PDF Attack: A Journey from the Exploit Kit to the Shellcode

Presented at Black Hat Europe 2014, Oct. 17, 2014, 9 a.m. (135 minutes).

"PDF Attack: A Journey from the Exploit Kit to the Shellcode" is a workshop to show how to analyze obfuscated Javascript code from an Exploit Kit page, extract the exploits used, and analyze them. Nowadays it is possible to use automated tools to extract URLs and binaries but it is also important to know how to do it manually to not to miss a detail. We will focus on PDF documents mostly, starting from a simple Javascript Hello World document and ending with a real file used by a fresh Exploit Kit. This workshop will also include exercises to modify malicious PDF files and obfuscate them to try to bypass AV software, very useful in pentesting. The last version of peepdf (included in REMnux, BackTrack and Kali Linux) will be used for acomplish these tasks, so it means that this presentation covers the latest tricks used by cybercriminals like using new filters and encryption to make the analysis more difficult.


Presenters:

  • Jose Miguel Esparza - Fox-IT
    Jose Miguel Esparza is a Security Researcher who has been working as an e-crime analyst for more than seven years, focused on botnets, malware, and Internet fraud. After working at S21sec e-crime, he joined the Fox-IT InTELL team in The Netherlands. He is the author of some exploits and analysis tools like Malybuzz and peepdf (http://peepdf.eternal-todo.com). He is also a regular writer on eternal-todo.com about security and threats in Internet, and has taken part in several conferences, e.g. RootedCon (Spain), NcN (Spain), CARO Workshop (Czech Republic), Source Seattle (USA), Black Hat (Europe / USA / Asia) and Troopers (Germany). You can easily find him on Twitter @EternalTodo talking about security.

Links:

Similar Presentations: