HTML Smuggling Against VirusTotal

Introduction

File smuggling is a method used to bypass proxy restrictions on specific file types that a user is attempting to download. If the proxy prevents you from downloading files like .exe via the browser, this technique allows you to bypass it by embedding malicious payloads within HTML files.

Also, Mitre says: Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html.

HTML Smuggling Technique

First, let's begin by making a simple HTML page.

<!DOCTYPE html>
<html>
<head>
  <title>Download File</title>
  <style>
    body {
      font-family: Arial, sans-serif;
      text-align: center;
    }

    #download-btn {
      background-color: #4CAF50;
      color: #ffffff;
      padding: 10px 20px;
      border: none;
      border-radius: 5px;
      cursor: pointer;
    }

    #download-btn:hover {
      background-color: #3e8e41;
    }
  </style>
</head>
<body>
  <h1>Download File</h1>
  <button id="download-btn">Download File</button>
<!-- Start HTML_SMUGGl1NG -->

<!-- End HTML_SMUGGl1NG -->
</body>
</html>

Next, we'll make a JavaScript script that can decode a Base64 string and download it to the target machine.

Let’s now combine everything and begin the game with VirusTotal. We will upload the file to VT.

So, the result is show on VirusTotal, 18 security vendors flagged our file as malicious.

https://www.virustotal.com/gui/file/807f7ce84bbe4710a9fbe7f21a499128321165fb1eafb024ae41376ffa4788e6?nocache=1

Now, let's create a function that can detect mouse movement. If movement is detected, start the file download process. This method can help bypass certain sandbox restrictions.

We should upload it to VirusTotal once more.

https://www.virustotal.com/gui/file/fc65b92cd95b8bd05e6f28f32e55c55e8310e7ef7c22aa922895a40342650af7?nocache=1

Great, by using this trick, we were able to avoid 3 vendors. Now, let's try reversing the base64 string to see if it has any impact. So we need to write a function to reverse the string before decode it.

Upload the file to VirusTotal , one more time.

https://www.virustotal.com/gui/file/abf67fea4829748268b64efdbae1943a8163a2685903afe39af3b6db25bf703c?nocache=1

I believe that even a small effort can have a significant impact. We were able to bypass nearly all AV/Sandbox with this small trick.

Let's kill last 3, I'm going to write Python code to XOR our payload, then write another function in JavaScript to decrypt it. Let's start with Python first.

Now, same thing with JavaScript to decryp it.

Full code

Finally, upload it to VirusTotal.

https://www.virustotal.com/gui/file/fc225350548557a0489f56b45b46cce498b8a3d2683ba223a41e53996632c394?nocache=1

We managed to bypass all AV/Sandbox :)

References

Obfuscated Files or Information: HTML Smuggling

File Smuggling with HTML and JavaScript

A Detailed Guide on HTML Smuggling

ChatGPT

Last updated

Was this helpful?