CVE-2018-4993

Bad-Pdf Bad-PDF create malicious PDF file to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines, it utilize vulnerability disclosed by checkpoint team to create the malicious PDF file Bad-Pdf reads the NTLM hashes using Responder listener This method work on all PDF readers(Any version) most of the EDR/Endpoint solution fail to detect this attack Reference : res

POC Files for CVE-2019-17497

CVE-2019-17497 CVE Details PDF-XChange Editor before 803300 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993) For example, an NTLM hash is sent for a link to \attackerloca\C$\eeepdf without user interaction Original Writeup Since the original writeup didn't include the POC as files, I recreated them myself

Bad-Pdf Bad-PDF create malicious PDF file to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines, it utilize vulnerability disclosed by checkpoint team to create the malicious PDF file Bad-Pdf reads the NTLM hashes using Responder listener This method work on all PDF readers(Any version) most of the EDR/Endpoint solution fail to detect this attack Reference : res

Steal Net-NTLM Hash using Bad-PDF

Bad-Pdf Bad-PDF create malicious PDF file to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines, it utilize vulnerability disclosed by checkpoint team to create the malicious PDF file Bad-Pdf reads the NTLM hashes using Responder listener This method work on all PDF readers(Any version) most of the EDR/Endpoint solution fail to detect this attack Reference : res

Bad-Pdf Bad-PDF create malicious PDF file to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines, it utilize vulnerability disclosed by checkpoint team to create the malicious PDF file Bad-Pdf reads the NTLM hashes using Responder listener This method will owkr on most of the EDR/Endpoint solution fail to detect this attack Reference : researchcheckpointcom/ntlm

Lantern Shark is a static file analyzer written in HTML and Javascript.

Lantern Shark Lantern Shark is a file analyzer written in HTML and JavaScript It can extract metadata and embedded script code from multiple file types It also attempts to identify suspicious and malicious attributes of various file types A live demo of this project can be viewed here Additional Features Deobfuscation of extracted scripts via inserted comments Look for th