SHARE
TWEET

EDB-ID-45502

TVT618 Oct 1st, 2018 222 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 1. Content process -> Privileged content process (first_stage.js)
  2. When spawning a new Edge content process, its privilege is determined by its URL. This URL check is performed by the LCIEUrlPolicy::GetPICForPrivilegedInternalPage method in eModel.dll. The method calls several another methods to check the URL. One of them EdgeUrlUtils::IsAboutFlagsResUri is vulnerable. Since it only checks the scheme and whether the URL ends with "/edgehtml.dll/flags.htm", the following URL which will execute arbitrary JavaScript code will be considered to need to spawn a privileged content process.
  3.  
  4. res://apds.dll/redirect.html?target=javascript:alert(1)//edgehtml.dll/flags.htm
  5.  
  6. As a navigation triggered from JavaScript to the "res" scheme is not allowed, an additional renderer exploit is required. I used   issue 1588   for it.
  7.  
  8. 2. Privileged content process -> Internet Explorer (second_stage.js)
  9. In a privileged content process, we can ask to the host to launch IE for some sites for compatibility. The host then redirects the request to the broker after checking whether the domain of the requested URL is in the IE compatibility view list. Since it only checks the domain, an arbitrary scheme like "file://" can be given.
  10.  
  11. For this part, a domain in the IE compatibility view list is required to host a samba server. I found that some domains were unregistered, but I just modified the hosts file for testing.
  12.  
  13. 3. Internet Explorer
  14. If the given URL has the "file://" scheme and it's a folder, IE will just open it using ShellExecuteExW. I managed to create a lnk file that bypasses the folder check and executes an arbitrary file. Please find lnk_bug.cc in the PoC.
  15.  
  16.  
  17.  
  18. To reproduce the PoC, you will need a remote machine hosting a samba server and a http server. Note that the PoC uses hardcoded offsets for "Build 17692.rs_prerelease.180609-1317".
  19.  
  20.  
  21. Proof of Concept:
  22. https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45502.zip
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top