Bad-PDF make pernicious PDF to steal NTLM Hashes from windows machines, it use defenselessness revealed by checkpoint group to make the malicious PDF record. Bad-Pdf peruses the NTLM hashes utilizing Responder listener.
This strategy deal with all PDF readers(Any version) and java scripts are not required for this attack.
Reference : https://research.checkpoint.com/ntlm-credentials-theft-via-pdf-files/
Also Read EggShell – Remote Administration Tool For iOS/macOS
Dependency To Steal NTLM Hashes
Responder/Kali Linux
Usage: python badpdf.py
Run Bad-PDF in Kali linux:
Responder waiting for NTLM hash:
Run generated Bad-PDF file on a windows machine and get NTLM hash:
Author : Deepu
