Hacker News Reader

Comment by bayindirh | Hacker News Reader

PoC||GTFO's [0] most issues are polyglot files.

Taken from 0x16 [1]'s introduction:

    This file, pocorgtfo16.pdf , is a polyglot that is valid as a PDF document,
    a ZIP archive, and a Bash script that runs a Python webserver which hosts
    Kaitai Struct’s WebIDE which, allowing you to view the file’s own annotated bytes.

[0]: https://www.alchemistowl.org/pocorgtfo/

[1]: https://www.alchemistowl.org/pocorgtfo/pocorgtfo16.pdf

View on HN

0x15 is a laser-projectable PDF that's also a ZIP containing, among other things, another PDF that is also a Git repo of its own source code.

0x17 is a PDF that's also a valid ZIP and valid firmware for Apollo Guidance Computer.

And that's just the tip of an iceberg. This project is absolutely crazy, in the most positive possible way.

> 0x17 is a PDF that's also a valid ZIP and valid firmware for Apollo Guidance Computer.

Wait, what?

Edit: 0x15 has the additional feature that viewing it in Chrome makes my work machine throw a "Threat detected: A threat has been blocked and quarantined" message, so I think I'm going to avoid this site now. Not to say that I don't trust this random PDF hacker (...that sounded less sarcastic in my head), but I don't need IT asking me pointed questions about what sites I've been visiting.

Yes, that.

PoC||GTFO is a well known project, and has a tradition of turning their PDFs into absurdly polyglot files. Your Chrome is giving you a false positive here.

Reply on news.ycombinator.com