Electron contextIsolation RCE via Electron internal code
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Example 1
"exit" 이벤트 리스너는 페이지 로딩이 시작될 때 항상 내부 코드에 의해 설정됩니다. 이 이벤트는 탐색 직전에 발생합니다:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F311514708-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F1ImEu59kE9yiIA7SmB7z%252Fuploads%252Fgit-blob-53c8c9a9a874ef93bb7610b657d2408527a7a68b%252Fimage%2520%281070%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=139ba79a&sv=1)
https://github.com/nodejs/node/blob/8a44289089a08b7b19fa3c4651b5f1f5d1edd71b/bin/events.js#L156-L231 -- 더 이상 존재하지 않음
그런 다음 여기로 이동합니다:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F311514708-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F1ImEu59kE9yiIA7SmB7z%252Fuploads%252Fgit-blob-d53a01b3672f489ace7c263837802ad3b82a6e52%252Fimage%2520%28793%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=88a7fd16&sv=1)
여기서 "self"는 Node의 프로세스 객체입니다:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F311514708-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F1ImEu59kE9yiIA7SmB7z%252Fuploads%252Fgit-blob-a19d59d32793adac49bc8ff5c08603edca74d89f%252Fimage%2520%28700%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=29c9f0f2&sv=1)
프로세스 객체는 "require" 함수에 대한 참조를 가지고 있습니다:
handler.call이 process 객체를 받을 것이므로, 이를 덮어써서 임의의 코드를 실행할 수 있습니다:
Example 2
프로토타입 오염에서 require 객체 가져오기. From https://www.youtube.com/watch?v=Tzo8ucHA5xw&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq&index=81
누출:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F311514708-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F1ImEu59kE9yiIA7SmB7z%252Fuploads%252Fgit-blob-2a98479515b54b62aecb80f3b215ca7f72469e35%252Fimage%2520%28279%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=62fa11c1&sv=1)
악용:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F311514708-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F1ImEu59kE9yiIA7SmB7z%252Fuploads%252Fgit-blob-2758b36d6443234264d7e9aeaca2377b4df5f7e9%252Fimage%2520%2889%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=1c5be906&sv=1)
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated