{"uuid": "3af52f8c-2a5f-4022-a97e-057b6eccb883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-4993", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/fileformat/badpdf.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Assaf Baharav\", \"Yaron Fruchtmann\", \"Ido Solomon\", \"Richard Davy - secureyourit.co.uk\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module can either creates a blank PDF file which contains a UNC link which can be used\\n          to capture NetNTLM credentials, or if the PDFINJECT option is used it will inject the necessary\\n          code into an existing PDF document if possible.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/fileformat/badpdf\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"BADPDF Malicious PDF Creator\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/fileformat/badpdf.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"fileformat/badpdf\", \"references\": [\"CVE-2018-4993\", \"URL-https://research.checkpoint.com/ntlm-credentials-theft-via-pdf-files/\"], \"rport\": null, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:10.761851Z"}