Hackers of India

Inside Stegosploit

By  Saumil Shah  on 15 Mar 2017 @ Can Sec West

This talk covers technique(s) listed below
STEGOSPLOIT

Presentation Material

CSW2017 Saumil shah stegosploit_internals_cansecwest_2017 from CanSecWest

Abstract

Stegosploit creates a new way to encode “drive-by” browser exploits and deliver them through image files. These payloads are undetectable using current means. This paper discusses two broad underlying techniques used for image based exploit delivery - Steganography and Polyglots. Drive-by browser exploits are steganographically encoded into JPG and PNG images. The resultant image file is fused with HTML and Javascript decoder code, turning it into an HTML+Image polyglot. The polyglot looks and feels like an image, but is decoded and triggered in a victim’s browser when loaded.

This talk focusses more on the inner mechanisms of Stegosploit, implementation details, and how certain browser specific obstacles were overcome.

The Stegosploit Toolkit contains the tools necessary to test image based exploit delivery. A case study of a Use-After-Free memory corruption exploit (CVE-2014-0282) shall be presented demonstrating the Stegosploit technique.