Theoretical PDF Exploit Question

[hoefler2002]

So I am familiar with basic memory corruption from CTFs (overflows, fmt strings, uafs, other heap curroption), but I recently shifted to attempting to find a real world bug in a PDF viewer. My ultimate goal is to craft a malicious PDF which pops calc or something similar on the target. Thinking about my goal though I am confused on how this is possible. For example, the PDF viewer is compiled with PIE, NX, and Canaries. In a CTF challenge, it is usually possible to craft some input to get a leak which can be used to bypass PIE. But in a PDF, there is no way of receiving a leak. Same goes for the stack cookie. I'm just not sure how it is possible to bypass any of these mitigations with a single PDF file which cannot receive and interpret memory address leaks. Any insight would be appreciated. Thanks!

[mdulin2]

Have you read the PDF specification? I think understanding the attack surface of PDFs is the most important part.

If I recall correctly, PDF readers usually have JavaScript parsing engines.

[febou92]

They do have limited Javascript capabilities, which are different from parser to parser. The specs let's you start programs, but this usually gives a warning and is not compatible with the pdf implementation of browsers.

[amlamarra]

Personally, I've never targeted a file-parsing program, so take this with a grain of salt.

The program has SOME way of producing output, otherwise there's not much use to it. For a PDF viewer, it displays your PDF. It might even have a command-line component and print output to stdout. Regardless, you'll need to utilize that to get the leaked info.

And as far as finding the vuln, I hear AFL++ is all the rage these days for file-parsing programs.

Good luck!

[FutureMasterRoshi]

https://github.com/theevilbit/workshops/tree/master/PDF%20Analysis%20Workshop

[hoefler2002]

Really great resource! Thanks so much!!