HTML Smuggling
In the previous sections, we created a malicious executable
and tested it by manually downloading and running it on a “victim’s” machine.
This works well as an example,
but attackers will often use more discreet delivery methods.
For example, an attacker may embed a link in an email.
When the victim reads the email and visits the webpage,
JavaScript code will use HTML Smuggling
to automatically save the dropper file.
This technique leverages the HTML5 anchor tag download attribute,
which instructs the browser to automatically download a file
when a user clicks the assigned hyperlink.
Let’s try this out by creating
an HTML file on our Kali Linux machine’s Apache server.
We’ll create a simple hyperlink
and set the download attribute anchor tag.
When a user clicks this link from an HTML5-compatible browser,
the msfstaged.exe file
will be downloaded to the users’s default download directory.
Although this works well, it exposes the filename and extension of the dropper
and requires the user to manually click on the link.
To avoid this we can trigger the download from an embedded JavaScript file.
This method feeds the file as an octet stream
and will download the assembled file without user interaction.
We’ll demonstrate this by building a proof of concept slowly,
explaining each section of the code as we go along.
Let’s discuss the required tasks.
First, we’ll create a Base64 Meterpreter executable
and store it as a Blob inside of a JavaScript variable.
Next, we’ll use that Blob to create a URL file object
that simulates a file on the web server.
Finally, we’ll create an invisible anchor tag
that will trigger a download action
once the victim loads the page.
The first hurdle is to store an executable
inside JavaScript
and allow it to be used with the download attribute.
By default, the download attribute only accepts files stored on a web server.
However, it will also accept an embedded Blob object.
The Blob object may be instantiated from a byte array.
Once this Blob has been created,
we can use it together with the static createObjectURL method
to create a URL file object.
This essentially simulates a file located on a web server,
but instead
reads from memory.
Now that we have the file object in memory,
we can create the anchor object
with the createElement method,
specifying the tagName of the anchor object, which is “a”.
We’ll then use the appendChild method
to place the created anchor object
in the HTML document
and specify its attributes.
First, we’ll set the display style to “none”
to ensure the anchor is not displayed on the webpage.
Next, we’ll set href to the URL leading to a remote file,
which we’ll embedded through \the Blob and URL file object.
Finally, we’ll set the
download attribute specifying a filename on the victim’s machine.
Note that the filename variable
will be set before we run the code, as we’ll see later on.
With the invisible anchor object created
and referencing our Blob object,
we can trigger the download prompt through the click method.
Before we are able to perform the HTML smuggling attack,
we need to embed the file.
In this example, we’ll embed a Meterpreter executable
inside the JavaScript code.
To avoid invalid characters we’ll Base64 encode the binary
and write a Base64 decoding function
that converts the file back to its original form
and stores it into a byte array.
Finally, we can generate a 64bit windows meterpreter reverse https payload
using our now-familiar syntax,
and convert it to base64.
It should be noted that we embed it as one continuous string.
Now let’s put everything together.
First, the Base64 code is decoded and then put into data
as part of the Base64 to array buffer method.
We’ll then place the array buffer into our Blob.
Next, we’ll create a hidden “a” tag.
The data from our Blob is then moved
to the href reference of our “a” tag.
Our Blob code in the href is given the file name of ‘msfstaged.exe’.
Finally, a click action is performed to download our file.
After saving the webpage to the web root of our Apache server,
we can browse to it using Google Chrome from the Windows 10 victim machine.
Just browsing the file will cause a trigger to download the executable.
Unfortunately, a warning may be displayed due to the potentially unsafe file format.
This warning may appear because the attachment is saved as an executable.
We’ll ignore this warning and download and run it anyway.
After running the new executable,
we obtain a reverse Meterpreter shell using the multi/handler.