Add Maldoc in PDF polyglot fileformat module

[mekhalleh]

The technique is called "MalDoc in PDF". This technique hides malicious Word documents in PDF files, which is why malicious code contained in them cannot be detected by many analysis tools.

The document can be opened in both Microsoft Word and a PDF reader.

However, for the macro to run, you must open this document in Microsoft Word. The attack does not bypass configured macro locks. The malicious macros are also not executed when the file is opened in PDF readers or similar software.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use auxiliary/fileformat/maldoc_in_pdf_polyglot
• set FILENAME /tmp/macro.htm
• run

Options

FILENAME

The input MHT filename with macro embedded.

INJECTED_PDF

The input PDF filename to be injected. (optional)

MESSAGE_PDF

The message to display in the local PDF template (if INJECTED_PDF is NOT used). Default: You must open this document in Microsoft Word

Results

The document can be opened in both Microsoft Word and a PDF reader.

A malicious MHT file created can be opened in Microsoft Word even though it has magic numbers and file
structure of PDF.

[msutovsky-r7]

Hey @mekhalleh, reviewed your module and left some comments. The module itself seems to be working fine.

[mekhalleh]

Hey @mekhalleh, reviewed your module and left some comments. The module itself seems to be working fine.

hello @msutovsky-r7 thanks for the review. and sorry for the time taken to reply :)

all is done.

[msutovsky-r7]

Suggested change

	'SideEffects' => []
	'SideEffects' => [ARTIFACTS_ON_DISK]

[msutovsky-r7]

I'm considering one additional change: is there any way to only have a docx as template, add payload from Metasploit as macro and then do the final conversion to PDF? It would provide bit better usability as there would be no need to add macro payload manually.