Dissecting Exploit Kits by: Daniel Frank

### Overview In this talk titled "Dissecting Exploit Kits," speaker Daniel Frank examines the operational workflow, architecture, and code execution patterns commonly found in web-based exploit kits. Exploit kits operate as automated attack frameworks designed to profile victim machines, deliver targeted exploits through browsers and plugins, and ultimately drop and execute malicious payloads.

### Key Topics - **Exploit Kit Attack Chain**: The lifecycle begins with victim redirection to an exploit kit landing page (often via malicious servers or popups), followed by reconnaissance to profile installed software versions, targeted vulnerability exploitation, and payload execution. - **Target Technologies & Vulnerabilities**: Exploit kits historically focused on widely deployed technologies such as Internet Explorer, Silverlight, and Adobe Flash. Frank references specific vulnerabilities, including CVE-2015-5119 (affecting Flash version 19 and earlier) and CVE-2016-0188. - **Geographic Targeting**: Exploitation patterns and campaign telemetry show regional targeting tendencies, with high victim activity observed in countries such as Japan and South Korea. - **Analyzed Exploit Kits**: The presentation provides detailed, stage-by-stage teardowns of two major exploit kits: Magnitude Exploit Kit and Sundown Exploit Kit.

### Technical Details - **Magnitude Exploit Kit Walkthrough**: - **Stage 0 & Stage 1**: Begins with initial redirection and communication with malicious URLs. An obfuscated JavaScript stage profiles the client environment to confirm the presence of vulnerable configurations. - **Stage 2 (Exploitation)**: Exploits an issue within JavaScript parsing/JSON processing where nested fields lead to memory corruption or arbitrary execution. - **Payload Deobfuscation & Execution**: The kit delivers an obfuscated payload (referenced in the code as `np90action`). A decoding function loops through character arrays, reassembles the binary data, and searches system processes to obtain execution handles. The downloaded payload is then written to disk and executed. The demonstration shows dropped malware—specifically ransomware—initiating file encryption on the host. - **Sundown Exploit Kit Walkthrough**: - **Landing Page & Stages**: Features a simple landing page delivering multiple obfuscated payload objects. In Stage 1, scripts unpack base64 and byte-encoded strings to serve further exploit stages. - **Flash Weaponization**: Targets the client by loading multiple SWF/Flash files. The speaker extracts and deobfuscates a Flash payload by isolating an embedded decoding routine that reads the first byte as a XOR key to unpack compressed Flash binary data. - **Execution**: Once decompressed, the exploit retrieves the secondary binary payload, saves it into local application data folders (such as the APPDATA temp/bin paths), and spawns the malicious process.

### Takeaways - Exploit kits heavily rely on layered multi-stage architectures (Stage 0 redirection, Stage 1 profiling, Stage 2 exploitation, and final payload staging) to complicate static analysis and evade automated detection. - Threat actors utilize obfuscation techniques such as XOR encoding, character manipulation, and base64 layering within both JavaScript and Flash media. - As modern browsers and platforms phased out legacy plugins like Flash and Silverlight, attackers shifted toward direct link distribution and alternative delivery mechanisms, though understanding exploit kit design remains critical for analyzing automated web exploitation.