Electron contextIsolation RCE via Electron internal code
Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Voorbeeld 1
Voorbeeld van https://speakerdeck.com/masatokinugawa/electron-abusing-the-lack-of-context-isolation-curecon-en?slide=41
"exit" gebeurtenis luisteraar word altyd deur die interne kode gestel wanneer die bladsy laai begin. Hierdie gebeurtenis word net voor navigasie uitgegee:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F843477771-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FC6PyZhjUxJWWaN3uLo1y%252Fuploads%252Fgit-blob-53c8c9a9a874ef93bb7610b657d2408527a7a68b%252Fimage%2520%281070%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=c1cdbcf9&sv=1)
https://github.com/nodejs/node/blob/8a44289089a08b7b19fa3c4651b5f1f5d1edd71b/bin/events.js#L156-L231 -- Bestaan nie meer nie
Dan gaan dit hierheen:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F843477771-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FC6PyZhjUxJWWaN3uLo1y%252Fuploads%252Fgit-blob-d53a01b3672f489ace7c263837802ad3b82a6e52%252Fimage%2520%28793%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=21d6a15b&sv=1)
Waar "self" Node se proses objek is:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F843477771-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FC6PyZhjUxJWWaN3uLo1y%252Fuploads%252Fgit-blob-a19d59d32793adac49bc8ff5c08603edca74d89f%252Fimage%2520%28700%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=16ece63b&sv=1)
Die proses objek het 'n verwysing na "require" funksie:
Aangesien die handler.call die proses objek gaan ontvang, kan ons dit oorskryf om arbitrêre kode uit te voer:
Voorbeeld 2
Kry vereis objek uit prototipe besoedeling. Van https://www.youtube.com/watch?v=Tzo8ucHA5xw&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq&index=81
Besoedeling:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F843477771-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FC6PyZhjUxJWWaN3uLo1y%252Fuploads%252Fgit-blob-2a98479515b54b62aecb80f3b215ca7f72469e35%252Fimage%2520%28279%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=701f5308&sv=1)
Eksploiteer:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F843477771-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FC6PyZhjUxJWWaN3uLo1y%252Fuploads%252Fgit-blob-2758b36d6443234264d7e9aeaca2377b4df5f7e9%252Fimage%2520%2889%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=27d8e141&sv=1)
Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated