Hackers of India

Stegosploit - Delivering Drive-By Exploits With Only Images

By  Saumil Shah  on 21 Oct 2015 @ Hacklu

This talk covers technique(s) listed below
STEGOSPLOIT

Presentation Material

Stegosploit - Hack.LU 2015 from Saumil Shah

Abstract

Stegosploit creates a new way to encode “drive-by” browser exploits and deliver them through image files. These payloads are undetectable using current means. This paper discusses two broad underlying techniques used for image based exploit delivery - Steganography and Polyglots. Drive-by browser exploits are steganographically encoded into JPG and PNG images. The resultant image file is fused with HTML and Javascript decoder code, turning it into an HTML+Image polyglot. The polyglot looks and feels like an image, but is decoded and triggered in a victim’s browser when loaded.

The Stegosploit Toolkit contains the tools necessary to test image based exploit delivery. A case study of a Use-After-Free memory corruption exploit (CVE-2014-0282) shall be presented demonstrating the Stegosploit technique.