The exploit code is inserted within the pixels of the image so that the image contains the exploit code. IMAJS then creates a polyglot image that will be read as an image and contains a decoder that will extract and run the javascript exploit.

The exploit that we will use is an Internet Explorer Use-after-free exploit (CVE-2014-0282).

Highlights:

• The server can serve images to the VM over 10.0.2.2:5000
• The jpg.py program can build a polyglot file (valid .html and .jpg)

• Refactor CRC32.pm

• Refactor PNGDATA.pm

• Refactor html_in_jpg_ie.pl

• Refactor pngenum.pl

• Demo Server

  • Move all static exploit files in demo pages to /static
  • Make sure all static files are passed parsed using template_render
  • Add an image picker for the image_layer_analysis.html (Optional)

• https://conference.hitb.org/hitbsecconf2015ams/sessions/stegosploit-hacking-with-pictures/
• https://www.vulnerability-db.com/?q=articles/2015/06/17/exploit-delivery-steganography-using-stegosploit-tool-v02
• https://www.blackhat.com/docs/eu-15/materials/eu-15-Shah-Stegosploit-Exploit-Delivery-With-Steganography-And-Polyglots.pdf
• https://stackoverflow.com/questions/4110964/how-does-heap-spray-attack-work
• https://www.youtube.com/watch?time_continue=1&v=6lYUtIZHlJA
• https://www.owasp.org/images/0/01/OWASL_IL_2010_Jan_-_Moshe_Ben_Abu_-_Advanced_Heapspray.pdf
• https://en.wikipedia.org/wiki/Heap_spraying
• https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/