Electron contextIsolation RCE via Electron internal code
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Örnek 1
https://speakerdeck.com/masatokinugawa/electron-abusing-the-lack-of-context-isolation-curecon-en?slide=41 adresinden örnek
"exit" olay dinleyicisi, sayfa yüklemesi başladığında her zaman iç kod tarafından ayarlanır. Bu olay, navigasyondan hemen önce yayımlanır:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F2815339644-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FKXYG6TIGtXXE4WZnfup9%252Fuploads%252Fgit-blob-53c8c9a9a874ef93bb7610b657d2408527a7a68b%252Fimage%2520%281070%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=3be498f4&sv=1)
https://github.com/nodejs/node/blob/8a44289089a08b7b19fa3c4651b5f1f5d1edd71b/bin/events.js#L156-L231 -- Artık mevcut değil
Sonra buraya gidiyor:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F2815339644-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FKXYG6TIGtXXE4WZnfup9%252Fuploads%252Fgit-blob-d53a01b3672f489ace7c263837802ad3b82a6e52%252Fimage%2520%28793%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=5cce2460&sv=1)
Burada "self", Node'un işlem nesnesidir:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F2815339644-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FKXYG6TIGtXXE4WZnfup9%252Fuploads%252Fgit-blob-a19d59d32793adac49bc8ff5c08603edca74d89f%252Fimage%2520%28700%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=4d9598d0&sv=1)
İşlem nesnesi "require" fonksiyonuna bir referansa sahiptir:
handler.call, process nesnesini alacağı için, onu rastgele kod çalıştırmak için geçersiz kılabiliriz:
Örnek 2
Prototip kirlenmesinden require nesnesini al. https://www.youtube.com/watch?v=Tzo8ucHA5xw&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq&index=81
Sızıntı:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F2815339644-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FKXYG6TIGtXXE4WZnfup9%252Fuploads%252Fgit-blob-2a98479515b54b62aecb80f3b215ca7f72469e35%252Fimage%2520%28279%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=84f96243&sv=1)
Sömürü:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F2815339644-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FKXYG6TIGtXXE4WZnfup9%252Fuploads%252Fgit-blob-2758b36d6443234264d7e9aeaca2377b4df5f7e9%252Fimage%2520%2889%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=612ac314&sv=1)
AWS Hacking öğrenin ve pratik yapın:HackTricks Training AWS Red Team Expert (ARTE)
GCP Hacking öğrenin ve pratik yapın:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated