diff --git a/.gitbook/assets/image (15) (3).png b/.gitbook/assets/image (15) (3).png new file mode 100644 index 000000000..d5eb069ff Binary files /dev/null and b/.gitbook/assets/image (15) (3).png differ diff --git a/.gitbook/assets/image (15).png b/.gitbook/assets/image (15).png index d5eb069ff..3ae281225 100644 Binary files a/.gitbook/assets/image (15).png and b/.gitbook/assets/image (15).png differ diff --git a/.gitbook/assets/image (8) (1).png b/.gitbook/assets/image (8) (1).png index 7df371f93..066cf2ec8 100644 Binary files a/.gitbook/assets/image (8) (1).png and b/.gitbook/assets/image (8) (1).png differ diff --git a/.gitbook/assets/image (8).png b/.gitbook/assets/image (8).png index 3ae281225..7df371f93 100644 Binary files a/.gitbook/assets/image (8).png and b/.gitbook/assets/image (8).png differ diff --git a/backdoors/salseo.md b/backdoors/salseo.md index fd972aed1..d98dbce9c 100644 --- a/backdoors/salseo.md +++ b/backdoors/salseo.md @@ -133,7 +133,7 @@ Select **x64** (if you are going to use it inside a x64 box, that was my case), **\[DllExport]** should not be longer marked as error -![](<../.gitbook/assets/image (8) (1) (1).png>) +![](<../.gitbook/assets/image (8) (1).png>) ### Build the solution diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md index 28eeea3b2..4301c1100 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md @@ -26,11 +26,29 @@ require('child_process').execSync('/System/Applications/Calculator.app/Contents/ {% endcode %} {% hint style="danger" %} -Note that now most Electron applications will ignore node parameters (such as --inspect) when launched unless the env variable **`ELECTRON_RUN_AS_NODE`** is set. +Note that now **hardened** Electron applications will **ignore node parameters** (such as --inspect) when launched unless the env variable **`ELECTRON_RUN_AS_NODE`** is set. However, you could still use the electron param `--remote-debugging-port=9229` but the previous payload won't work to execute other processes. {% endhint %} +## `NODE_OPTIONS` + +{% hint style="warning" %} +This env variable would only work if the Electron application hasn't been properly hardened and is allowing it. If hardened, you would also need to use the **env variable `ELECTRON_RUN_AS_NODE`**. +{% endhint %} + +With this combination you could store the payload in a different file and execute that file: + +{% code overflow="wrap" %} +```bash +# Content of /tmp/payload.js +require('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Ca$ + +# Execute +NODE_OPTIONS="--require /tmp/payload.js" ELECTRON_RUN_AS_NODE=1 /Applications/Discord.app/Contents/MacOS/Discord +``` +{% endcode %} + ## `ELECTRON_RUN_AS_NODE` According to [**the docs**](https://www.electronjs.org/docs/latest/api/environment-variables#electron\_run\_as\_node), if this env variable is set, it will start the process as a normal Node.js process. @@ -70,20 +88,6 @@ As [**proposed here**](https://www.trustedsec.com/blog/macos-injection-via-third ``` -### `ELECTRON_RUN_AS_NODE` & `NODE_OPTIONS` - -With this combination you could store the payload in a different file and execute that file: - -{% code overflow="wrap" %} -```bash -# Content of /tmp/payload.js -require('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Ca$ - -# Execute -NODE_OPTIONS="--require /tmp/payload.js" ELECTRON_RUN_AS_NODE=1 /Applications/Discord.app/Contents/MacOS/Discord -``` -{% endcode %} -
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥 diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md b/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md index 987c7bdf9..af3056e66 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md @@ -378,7 +378,7 @@ $> ls ~/Documents Notes had access to TCC protected locations but when a note is created this is **created in a non-protected location**. So, you could ask notes to copy a protected file in a noe (so in a non-protected location) and then access the file: -
+
### CVE-2023-26818 - Telegram diff --git a/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md b/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md index a9affdd26..c045c5dcf 100644 --- a/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md +++ b/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md @@ -7,7 +7,7 @@ * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
@@ -38,7 +38,7 @@ You can create **fake cards in Flipper Zero indicating the data** you manually a #### IDs on cards -Some times, when you get a card you will find the ID (or part) of it written in the card visible. +Some times, when you get a card you will find the ID (or part) of it written in the card visible. * **EM Marin** @@ -51,7 +51,7 @@ The other 2 can be brute-forced if you cannot read them from the card. Same happens in this HID card where only 2 out of 3 bytes can be found printed in the card -
+
### Emulate/Write @@ -68,7 +68,7 @@ After **copying** a card or **entering** the ID **manually** it's possible to ** * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).