H7 / SECURITY RESEARCH NOTES Endpoint & Adversary Techniques

Using Bad-PDF to Steal NTLM Hashes from a Windows Host

ProcedureTechnical translation

On this page3 sections

Environment Description

IP	HOSTNAME	NOTE
172.16.106.67	kali_dqy	Attacker host
10.10.10.88	win10_dqy	Victim host

Preface

Attack Process