| 0. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. 49. 50. 51. 52. 53. 54. 55. 56. 57. 58. 59. 60. 61. 62. 63. 64. 65. 66. 67. 68. 69. 70. 71. 72. 73. 74. 75. 76. 77. 78. 79. 80. 81. 82. 83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99. 100. 101. 102. 103. 104. 105. 106. 107. 108. 109. 110. 111. 112. 113. 114. 115. 116. 117. 118. 119. 120. 121. 122. 123. 124. 125. 126. 127. 128. 129. 130. 131. 132. 133. 134. 135. 136. 137. 138. 139. 140. 141. 142. 143. 144. 145. 146. 147. 148. 149. 150. 151. 152. 153. 154. 155. 156. 157. 158. 159. 160. 161. 162. 163. 164. 165. 166. 167. 168. 169. 170. 171. 172. 173. 174. 175. 176. 177. 178. 179. 180. 181. 182. 183. 184. 185. 186. 187. 188. 189. 190. 191. 192. 193. 194. 195. 196. 197. 198. 199. 200. 201. 202. 203. 204. 205. 206. 207. 208. 209. 210. 211. 212. 213. 214. 215. 216. 217. 218. 219. 220. 221. 222. 223. 224. 225. 226. 227. 228. 229. 230. 231. 232. 233. 234. 235. 236. 237. 238. 239. 240. 241. 242. 243. 244. 245. 246. 247. 248. 249. 250. 251. 252. 253. 254. 255. 256. 257. 258. 259. 260. 261. 262. 263. 264. 265. 266. 267. 268. 269. 270. 271. 272. 273. 274. 275. 276. 277. 278. 279. 280. 281. 282. 283. 284. 285. 286. 287. 288. 289. 290. 291. 292. 293. 294. 295. 296. 297. 298. 299. 300. 301. 302. 303. 304. 305. 306. 307. 308. 309. 310. 311. 312. 313. 314. 315. 316. 317. 318. 319. 320. 321. 322. 323. 324. 325. 326. 327. 328. 329. 330. 331. 332. 333. 334. 335. 336. 337. 338. 339. 340. 341. 342. 343. 344. 345. 346. 347. 348. 349. 350. 351. 352. 353. 354. 355. 356. 357. 358. 359. 360. 361. 362. 363. 364. 365. 366. 367. 368. 369. 370. 371. 372. 373. 374. 375. 376. 377. 378. 379. 380. 381. 382. 383. 384. 385. 386. 387. 388. 389. 390. 391. 392. 393. 394. 395. 396. 397. 398. 399. 400. 401. 402. 403. 404. 405. 406. 407. 408. 409. 410. 411. 412. 413. 414. 415. 416. 417. 418. 419. 420. 421. 422. 423. 424. 425. 426. 427. 428. 429. 430. 431. 432. 433. 434. 435. 436. 437. 438. 439. 440. 441. 442. 443. 444. 445. 446. 447. 448. | #!/usr/bin/perl # Jeremy Brown [[email protected]/jbrownsec.blogspot.com] # PDF FUZZER -- TAKE IT TO THE HEAD # :) HAVE FUN :) use PDF::Create; use Getopt::Std; @overflow = ('A' x 8200, 'A' x 11000, 'A' x 110000, 'A' x 550000, 'A' x 1100000, 'A' x 2200000, 'A' x 12000000, "\0x99" x 1200, "//AAAA" x 250, "\\AAAA" x 250); @fmtstring = ("%n%n%n%n%n", "%p%p%p%p%p", "%s%s%s%s%s", "%d%d%d%d%d", "%x%x%x%x%x", "%s%p%x%d", "%.1024d", "%.1025d", "%.2048d", "%.2049d", "%.4096d", "%.4097d", "%99999999999s", "%08x", "%%20n", "%%20p", "%%20s", "%%20d", "%%20x", "%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%", "\0xCD" x 50, "\0xCB" x 50); @numbers = ("0", "-0", "1", "-1", "32767", "-32768", "2147483647", "-2147483647", "2147483648", "-2147483648", "4294967294", "4294967295", "4294967296", "357913942", "-357913942", "536870912", "-536870912", "1.79769313486231E+308", "3.39519326559384E-313", "99999999999", "-99999999999", "0x100", "0x1000", "0x3fffffff", "0x7ffffffe", "0x7fffffff", "0x80000000", "0xffff", "0xfffffffe", "0xfffffff", "0xffffffff", "0x10000", "0x100000", "0x99999999", "65535", "65536", "65537", "16777215", "16777216", "16777217", "-268435455"); @miscbugs = ("test|touch /tmp/ZfZ-PWNED|test", "test`touch /tmp/ZfZ-PWNED`test", "test'touch /tmp/ZfZ-PWNED'test", "test;touch /tmp/ZfZ-PWNED;test", "test&&touch /tmp/ZfZ-PWNED&&test", "test|C:/WINDOWS/system32/calc.exe|test", "test`C:/WINDOWS/system32/calc.exe`test", "test'C:/WINDOWS/system32/calc.exe'test", "test;C:/WINDOWS/system32/calc.exe;test", "/bin/sh", "C:/WINDOWS/system32/calc.exe", "%0xa", "%u000"); getopts('t:o:', \%opts); $target = $opts{'t'}; $pdfdoc = $opts{'o'}; if(!defined($target) || !defined($pdfdoc)) { print "\n pdfUZZ - PDF Fuzzer"; print "\nJeremy Brown [[email protected]/http://jbrownsec.blogspot.com]"; print "\n Usage: $0 -t <targetapp> -o <output.pdf>\n\n"; exit(0); } print "\n pdfUZZ - PDF Fuzzer"; print "\nJeremy Brown [[email protected]/http://jbrownsec.blogspot.com]\n"; print "\nFUZZING '$target' with '$pdfdoc' [STAGE->1(Version)]"; print "\n"; foreach(@numbers) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => $fuzz, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->2(Author)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => $fuzz, 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => $fuzz, 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => $fuzz, 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->3(Title)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => $fuzz, 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => $fuzz, 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => $fuzz, 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->4(page_size)]"; print "\n"; foreach(@numbers) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => [$fuzz, $fuzz, $fuzz, $fuzz]); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->5(Subject)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => $fuzz, 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => $fuzz, 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => $fuzz, 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => $fuzz, 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => $fuzz, 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->6(Keywords)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => $fuzz); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => $fuzz, 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => $fuzz); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => $fuzz, 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => $fuzz); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $pdf->close; system $target $pdfdoc; } print "\nFUZZING '$target' with '$pdfdoc' [STAGE->7(font/Subtype)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => $fuzz, 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => $fuzz, 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => $fuzz, 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->8(font/Encoding)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => $fuzz, 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => $fuzz, 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => $fuzz, 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->9(font/BaseFont)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => $fuzz); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => $fuzz); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => $fuzz); $page->string($ffont, 20, 300, 300, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } print "\nFUZZING '$target' with '$pdfdoc' [STAGE->10(string/z+x+y)]"; print "\n"; foreach(@numbers) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => 'Times-Roman'); $page->string($ffont, $fuzz, $fuzz, $fuzz, "pdfUZZ"); $pdf->close; system $target $pdfdoc; } print "FUZZING '$target' with '$pdfdoc' [STAGE->11(string/text)]"; print "\n"; foreach(@overflow) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, $fuzz); $pdf->close; system $target $pdfdoc; } foreach(@fmtstring) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, $fuzz); $pdf->close; system $target $pdfdoc; } foreach(@miscbugs) { $fuzz = $_; $pdf = new PDF::Create('filename' => $pdfdoc, 'Version' => 1.2, 'Author' => 'pdfUZZ', 'Title' => 'pdfUZZ', 'CreationDate' => [localtime], 'Subject' => 'pdfUZZ', 'Keywords' => 'pdfUZZ'); $main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4')); $page = $main->new_page; $ffont = $pdf->font('Subtype' => 'Type1', 'Encoding' => 'WinAnsiEncoding', 'BaseFont' => 'Times-Roman'); $page->string($ffont, 20, 300, 300, $fuzz); $pdf->close; system $target $pdfdoc; } exit; |