Exploit Kits: Anatomy Of A Silverlight Exploit

This report analyzes how popular exploit kits (e.g., Nuclear, Fiesta) weaponize Silverlight vulnerabilities—CVE-2013-0074 (arbitrary code execution) and CVE-2013-3896 (memory disclosure)—via malicious XAP payloads. It describes the exploit chain and DLL reverse-engineering findings, shows how the payloads calculate base addresses and trigger vulnerabilities to execute shellcode, and provides a list of recently observed Nuclear EK domains.