Is there any way I can check a PDF for exploits? I am on Linux most of the times but I sometimes have to read PDF's on Windows also, so I have to be extra sure that the PDF is clean. I use Acrobat Reader on Windows and Evince on Linux.
Here's the method that I use in
analysing malicious PDFs:
I use the tools pdfid and
pdf-parser from here. In the
past I have also used pdftk, but I'm
finding that less useful recently.
Use pdfid to analyse the pdf document. pdfid can tell you if a
autorun functionality and how many
pages it has. A one page document with
determine its purpose. Sometimes the
in which case you can just use the
strings utility to extract it.
Otherwise, you can use pdf-parser to
extract certain types of encoded
true purpose. To remove this
obfuscation I modify the script a
little to allow easier debugging (e.g.
assign the code from eval statements
to a variable instead) and use the
how the code is transformed as it
overflows, and the shellcode is often
in unicode format. I have a perl
script that I wrote to convert
this type of shellcode to a C program
(really just C style shellcode with
some wrapper code) which can then be
compiled to be further analysed using
standard binary analysis techniques.
I will note that PDF exploits are
practice most of the ones out in the
wild seem to use it. Certainly the
ones I have seen have it.