Execute Bash Script within a PDF File

Question

I recently discovered that concatenating text to the end of a PDF file does not change properties of the PDF file. This may be a very silly question, but if a program were concatenated to the PDF file, could it somehow be executed?

For example, opening this PDF file would create a text file in the home directory with the words "hello world" in it.

*pdf contents*...
trailer^M
<</Size 219/Root 186 0 R/Info 177 0     R/ID[<5990BFFB4DF3DB26CE6A92829BB5C41B>    <B35E036CA0E7BA4CBF39B3D74DCE4CAF>]/Prev 4494028 >>^M
startxref^M
4663747^M
%%EOF^M
#!/bin/bash
echo "hello world" > ~/hello.txt

Would this work with a different file format? Does the embedded code need to be a binary executable?

You could use this to make a PDF file also valid in a footer-based format, like ZIP, but not a header-based format, like... well, basically all your executable formats, scripting or otherwise. A shebang, like other headers, will only be recognized at the top of a file. — Charles Duffy
– Charles Duffy, Commented May 22, 2016 at 18:10
In general, though, a "is this design decision exploitable?" question is probably a better fit for security.stackexchange.com than SO. — Charles Duffy
– Charles Duffy, Commented May 22, 2016 at 18:12

Community · Accepted Answer · 2017-05-23 12:16:07Z

2

As (fortunately), that's not part of the standard, you can't do that.

Unfortunately, the standard supports "launch actions", to execute arbitrary code with user confirmation. Those are now disabled by default and don't allow to execute embedded bulbs, but if enabled you could use that to execute arbitrary code that finds and executes the code embedded on the pdf.

The standard also supports javascript that excecutes sandboxed, but it a reader specific bug that allows may escaping the sandbox.

edited May 23, 2017 at 12:16

CommunityBot

11 silver badge

answered May 22, 2016 at 17:11

xvan

4,8491 gold badge25 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Execute Bash Script within a PDF File

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related