PDF File Standard Fuzzer

#!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# PDF FUZZER -- TAKE IT TO THE HEAD
# :) HAVE FUN :)

use PDF::Create;
use Getopt::Std;

@overflow = ('A' x 8200, 'A' x 11000, 'A' x 110000, 'A' x 550000, 'A' x 1100000, 'A' x 2200000, 'A' x 12000000, "\0x99" x 1200, "//AAAA" x 250, "\\AAAA" x 250);

@fmtstring = ("%n%n%n%n%n", "%p%p%p%p%p", "%s%s%s%s%s", "%d%d%d%d%d", "%x%x%x%x%x",
              "%s%p%x%d", "%.1024d", "%.1025d", "%.2048d", "%.2049d", "%.4096d", "%.4097d",
              "%99999999999s", "%08x", "%%20n", "%%20p", "%%20s", "%%20d", "%%20x",
              "%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%", "\0xCD" x 50, "\0xCB" x 50);

@numbers = ("0", "-0", "1", "-1", "32767", "-32768", "2147483647", "-2147483647", "2147483648", "-2147483648",
            "4294967294", "4294967295", "4294967296", "357913942", "-357913942", "536870912", "-536870912",
            "1.79769313486231E+308", "3.39519326559384E-313", "99999999999", "-99999999999", "0x100", "0x1000",
            "0x3fffffff", "0x7ffffffe", "0x7fffffff", "0x80000000", "0xffff", "0xfffffffe", "0xfffffff", "0xffffffff",
            "0x10000", "0x100000", "0x99999999", "65535", "65536", "65537", "16777215", "16777216", "16777217", "-268435455");

@miscbugs = ("test|touch /tmp/ZfZ-PWNED|test", "test`touch /tmp/ZfZ-PWNED`test", "test'touch /tmp/ZfZ-PWNED'test", "test;touch /tmp/ZfZ-PWNED;test",
             "test&&touch /tmp/ZfZ-PWNED&&test", "test|C:/WINDOWS/system32/calc.exe|test", "test`C:/WINDOWS/system32/calc.exe`test",
             "test'C:/WINDOWS/system32/calc.exe'test", "test;C:/WINDOWS/system32/calc.exe;test", "/bin/sh", "C:/WINDOWS/system32/calc.exe", "%0xa", "%u000");

getopts('t:o:', \%opts);
$target = $opts{'t'};
$pdfdoc = $opts{'o'};

if(!defined($target) || !defined($pdfdoc))
{
     print "\n pdfUZZ - PDF Fuzzer";
     print "\nJeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]";
     print "\n Usage: $0 -t <targetapp> -o <output.pdf>\n\n";
     exit(0);

}

     print "\n pdfUZZ - PDF Fuzzer";
     print "\nJeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]\n";

print "\nFUZZING '$target' with '$pdfdoc' [STAGE->1(Version)]";

print "\n";
foreach(@numbers) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => $fuzz,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->2(Author)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => $fuzz,
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => $fuzz,
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => $fuzz,
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->3(Title)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => $fuzz,
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => $fuzz,
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => $fuzz,
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->4(page_size)]";

print "\n";
foreach(@numbers) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => [$fuzz, $fuzz, $fuzz, $fuzz]);
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->5(Subject)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => $fuzz,
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => $fuzz,
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => $fuzz,
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => $fuzz,
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => $fuzz,
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->6(Keywords)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => $fuzz);
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => $fuzz,
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => $fuzz);
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => $fuzz,
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => $fuzz);
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$pdf->close;
system $target $pdfdoc; }

print "\nFUZZING '$target' with '$pdfdoc' [STAGE->7(font/Subtype)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => $fuzz,
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => $fuzz,
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => $fuzz,
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->8(font/Encoding)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => $fuzz,
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => $fuzz,
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => $fuzz,
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->9(font/BaseFont)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => $fuzz);
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => $fuzz);
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => $fuzz);
$page->string($ffont, 20, 300, 300, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }

print "\nFUZZING '$target' with '$pdfdoc' [STAGE->10(string/z+x+y)]";

print "\n";
foreach(@numbers) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, $fuzz, $fuzz, $fuzz, "pdfUZZ");
$pdf->close;
system $target $pdfdoc; }

print "FUZZING '$target' with '$pdfdoc' [STAGE->11(string/text)]";

print "\n";
foreach(@overflow) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, $fuzz);
$pdf->close;
system $target $pdfdoc; }
foreach(@fmtstring) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, $fuzz);
$pdf->close;
system $target $pdfdoc; }
foreach(@miscbugs) { $fuzz = $_;
$pdf = new PDF::Create('filename' => $pdfdoc,
                       'Version' => 1.2,
                       'Author' => 'pdfUZZ',
                       'Title' => 'pdfUZZ',
                       'CreationDate' => [localtime],
                       'Subject' => 'pdfUZZ',
                       'Keywords' => 'pdfUZZ');
$main = $pdf->new_page('MediaBox' => $pdf->get_page_size('A4'));
$page = $main->new_page;
$ffont = $pdf->font('Subtype' => 'Type1',
                    'Encoding' => 'WinAnsiEncoding',
                    'BaseFont' => 'Times-Roman');
$page->string($ffont, 20, 300, 300, $fuzz);
$pdf->close;
system $target $pdfdoc; }

exit;



文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags:
评论: 41 | 引用: 0 | 查看次数: 22614
回复回复Porter[2015-06-07 01:39 PM | del]
Superb Webpage, Continue the very good work. Thank you.
回复回复Judy[2015-06-05 06:44 PM | del]
Simply desired to tell you Now i'm glad that i stumbled on your site!
回复回复Ray[2015-06-05 00:31 AM | del]
I treasure the content on your web site. Cheers.
回复回复Bennie[2015-05-26 04:43 AM | del]
Whoa....this is a advantageous webpage.
回复回复Leo[2015-05-14 05:49 AM | del]
Howdy, tidy web page you have there.
回复回复Benito[2015-03-23 07:37 AM | del]
You will serve yourself less food rather than even notice it.
Blindly following diet charts and diagrams that prohibit any sort of deviation can be extremely unhealthy to the dieter. If it's too good to be real, it's too good actually was.
回复回复HELLO[2010-11-20 05:26 PM | del]
我什么都没学过,可是不一会就看懂了你的程序
回复回复雏鹰[2010-10-14 06:37 PM | del]
我学过C,C++,JAVA,C#,汇编,还是看不懂你的程序,唉,杯具啊,找个大哥交流下,指点下QQ:709421751。。。。。。
回复回复风子[2010-05-31 08:37 PM | del]
风子有偿收徒
QQ84528439
回复回复黑客雇佣军[2010-04-03 09:42 AM | del]
攻击业务:服务器攻击,个人主机攻击,网页攻击,网吧攻击,手机攻击
入侵业务:ADM网站入侵,WEB网页提权入侵,服务器入侵,个人主机入侵
盗号业务:QQ号,手机和电话机密码,密码窃取手机文件,任意网游帐号
免杀业务:任意免杀木马!(QQ木马六个月,任意网游、远程木马包一年)
破解业务:软件破解,数据库解密,文本文档、压缩文件、核心文件解密
定位业务:手机定位,IP定位,座机定位,车辆定位,QQ定位,人员定位
      ◆天赋异能 谁与争峰 你的电脑 我的权限◆    
                               ◆你的网站我来管理◆  
                                〓 打破电脑权限 〓    
                            〓 通往电脑的路不止一条 〓    
                                业务网站:www.pojie567.com
                                          联系QQ276901888
发表评论
昵 称:
密 码: 游客发言不需要密码.
内 容:
验证码: 验证码
选 项:
虽然发表评论不用注册,但是为了保护您的发言权,建议您注册帐号.
字数限制 1000 字 | UBB代码 开启 | [img]标签 关闭