SKAEG: Automatic Exploit Generation Based on Shared Keywords in Embedded Systems

Abstract

 Existing Automatic Exploit Generation (AEG) solutions primarily target Linux and Windows binary files. Currently, only one AEG framework for IoT devices—IoTAEG—has been proposed, which emphasizes bypassing diverse protection mechanisms and relies on real devices for exploit generation. To enhance the efficiency of exploit generation for IoT firmware vulnerabilities, we present Automatic Exploit Generation Based on Shared Keywords (SKAEG) in embedded systems, a novel shared-keyword-based approach. SKAEG automatically detects and analyses vulnerabilities within IoT device firmware and generates exploits subsequently. It first extracts shared keywords from firmware to guide taint analysis for vulnerability detection. To improve efficiency, pruning strategies are applied during taint analysis to eliminate infeasible paths. Subsequently, we introduce two new modules: Exploitability Analysis, which evaluates whether identified vulnerabilities can be exploited, and Frontend File Parsing, which constructs request packets based on shared keywords. This design enables SKAEG to integrate vulnerability analysis with concrete exploit generation, thereby facilitating the automated construction of complete exploits. Experimental results demonstrate that SKAEG successfully detects and exploits vulnerabilities across 10 IoT devices from 4 manufacturers, covering 8 CVE-listed vulnerabilities. Additionally, the exploitability analysis accurately identifies 51 non-exploitable vulnerabilities. Through optimized symbolic execution, SKAEG addresses solver crash issues and achieves superior exploit generation efficiency compared to IoTAEG.