What is the URL which contains the JS code?

ok here I need to look for the responses bodies and look in them if i can spot java script code. I typed the filter “http.response” then hit the enter.

looked in them and found that the response in the packet number 12 has <script> part in the response. which contains an html as you can see.

and as you can see the full request url is: http://blog.honeynet.org.my/forensic_challenge/

Q3: What is the URL hidden in the JS code?

ok now we need to get the java script code itself. without having to copy the whole response. you can extract it easily to check it.

• in wireshark you click on the File > Export Objects > HTTP
• you chose the response of the url above and save it

now you open it, copy the script part. and now we need to beautify it so we can read and analyze it.

I went to https://beautifier.io/ and paste it inthere and check the code

and now we can see a highly obfuscated code. that it looks to be processing some strings through loops in order to get the original code or url.

so how can we get that code or url?

without copying the code to chatgpt and ask it to deobfuscate it. I decided to just print out the variable ZeJexn which looks to be is our goal as it’s in the end passed to the function GaDemee.

I commented out that function in the end and console.log(ZeJexn) as you can see and ran it in some online Java script interpreter.

and YES!. we can find the code here which has the url:

http[:]//blog[.]honeynet[.]org[.]my/forensic_challenge/getpdf[.]php

Q4: What is the MD5 hash of the PDF file contained in the packet?

ok now we need to get the pdf file. we will go back to our wireshark friend.

• File > export objects > http
• check if there is any pdf in the objects we had

• and we can see fcexploit.pdf which we will save

I went to the path I saved the pdf in. ran the powershell command in order to get the MD5 hash:

get-filehash <pdf path> -algorithm md5

which returned us the answer.

Q5: How many object(s) are contained inside the PDF file?

now as you did u must now know that the PDF consists of objects and streams and that stuff. now we need to use our pdfid “which is a python tool you have to install” to do the job.

now we use:

py -m pdfid <the pdf path>

which returns us the answer shown. obj 19

Note:

but before we jump into the next question there are some suspicious things you need to be careful for in the future when you are investigating a pdf whether in your work or in any cybersecurity challenge:

• /JS -> shows the presence of javascript code
• /JavaScript -> indicator of javascript object
• /AA -> which stands for additional actions. this can run automatically when the pdf is opened
• /OpenAction -> this defines the action when document is opened. often abused to auto-launch the javascript or any embeded code without the user’s interaction
• /Launch -> executes a program or command
• /EmbeddedFile -> file attachments inside the pdf and it can hide payloads

and we can see here in our pdf it has JS, Javascript, OpenAction and EmbeddedFile not zeros.

Note:

if you want to explore the pdf but without anything get executed if you are curious like me. you can user “ — disarm” flag in pdfid and also peepdf. which will change some flags in the pdf code so it won’t execute any codes and that stuff.

and it will creates you another disarmed version of the PDF.

Q6: How many filtering schemes are used for the object streams?

first what are“filters”?

filters tell the PDF reads how to decode the stored data.

examples of filters so you can be fimiliar with them:

• /Filter /FlateDecode
• /Filter /ASCIIHexDecode
• /Filter /LZWDecode

ok when we open the PDF using VS code or any another text editor. and search for the keyword “Filter”

and we can see here 4 filters are used

Q7: What is the number of the ‘object stream’ that might contain malicious JS code?

ok now we will use the tool “PDFStreamDumper” to look for the object streams we have in the pdf.

• open it
• Load > PDF file

we look around in objects. and we can notice that object 5 has java script code. making it our answer

but we will copy that java script and pass it to our online java script beautifier and try to understand it.

we can see that is scans the pdf annotations.

and it collects strings from the vaiable S$ in an array by splitting them by U_155bf62c9aU_7917ab39 and replacing it with 0x. which looks to be used for obfuscation also. ‘

when we look we see that the S$ is collected from this.info.title. so now we need to see where does that info.title exists.

here we will start using our “peepdf” which is a python tool like pdfid. “which you have to install both btw”

• we used the command:

python2 peepdf <pdfpath> -ifl

and anyway you can also answer the previous questions using it. here are some screenshots for you information:

you can type info and press enter.

you can see here that info: 11. which indicate that the info is in object 11. let’s give it a look.

we can find that the Title is refering to the Object number 10. so let’s check it also but in PDFstreamDumper

and yes we can find the pattern here. lets user Find/Replace tab to replace U_155bf62c9aU_7917ab39 with a 0x as it’s doing in the java script code to see what is hiding.

we find hexdecimal here. lets copy it and go to our friend cyber chef and decode it as shown

we can find the following code:

SS=1;$5=SSS[SS].subject;$S=0;$=$5.replace(/X_17844743X_170987743/g,”%”);S5=SSS[$S].subject;$+=S5.replace(/89af50d/g,”%”);$=$.replace(/\n/,””);$=$.replace(/\r/,””);S$=unescape($);app.eval(____S$);

let’s beautify it.

we can find it also looking for patterns:

• X_17844743X_170987743
• 89af50d

and replace them with %. let’s keep them in mind and jump to our next question.

Q8: Analyzing the PDF file. What ‘object-streams’ contain the JS code responsible for executing the shellcodes? The JS code is divided into two streams. Format: two numbers separated with ‘,’. Put the numbers in ascending order

ok now we need to look for the other objects as I belive this codes are related to patterns we found.

and yes we can find them in objects 7 and 9 as shown

now lets do the find/replace with the patterns and %. to reveal what is hiding inthere

we can see that both are also encoded but this time it’s url encoding so we will use url decoder. for example: https://meyerweb.com/eric/tools/dencoder/

when we decode them we found that they both are splitted parts of a code. lets combine both of them together.

Q9: The JS code responsible for executing the exploit contains shellcodes that drop malicious executable files. What is the full path of malicious executable files after being dropped by the malware on the victim machine?

now when we look at the full code we got. I can’t find any path write or something similar in the code. so it looks it’s hidden in the payload strings we have here.

which looks to be uni coded as there is a function called unescape to decode them in the code.

now what I need really is to extract the payload in a binary file to investigate it.

first I tried to run the unescape function and print out the payload variable and copy it in a text file but it didn’t work.

so I went to chatgpt. asked it to make me a powershell script that takes the string of the payload variable from a text file. and it will decode it and return it to me as a bin file.

<# u_to_bin.ps1 Reads a text file with a %uXXXX style string (or many), decodes %uXXXX tokens to little-endian bytes and writes a raw binary file.

Usage: powershell -ExecutionPolicy Bypass -File .\u_to_bin.ps1 -InputFile .\payload.txt -OutFile .\shellcode.bin

Safety: run only in an isolated analysis VM with no network.

>

param( [Parameter(Mandatory=$true)] [string]$InputFile, [string]$OutFile = “shellcode.bin” )

if (-not (Test-Path $InputFile)) { Write-Error “Input file not found: $InputFile” exit 1 }

Read file as raw text

$text = Get-Content -Raw -Path $InputFile -ErrorAction Stop

Find all %uXXXX tokens anywhere in the text

$matches = [regex]::Matches($text, ‘%u([0–9A-Fa-f]{4})’)

if ($matches.Count -eq 0) { Write-Error “No %uXXXX tokens found in $InputFile” exit 1 }

Build byte array (little-endian per %uXXXX)

$bytes = New-Object System.Collections.Generic.List[byte] foreach ($m in $matches) { $hex = $m.Groups[1].Value $val = [Convert]::ToInt32($hex,16)

append low byte then high byte

$bytes.Add([byte]($val -band 0xFF)) $bytes.Add([byte](($val -shr 8) -band 0xFF)) }

Write binary file

[System.IO.File]::WriteAllBytes($OutFile, $bytes.ToArray()) Write-Host “Wrote $($bytes.Count) bytes to $OutFile”

Safe preview (do not print whole payload): show length and first 16 bytes in hex

$previewCount = [Math]::Min(16, $bytes.Count) $preview = $bytes.ToArray()[0..($previewCount-1)] $hexPreview = ($preview | ForEach-Object { “{0:X2}” -f $_ }) -join ‘ ‘ Write-Host “Preview (first $previewCount bytes): $hexPreview”

ok now we managed to extract the shell code. we need to emulate it to check what is it doing. here we will user the tool “SCDBG”

• this tools ise used to emulate and debug shellcodes in a controlled environment
• you can find it from the url: https://sandsprite.com/blogs/index.php?uid=7&pid=152
• make sure to download from the “source” button under windows section to download the zip file.

and I would recommend you to watch that video to introduce you to that tool and understand how to use it:

[embed]

now we use it on our bin file as shown:

we can find it creating and try to execute a file called a.exe under the path:

• c:\WINDOWS\system32\a.exe

Q10: The PDF file contains another exploit related to CVE-2010–0188. What is the URL of the malicious executable that the shellcode associated with this exploit drop?

ok now we will get back to wireshark and check for objects we can export.

• we can find an executable called “the_real_malware.exe”
• we click on it so it highligh the related packed to it
• we check the full request url which will reveal the answer to us.

Q11: How many CVEs are included in the PDF file?

i really didn’t care in this question so much. i found that there are 5 payload strings in the malicious Java script code we have and typed 5 in the answer and it worked!.

if you have a better technique please share in the comments below.

I hope you found this write up helpful. see you later!.