mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-16 14:08:26 +00:00
GITBOOK-4142: change request with no subject merged in GitBook
This commit is contained in:
CPol
gitbook-bot
parent
1015696215
commit
46d107852a
9 changed files with 42 additions and 30 deletions
10
SUMMARY.md
10
SUMMARY.md
|
|
@ -386,9 +386,12 @@
|
|||
* [Buckets](network-services-pentesting/pentesting-web/buckets/README.md)
|
||||
* [Firebase Database](network-services-pentesting/pentesting-web/buckets/firebase-database.md)
|
||||
* [CGI](network-services-pentesting/pentesting-web/cgi.md)
|
||||
* [Source code Review / SAST Tools](network-services-pentesting/pentesting-web/code-review-tools.md)
|
||||
* [DotNetNuke (DNN)](network-services-pentesting/pentesting-web/dotnetnuke-dnn.md)
|
||||
* [Drupal](network-services-pentesting/pentesting-web/drupal.md)
|
||||
* [Electron Desktop Apps](network-services-pentesting/pentesting-web/electron-desktop-apps/README.md)
|
||||
* [Electron contextIsolation RCE via preload code](network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md)
|
||||
* [Electron contextIsolation RCE via Electron internal code](network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md)
|
||||
* [Electron contextIsolation RCE via IPC](network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.md)
|
||||
* [Flask](network-services-pentesting/pentesting-web/flask.md)
|
||||
* [NodeJS Express](network-services-pentesting/pentesting-web/nodejs-express.md)
|
||||
* [Git](network-services-pentesting/pentesting-web/git.md)
|
||||
|
|
@ -427,6 +430,7 @@
|
|||
* [Python](network-services-pentesting/pentesting-web/python.md)
|
||||
* [Rocket Chat](network-services-pentesting/pentesting-web/rocket-chat.md)
|
||||
* [Special HTTP headers](network-services-pentesting/pentesting-web/special-http-headers.md)
|
||||
* [Source code Review / SAST Tools](network-services-pentesting/pentesting-web/code-review-tools.md)
|
||||
* [Spring Actuators](network-services-pentesting/pentesting-web/spring-actuators.md)
|
||||
* [Symfony](network-services-pentesting/pentesting-web/symphony.md)
|
||||
* [Tomcat](network-services-pentesting/pentesting-web/tomcat.md)
|
||||
|
|
@ -438,10 +442,6 @@
|
|||
* [WebDav](network-services-pentesting/pentesting-web/put-method-webdav.md)
|
||||
* [Werkzeug / Flask Debug](network-services-pentesting/pentesting-web/werkzeug.md)
|
||||
* [Wordpress](network-services-pentesting/pentesting-web/wordpress.md)
|
||||
* [XSS to RCE Electron Desktop Apps](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md)
|
||||
* [Electron contextIsolation RCE via preload code](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md)
|
||||
* [Electron contextIsolation RCE via Electron internal code](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md)
|
||||
* [Electron contextIsolation RCE via IPC](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-ipc.md)
|
||||
* [88tcp/udp - Pentesting Kerberos](network-services-pentesting/pentesting-kerberos-88/README.md)
|
||||
* [Harvesting tickets from Windows](network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md)
|
||||
* [Harvesting tickets from Linux](network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md)
|
||||
|
|
|
|||
|
|
@ -4,15 +4,11 @@
|
|||
|
||||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
|
||||
|
|
@ -108,7 +104,7 @@ Note that **NodeJS RCE exploits won't work** if connected to a browser via [**Ch
|
|||
## RCE in NodeJS Debugger/Inspector
|
||||
|
||||
{% hint style="info" %}
|
||||
If you came here looking how to get [**RCE from a XSS in Electron please check this page.**](../../network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/)
|
||||
If you came here looking how to get [**RCE from a XSS in Electron please check this page.**](../../network-services-pentesting/pentesting-web/electron-desktop-apps/)
|
||||
{% endhint %}
|
||||
|
||||
Some common ways to obtain **RCE** when you can **connect** to a Node **inspector** is using something like (looks that this **won't work in a connection to Chrome DevTools protocol**):
|
||||
|
|
@ -127,7 +123,7 @@ In this section I will just list interesting things I find people have used to e
|
|||
|
||||
### Parameter Injection via Deep Links
|
||||
|
||||
In the [**CVE-2021-38112**](https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/) Rhino security discovered that an application based on CEF **registered a custom UR**I in the system (workspaces://) that received the full URI and then **launched the CEF based applicatio**n with a configuration that was partially constructing from that URI.
|
||||
In the [**CVE-2021-38112**](https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/) Rhino security discovered that an application based on CEF **registered a custom UR**I in the system (workspaces://) that received the full URI and then **launched the CEF based applicatio**n with a configuration that was partially constructing from that URI.
|
||||
|
||||
It was discovered that the URI parameters where URL decoded and used to launch the CEF basic application, allowing a user to **inject** the flag **`--gpu-launcher`** in the **command line** and execute arbitrary things.
|
||||
|
||||
|
|
@ -186,14 +182,10 @@ Start-Process "Chrome" "--remote-debugging-port=9222 --restore-last-session"
|
|||
|
||||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -180,9 +180,21 @@ require('child_process').execSync('/System/Applications/Calculator.app/Contents/
|
|||
{% hint style="danger" %}
|
||||
If the fuse**`EnableNodeCliInspectArguments`** is disabled, the app will **ignore node parameters** (such as `--inspect`) when launched unless the env variable **`ELECTRON_RUN_AS_NODE`** is set, which will be also **ignored** if the fuse **`RunAsNode`** is disabled.
|
||||
|
||||
However, you could still use the electron param `--remote-debugging-port=9229` but the previous payload won't work to execute other processes.
|
||||
However, you could still use the **electron param `--remote-debugging-port=9229`** but the previous payload won't work to execute other processes.
|
||||
{% endhint %}
|
||||
|
||||
Using the param **`--remote-debugging-port=9222`** it's possible to steal some information from the Electron App like the **history** (with GET commands) or the **cookies** of the browser (as they are **decrypted** inside the browser and there is a **json endpoint** that will give them).
|
||||
|
||||
You can learn how to do that in [**here**](https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e) and [**here**](https://slyd0g.medium.com/debugging-cookie-dumping-failures-with-chromiums-remote-debugger-8a4c4d19429f) and use the automatic tool [WhiteChocolateMacademiaNut](https://github.com/slyd0g/WhiteChocolateMacademiaNut) or a simple script like:
|
||||
|
||||
```python
|
||||
import websocket
|
||||
ws = websocket.WebSocket()
|
||||
ws.connect("ws://localhost:9222/devtools/page/85976D59050BFEFDBA48204E3D865D00", suppress_origin=True)
|
||||
ws.send('{\"id\": 1, \"method\": \"Network.getAllCookies\"}')
|
||||
print(ws.recv()
|
||||
```
|
||||
|
||||
### Injection from the App Plist
|
||||
|
||||
You could abuse this env variable in a plist to maintain persistence adding these keys:
|
||||
|
|
|
|||
|
|
@ -116,7 +116,7 @@ Some **tricks** for **finding vulnerabilities** in different well known **techno
|
|||
* [**WebDav**](put-method-webdav.md)
|
||||
* [**Werkzeug**](werkzeug.md)
|
||||
* [**Wordpress**](wordpress.md)
|
||||
* [**Electron Desktop (XSS to RCE)**](xss-to-rce-electron-desktop-apps/)
|
||||
* [**Electron Desktop (XSS to RCE)**](electron-desktop-apps/)
|
||||
|
||||
_Take into account that the **same domain** can be using **different technologies** in different **ports**, **folders** and **subdomains**._\
|
||||
If the web application is using any well known **tech/platform listed before** or **any other**, don't forget to **search on the Internet** new tricks (and let me know!).
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# XSS to RCE Electron Desktop Apps
|
||||
# Electron Desktop Apps
|
||||
|
||||
<details>
|
||||
|
||||
|
|
@ -112,6 +112,14 @@ Modify the start-main configuration and add the use of a proxy such as:
|
|||
"start-main": "electron ./dist/main/main.js --proxy-server=127.0.0.1:8080 --ignore-certificateerrors",
|
||||
```
|
||||
|
||||
## Electron Local Code Injection
|
||||
|
||||
If you can execute locally an Electron App it's possible that you could make it execute arbitrary javascript code. Check how in:
|
||||
|
||||
{% content-ref url="../../../macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md" %}
|
||||
[macos-electron-applications-injection.md](../../../macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## RCE: XSS + nodeIntegration
|
||||
|
||||
If the **nodeIntegration** is set to **on**, a web page's JavaScript can use Node.js features easily just by calling the `require()`. For example, the way to execute the calc application on Windows is:
|
||||
|
|
@ -184,8 +184,8 @@ Some **examples**:
|
|||
[server-side-xss-dynamic-pdf.md](server-side-xss-dynamic-pdf.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
{% content-ref url="../../network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/" %}
|
||||
[xss-to-rce-electron-desktop-apps](../../network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/)
|
||||
{% content-ref url="../../network-services-pentesting/pentesting-web/electron-desktop-apps/" %}
|
||||
[electron-desktop-apps](../../network-services-pentesting/pentesting-web/electron-desktop-apps/)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## WAF bypass encoding image
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue