Electron contextIsolation RCE via Electron internal code
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Esempio 1
Il listener dell'evento "exit" è sempre impostato dal codice interno quando inizia il caricamento della pagina. Questo evento viene emesso poco prima della navigazione:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F197708944-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FE5VfhVAq0qYsgU9deMR8%252Fuploads%252Fgit-blob-53c8c9a9a874ef93bb7610b657d2408527a7a68b%252Fimage%2520%281070%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=3e465ceb&sv=1)
https://github.com/nodejs/node/blob/8a44289089a08b7b19fa3c4651b5f1f5d1edd71b/bin/events.js#L156-L231 -- Non esiste più
Poi va qui:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F197708944-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FE5VfhVAq0qYsgU9deMR8%252Fuploads%252Fgit-blob-d53a01b3672f489ace7c263837802ad3b82a6e52%252Fimage%2520%28793%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=95d7e575&sv=1)
Dove "self" è l'oggetto processo di Node:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F197708944-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FE5VfhVAq0qYsgU9deMR8%252Fuploads%252Fgit-blob-a19d59d32793adac49bc8ff5c08603edca74d89f%252Fimage%2520%28700%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=ab7446d9&sv=1)
L'oggetto processo ha un riferimento alla funzione "require":
Poiché handler.call riceverà l'oggetto process, possiamo sovrascriverlo per eseguire codice arbitrario:
Esempio 2
Ottieni l'oggetto require dalla contaminazione del prototipo. Da https://www.youtube.com/watch?v=Tzo8ucHA5xw&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq&index=81
Leak:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F197708944-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FE5VfhVAq0qYsgU9deMR8%252Fuploads%252Fgit-blob-2a98479515b54b62aecb80f3b215ca7f72469e35%252Fimage%2520%28279%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=9fdab882&sv=1)
Exploit:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F197708944-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FE5VfhVAq0qYsgU9deMR8%252Fuploads%252Fgit-blob-2758b36d6443234264d7e9aeaca2377b4df5f7e9%252Fimage%2520%2889%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=e544040f&sv=1)
Impara e pratica il hacking AWS:HackTricks Training AWS Red Team Expert (ARTE)
Impara e pratica il hacking GCP:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated