[๖ۣۜCriminal]

https://fossbytes.com/warning-just-openi...et-hacked/

this seems to only effect the jpeg2000 format which is slightly different then normal .jpeg files but opening pdfs with these embedded images is enough to get owned.Alot of people tend to think .jpeg exploits are far fetched but as you can see here they do come through the pipeline occasionally your just not gonna find exploits that target windows photo viewer or similar things.

[Faith Connors]

Good shit, this is a really neat find.
But just out of curiosity, if anyone knows more about memory than me, how far could you potentially go with this? As we can see there is a segfault at the end of the full documentation on the Talos site, which means that the application crashes. So how would you be able to stop that crash and actually execute some kind of code?


Also there is an exploit kit available for images, but it works very differently as it's for hiding code in an image file which is virtually undetectable. Have a look at Stegosploit.

[Mr. Robot]

Been trying to find a post regarding it in detail for a while.

[Faith Connors]

Been trying to find a post regarding it in detail for a while.
-snip-

The official documentation for it is pretty detailed
http://www.talosintelligence.com/reports...2016-0193/

[LanMan]

this seems to only effect the jpeg2000 format which is slightly different then normal .jpeg files but opening pdfs with these embedded images is enough to get owned.
Alot of people tend to think .jpeg exploits are far fetched but as you can see here they do come through the pipeline occasionally your just not gonna find exploits that target windows photo viewer or similar things.

The exploit is just for the codec parsing the jpeg2000 (OpenJPEG), not all app using this format will be vulnerable.
And one of the most used way to crack and flash the PSP was by using a image, a exploit in the libTIFF library

How far could you potentially go with this? As we can see there is a segfault at the end of the full documentation on the Talos site, which means that the application crashes. So how would you be able to stop that crash and actually execute some kind of code?

By using multiple time the exploit they arrive to the point of Code Execution by memory corruption.

In theory you could relocate and make a huge trampoline to continue the flow of the program, but since the exploit is based on wrong headers of the file and memory corruption it will still crash

[somejohndue]

The exploit is just for the codec parsing the jpeg2000 (OpenJPEG), not all app using this format will be vulnerable.
And one of the most used way to crack and flash the PSP was by using a image, a exploit in the libTIFF library

By using multiple time the exploit they arrive to the point of Code Execution by memory corruption.

In theory you could relocate and make a huge trampoline to continue the flow of the program, but since the exploit is based on wrong headers of the file and memory corruption it will still crash

A trampoline? I'd prefer a slide ;)

[LanMan]

A trampoline? I'd prefer a slide ;)

I'm not sure it will work as well, maybe try a swing 😁

[somejohndue]

I'm not sure it will work as well, maybe try a swing 😁

Referred to a NOP sled as the slide. Also there's a common assosiation between the Global Offset Table and a trampoline (it launches off your vtable, function pointers etc), so not so far fetched.

[LanMan]

Referred to a NOP sled as the slide.

Oh my bad, i though it was just a random joke 🤝

[officeunit247]

this seems to only effect the jpeg2000 format which is slightly different then normal .jpeg files but opening pdfs with these embedded images is enough to get owned.Alot of people tend to think .jpeg exploits are far fetched but as you can see here they do come through the pipeline occasionally your just not gonna find exploits that target windows photo viewer or similar things.

i have bought the silent jpeg exploit form 0dayexploits.org its working one pop up but its working exploit i paid 750$ for this exploit but i am happy its working exploit

[SlowMehMo]

i have bought the silent jpeg exploit form 0dayexploits.org its working one pop up but its working exploit i paid 750$ for this exploit but i am happy its working exploit

you paid 750 smackaroos for a exploit that will be patched soon and has a pop up requiring user action?
oh dear, sorry but yeah, you got scammzored.

[greghoglund1204]

I have also found an exploit in jpeg2000. But are there any exploits in the native jpeg file? As far as I know, there was a big "windows XP photo viewer" exploit in 2004. But not found anything in windows 7 or later OS versions. Can anyone say about this?