+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: To the people who think jpeg exploits are "BS" (/showthread.php?tid=5430784)
To the people who think jpeg exploits are "BS" - ๖ۣۜCriminal - Oct 11, 2016
https://fossbytes.com/warning-just-opening-jpeg-2000-image-file-can-get-hacked/
this seems to only effect the jpeg2000 format which is slightly different then normal .jpeg files but opening pdfs with these embedded images is enough to get owned.Alot of people tend to think .jpeg exploits are far fetched but as you can see here they do come through the pipeline occasionally your just not gonna find exploits that target windows photo viewer or similar things.
* - Faith Connors - Oct 11, 2016
Good shit, this is a really neat find.
But just out of curiosity, if anyone knows more about memory than me, how far could you potentially go with this? As we can see there is a segfault at the end of the full documentation on the Talos site, which means that the application crashes. So how would you be able to stop that crash and actually execute some kind of code?
Also there is an exploit kit available for images, but it works very differently as it's for hiding code in an image file which is virtually undetectable. Have a look at Stegosploit.
* - Mr. Robot - Oct 11, 2016
Been trying to find a post regarding it in detail for a while.
![[Image: 4krS6sO.png]](https://i.imgur.com/4krS6sO.png)
* - Faith Connors - Oct 11, 2016
(Oct 11, 2016 05:44 PM)Mr. Robot Wrote: Been trying to find a post regarding it in detail for a while.
-snip-
The official documentation for it is pretty detailed
http://www.talosintelligence.com/reports/TALOS-2016-0193/
* - LanMan - Oct 11, 2016
(Oct 11, 2016 05:20 PM)๖ۣۜCriminal Wrote: this seems to only effect the jpeg2000 format which is slightly different then normal .jpeg files but opening pdfs with these embedded images is enough to get owned.
Alot of people tend to think .jpeg exploits are far fetched but as you can see here they do come through the pipeline occasionally your just not gonna find exploits that target windows photo viewer or similar things.
The exploit is just for the codec parsing the jpeg2000 (OpenJPEG), not all app using this format will be vulnerable.
And one of the most used way to crack and flash the PSP was by using a image, a exploit in the libTIFF library
(Oct 11, 2016 05:37 PM)Faith Connors Wrote: How far could you potentially go with this? As we can see there is a segfault at the end of the full documentation on the Talos site, which means that the application crashes. So how would you be able to stop that crash and actually execute some kind of code?By using multiple time the exploit they arrive to the point of Code Execution by memory corruption.
In theory you could relocate and make a huge trampoline to continue the flow of the program, but since the exploit is based on wrong headers of the file and memory corruption it will still crash
* - somejohndue - Oct 12, 2016
(Oct 11, 2016 10:33 PM)LanMan Wrote: The exploit is just for the codec parsing the jpeg2000 (OpenJPEG), not all app using this format will be vulnerable.A trampoline? I'd prefer a slide ;)
And one of the most used way to crack and flash the PSP was by using a image, a exploit in the libTIFF library
By using multiple time the exploit they arrive to the point of Code Execution by memory corruption.
In theory you could relocate and make a huge trampoline to continue the flow of the program, but since the exploit is based on wrong headers of the file and memory corruption it will still crash
* - LanMan - Oct 12, 2016
(Oct 12, 2016 03:09 AM)somejohndue Wrote: A trampoline? I'd prefer a slide ;)
I'm not sure it will work as well, maybe try a swing 😁
* - somejohndue - Oct 12, 2016
(Oct 12, 2016 09:06 AM)LanMan Wrote: I'm not sure it will work as well, maybe try a swing 😁Referred to a NOP sled as the slide. Also there's a common assosiation between the Global Offset Table and a trampoline (it launches off your vtable, function pointers etc), so not so far fetched.
* - LanMan - Oct 12, 2016
(Oct 12, 2016 09:20 AM)somejohndue Wrote: Referred to a NOP sled as the slide.
Oh my bad, i though it was just a random joke 🤝
RE: To the people who think jpeg exploits are "BS" - officeunit247 - Aug 6, 2019
(Oct 11, 2016 05:20 PM)๖ۣۜCriminal Wrote: this seems to only effect the jpeg2000 format which is slightly different then normal .jpeg files but opening pdfs with these embedded images is enough to get owned.Alot of people tend to think .jpeg exploits are far fetched but as you can see here they do come through the pipeline occasionally your just not gonna find exploits that target windows photo viewer or similar things.
i have bought the silent jpeg exploit form 0dayexploits.org its working one pop up but its working exploit i paid 750$ for this exploit but i am happy its working exploit
RE: To the people who think jpeg exploits are "BS" - SlowMehMo - Aug 9, 2019
(Aug 6, 2019 01:43 AM)officeunit247 Wrote: i have bought the silent jpeg exploit form 0dayexploits.org its working one pop up but its working exploit i paid 750$ for this exploit but i am happy its working exploit
you paid 750 smackaroos for a exploit that will be patched soon and has a pop up requiring user action?
oh dear, sorry but yeah, you got scammzored.
RE: To the people who think jpeg exploits are "BS" - greghoglund1204 - Dec 17, 2019
I have also found an exploit in jpeg2000. But are there any exploits in the native jpeg file? As far as I know, there was a big "windows XP photo viewer" exploit in 2004. But not found anything in windows 7 or later OS versions. Can anyone say about this?