1 00:00:00,180 --> 00:00:01,498 - What's up? 2 00:00:01,498 --> 00:00:04,923 What the fuck is up, Denny's? I mean, DEF CON? 3 00:00:05,850 --> 00:00:09,180 Hi, I'm Jimi Two Times and I'm here to talk about 4 00:00:09,180 --> 00:00:12,453 how I broke my Chromebook with a Pico Ducky. 5 00:00:16,050 --> 00:00:20,730 I'll also say this, I'm a goon, I've lost my voice, 6 00:00:20,730 --> 00:00:24,093 and I'm gonna do my best here, so bear with me. 7 00:00:26,100 --> 00:00:29,700 My name is Jimi Two Times, Jim Allee, as I said before. 8 00:00:29,700 --> 00:00:32,193 I'm the CEO of Lost Rabbit Labs right now. 9 00:00:36,750 --> 00:00:40,440 I am a former member of the US National Video Game Team. 10 00:00:40,440 --> 00:00:45,360 You can see some history there on osgrelics.com, 11 00:00:45,360 --> 00:00:46,833 Old School Gaming. 12 00:00:48,630 --> 00:00:50,310 My hacking led me to get involved 13 00:00:50,310 --> 00:00:53,370 in the video game industry back in the 80s. 14 00:00:53,370 --> 00:00:56,190 I was the first person to beat Mike Tyson's Punch-Out, 15 00:00:56,190 --> 00:00:59,340 a bunch of NES and Sega Master System games. 16 00:00:59,340 --> 00:01:02,430 And I'm actually two characters 17 00:01:02,430 --> 00:01:04,530 in two Sega Master System games, 18 00:01:04,530 --> 00:01:08,403 Zillion 2 and Wonder Boy in Monsterland, represent. 19 00:01:09,240 --> 00:01:14,240 20 years martial arts student, I think that is important 20 00:01:14,520 --> 00:01:19,520 to be scholar warriorly in our hacker and everything we do. 21 00:01:20,100 --> 00:01:22,860 And so I just wanted to mention that. 22 00:01:22,860 --> 00:01:26,490 And I am dedicated to gamifying our craft 23 00:01:26,490 --> 00:01:28,383 because this is all fucking fun. 24 00:01:29,820 --> 00:01:32,700 It's my first time presenting, been at Goon for six years, 25 00:01:32,700 --> 00:01:35,610 Skytalks for eight, and this is a huge honor. 26 00:01:35,610 --> 00:01:37,470 So thank you, DEF CON, and thank you, everybody, 27 00:01:37,470 --> 00:01:39,352 for showing up, appreciate it. 28 00:01:39,352 --> 00:01:42,352 (audience cheering) 29 00:01:45,540 --> 00:01:49,110 So we will be covering gamified hacking, 30 00:01:49,110 --> 00:01:53,673 container breakouts, fuzzing strategy, LOLBinning, 31 00:01:54,540 --> 00:01:59,540 Living Off the Land, retro assessments, unorthodox methods, 32 00:01:59,580 --> 00:02:01,383 and one-liners for the fucking win. 33 00:02:03,210 --> 00:02:06,150 I will say that, first off, this exploit 34 00:02:06,150 --> 00:02:10,890 is on an end-of-life Chromebook, it's a known vulnerability 35 00:02:10,890 --> 00:02:13,290 that's been patched two years ago. 36 00:02:13,290 --> 00:02:15,240 However, I think some of the techniques 37 00:02:15,240 --> 00:02:17,850 in here will help bug bounty 38 00:02:17,850 --> 00:02:20,223 and help other folks secure their Chromebooks. 39 00:02:22,560 --> 00:02:26,640 This Chromebook hack was done in factory reset state 40 00:02:26,640 --> 00:02:30,810 and it was done living off of the land really, mostly, 41 00:02:30,810 --> 00:02:32,133 or only at the end. 42 00:02:33,210 --> 00:02:35,850 One-liners, they're like keys. 43 00:02:35,850 --> 00:02:38,310 It's a string that will open a door. 44 00:02:38,310 --> 00:02:41,280 And every chance we can, we'll use them here. 45 00:02:41,280 --> 00:02:45,930 And the Pico Ducky, it is a key, it's a shim, it's a key, 46 00:02:45,930 --> 00:02:48,530 you can shove it in and it will open a door for you. 47 00:02:50,430 --> 00:02:52,383 So gamified efforts. 48 00:02:53,400 --> 00:02:56,100 I feel like we're better at progressing 49 00:02:56,100 --> 00:03:00,360 when we have a challenge or an ankle weight on us, 50 00:03:00,360 --> 00:03:04,530 so it's often good to put yourself in jail 51 00:03:04,530 --> 00:03:07,020 and really be thorough on how to get out of there, 52 00:03:07,020 --> 00:03:09,663 to research all aspects of your environment. 53 00:03:10,830 --> 00:03:13,890 Being tenacious, thorough, and exhaustive is key in a lot 54 00:03:13,890 --> 00:03:15,600 of what we do, looking for the anomaly 55 00:03:15,600 --> 00:03:17,940 or the needle in the haystack. 56 00:03:17,940 --> 00:03:21,720 So performing retro hacking or retro assessment 57 00:03:21,720 --> 00:03:25,470 is really about taking maybe an older device 58 00:03:25,470 --> 00:03:28,830 and taking a look at it and see, you know, 59 00:03:28,830 --> 00:03:31,500 10 years ago we had a device we didn't know much about, 60 00:03:31,500 --> 00:03:33,180 10 years later, we know way more, 61 00:03:33,180 --> 00:03:35,130 we're gonna take it further if we take a look at it, 62 00:03:35,130 --> 00:03:37,770 even if it's old, it's gonna help us gain insight 63 00:03:37,770 --> 00:03:39,960 into the new versions we could create 64 00:03:39,960 --> 00:03:42,410 and some of the challenges that we need to solve. 65 00:03:43,470 --> 00:03:46,260 And again, putting yourself in jail here 66 00:03:46,260 --> 00:03:49,710 to expand your horizons, it's just really about 67 00:03:49,710 --> 00:03:51,720 being thorough again with what's in front of you, 68 00:03:51,720 --> 00:03:55,560 not thinking you need an exploit or a zero-day or, 69 00:03:55,560 --> 00:03:59,133 it's about being tenacious and trying all possibilities. 70 00:04:00,300 --> 00:04:01,820 So again, too long, didn't read here. 71 00:04:01,820 --> 00:04:06,120 We took an old EOL Chromebook, HP Pavilion 14, 72 00:04:06,120 --> 00:04:09,210 in an out-of-box experience state. 73 00:04:09,210 --> 00:04:11,370 And it's able, with the guest user, 74 00:04:11,370 --> 00:04:16,030 we're able to gain local access through a Crosh breakout 75 00:04:16,890 --> 00:04:19,260 when Linux isn't supposed to be enabled yet. 76 00:04:19,260 --> 00:04:21,630 And we're doing that by exploiting a command injection 77 00:04:21,630 --> 00:04:24,033 in the set_ command set. 78 00:04:25,260 --> 00:04:27,330 And we're able to utilize shill-scripts 79 00:04:27,330 --> 00:04:30,300 and the chronos user accounts and root 80 00:04:30,300 --> 00:04:32,310 before developer mode has been enabled 81 00:04:32,310 --> 00:04:34,290 and before any passwords have been assigned 82 00:04:34,290 --> 00:04:35,583 to the existing users. 83 00:04:37,590 --> 00:04:41,130 One of the other exploits that was discovered 84 00:04:41,130 --> 00:04:42,687 was a command injection in DBUS, 85 00:04:42,687 --> 00:04:45,750 and that is where we got our root from. 86 00:04:45,750 --> 00:04:49,590 We were able to fuzz a parameter there and gain root access. 87 00:04:49,590 --> 00:04:52,170 And again, there's a couple tricks here, old-school tricks, 88 00:04:52,170 --> 00:04:55,620 redirection operators, internal field separator, 89 00:04:55,620 --> 00:04:57,520 and we'll get more into that as we go. 90 00:04:58,800 --> 00:05:02,190 Passionate curiosity is absolutely not a crime, 91 00:05:02,190 --> 00:05:04,980 just not, just know that. 92 00:05:04,980 --> 00:05:08,340 Right to repair, it's our hardware, we bought it, 93 00:05:08,340 --> 00:05:10,800 we should be able to do what we want. 94 00:05:10,800 --> 00:05:12,600 If we're afraid of affecting 95 00:05:12,600 --> 00:05:14,400 somebody's upstream infrastructure, 96 00:05:14,400 --> 00:05:17,880 we can just sever the network, sever communications. 97 00:05:17,880 --> 00:05:19,740 In this case, I did not, I wanted to connect 98 00:05:19,740 --> 00:05:23,133 into the Google Cloud and then we just go from there. 99 00:05:24,690 --> 00:05:26,670 So these are all non-destructive techniques, 100 00:05:26,670 --> 00:05:28,590 meaning we didn't have to open the laptop up 101 00:05:28,590 --> 00:05:30,510 or we didn't have to do anything crazy 102 00:05:30,510 --> 00:05:31,923 to modify anything here. 103 00:05:33,450 --> 00:05:35,400 And again, I was inspired really to do it, 104 00:05:35,400 --> 00:05:38,460 I like kiosk breakouts, they're fun, you know, 105 00:05:38,460 --> 00:05:40,890 it's a challenge, they're small little CTFs, 106 00:05:40,890 --> 00:05:44,133 so anytime you can break out of a jail, you win. 107 00:05:45,600 --> 00:05:48,720 The hardware we're using here today is gonna be HP Pavilion, 108 00:05:48,720 --> 00:05:53,610 Raspberry Pico, and the Pico Ducky software, 109 00:05:53,610 --> 00:05:55,973 and again, we'll talk about that in a second here. 110 00:05:59,400 --> 00:06:01,920 So one thing I'll mention here on the slide deck 111 00:06:01,920 --> 00:06:04,770 is it's done sort of in the form of a video game, 112 00:06:04,770 --> 00:06:07,203 so this is how to play the game. 113 00:06:08,190 --> 00:06:11,160 Set up the environment, we began by factory resetting 114 00:06:11,160 --> 00:06:14,400 the Chromebook, power washing it. 115 00:06:14,400 --> 00:06:19,140 Then we boot it up for the first time boot, we log in, 116 00:06:19,140 --> 00:06:21,700 and we log in as guests, that's how we play 117 00:06:23,400 --> 00:06:26,970 The helpful commands here during the out-of-box experience 118 00:06:26,970 --> 00:06:30,150 are for fun, there's actually something called shark mode, 119 00:06:30,150 --> 00:06:31,200 I didn't know that. 120 00:06:31,200 --> 00:06:33,660 One time I was booting up, I pounded on all the keys, 121 00:06:33,660 --> 00:06:36,180 it's an actual technique to find stuff. 122 00:06:36,180 --> 00:06:39,270 Pounded the keys, and I saw shark mode, shark mode? 123 00:06:39,270 --> 00:06:42,180 And I got to find out it's part of their enrollment process. 124 00:06:42,180 --> 00:06:45,060 But there's a bunch of shortcut keys we found there. 125 00:06:45,060 --> 00:06:49,380 And you can also force your out-of-box experience back 126 00:06:49,380 --> 00:06:52,380 into the original state by deleting 127 00:06:52,380 --> 00:06:54,720 a couple of files out of /home/chronos 128 00:06:54,720 --> 00:06:56,883 and removing any user on the system. 129 00:07:00,270 --> 00:07:04,170 So this is our game map, we have a Chromebook, 130 00:07:04,170 --> 00:07:07,230 we wanna choose our attack path. 131 00:07:07,230 --> 00:07:11,280 So we have the Chrome browser, we have the Crosh window, 132 00:07:11,280 --> 00:07:13,620 which has a limited shell. 133 00:07:13,620 --> 00:07:17,820 We can side load, USB, SD, whatever else, inputs. 134 00:07:17,820 --> 00:07:19,590 We have network. 135 00:07:19,590 --> 00:07:22,410 And I started off first with the Crosh window 136 00:07:22,410 --> 00:07:26,280 just because Linux, Linux terminal, we want shells. 137 00:07:26,280 --> 00:07:31,280 So I ended up going that route, and let's see here. 138 00:07:33,990 --> 00:07:36,510 Just looking at the Crosh shell by default, 139 00:07:36,510 --> 00:07:39,630 it's not Linux-enabled all the way in the backend, 140 00:07:39,630 --> 00:07:42,840 as far as you can tell, there's no shell command yet, 141 00:07:42,840 --> 00:07:47,610 but you do have Crosh --dev and --removable 142 00:07:47,610 --> 00:07:48,933 if you can run the binary. 143 00:07:51,270 --> 00:07:52,683 And let's see here. 144 00:07:53,730 --> 00:07:57,360 So fuzzing, we want to, we know we're gonna have to fuzz, 145 00:07:57,360 --> 00:07:58,890 we know we're gonna have to throw a lot of payloads 146 00:07:58,890 --> 00:08:01,770 at inputs, and we don't wanna do that as a human, 147 00:08:01,770 --> 00:08:04,680 your hands will hurt and your brain will hurt. 148 00:08:04,680 --> 00:08:09,660 So we started off here using the Rubber Ducky, 149 00:08:09,660 --> 00:08:13,590 I like doing Rubber Ducky stuff, but memory limitations, 150 00:08:13,590 --> 00:08:15,120 way too slow. 151 00:08:15,120 --> 00:08:18,840 So Aask from the info booth, thank you, Aask, 152 00:08:18,840 --> 00:08:21,270 let me know that the Pico Ducky software 153 00:08:21,270 --> 00:08:24,300 is awesome that Dave Bailey had created. 154 00:08:24,300 --> 00:08:29,300 And so I started this whole project out with Rubber Ducky, 155 00:08:30,330 --> 00:08:33,090 and I got far, but as soon as I used the Pico, 156 00:08:33,090 --> 00:08:34,473 it just was night and day. 157 00:08:35,970 --> 00:08:38,523 And here we go, round one, fight. 158 00:08:39,570 --> 00:08:42,000 So we know that we have a Crosh shell, 159 00:08:42,000 --> 00:08:44,520 we have some commands that we can utilize. 160 00:08:44,520 --> 00:08:47,910 You can go through those and extract them 161 00:08:47,910 --> 00:08:49,350 and put them in a text file, 162 00:08:49,350 --> 00:08:51,000 we're gonna take all the commands 163 00:08:51,000 --> 00:08:53,010 and put them in commands.txt. 164 00:08:53,010 --> 00:08:56,280 Then we're gonna take some fuzz payloads and strings 165 00:08:56,280 --> 00:08:58,173 and shove them in another text file. 166 00:09:00,150 --> 00:09:01,980 This is how we're gonna build our test harness 167 00:09:01,980 --> 00:09:05,430 and how we're gonna try to attack the Chromebook here 168 00:09:05,430 --> 00:09:06,780 using the Ducky. 169 00:09:06,780 --> 00:09:09,090 So I just created a small Python script, 170 00:09:09,090 --> 00:09:11,010 I called it FuzzyDucky. 171 00:09:11,010 --> 00:09:14,070 It takes the commands, one command per line, 172 00:09:14,070 --> 00:09:16,020 and the fuzz payload one per line, 173 00:09:16,020 --> 00:09:19,200 and it will mush them together for you, basically. 174 00:09:19,200 --> 00:09:23,730 Tons of payload lists out there, fuzz lists. 175 00:09:23,730 --> 00:09:25,950 I gotta give a shout out to Dan McInerney 176 00:09:25,950 --> 00:09:28,083 for his little short fuzz list. 177 00:09:29,190 --> 00:09:31,770 Very interesting and unique. 178 00:09:31,770 --> 00:09:34,890 And then, of course, we also have things like the SecLists 179 00:09:34,890 --> 00:09:36,600 and big list of naughty strings 180 00:09:36,600 --> 00:09:38,500 and anything else you can throw at it. 181 00:09:39,960 --> 00:09:43,260 This is the FuzzyDucky script on the left, it's that simple, 182 00:09:43,260 --> 00:09:45,210 takes the commands in from one file 183 00:09:45,210 --> 00:09:47,820 and the commands and then the fuzz from the other, 184 00:09:47,820 --> 00:09:49,890 puts them together, and converts it 185 00:09:49,890 --> 00:09:54,150 into the payload.dd file, which then can be transferred over 186 00:09:54,150 --> 00:09:55,860 to the Pico Ducky. 187 00:09:55,860 --> 00:09:57,480 And once again, thank you, Dave Bailey, 188 00:09:57,480 --> 00:09:59,340 for a great piece of software, you can find it 189 00:09:59,340 --> 00:10:02,403 at github.com/dbisu. 190 00:10:03,270 --> 00:10:06,993 It uses CircuitPy, it's so simple to set up, piece of cake. 191 00:10:08,880 --> 00:10:12,840 So we have our Ducky, we have our shim, 192 00:10:12,840 --> 00:10:16,650 so we're gonna open our Chromebook with the Crosh window, 193 00:10:16,650 --> 00:10:20,160 Ctrl + Alt + T, and we're going to direct the input 194 00:10:20,160 --> 00:10:21,990 into the browser window. 195 00:10:21,990 --> 00:10:24,300 From there, we plug in our Pico Ducky 196 00:10:24,300 --> 00:10:26,820 and it starts fuzzing every command. 197 00:10:26,820 --> 00:10:29,190 And it's probably hard to see some of these screenshots, 198 00:10:29,190 --> 00:10:31,500 but if you take a look at the slide deck, 199 00:10:31,500 --> 00:10:33,870 which is gonna be available, you'd be able 200 00:10:33,870 --> 00:10:37,440 to see all these commands, and I wanted to kind of like pics 201 00:10:37,440 --> 00:10:39,990 or it didn't happen on every aspect of this project, 202 00:10:39,990 --> 00:10:41,630 so it's all about sharing all the info 203 00:10:41,630 --> 00:10:43,800 so you can see what challenges I had 204 00:10:43,800 --> 00:10:45,400 and how I worked through things. 205 00:10:47,280 --> 00:10:49,173 When we run our fuzz list here, 206 00:10:50,250 --> 00:10:52,950 we don't see much the first iteration, 207 00:10:52,950 --> 00:10:57,510 but once we start getting in to some of the other payloads 208 00:10:57,510 --> 00:10:59,473 and running binaries here, 209 00:10:59,473 --> 00:11:03,243 we saw a, where the Scooby-Doo is here, 210 00:11:05,130 --> 00:11:08,520 we can see that we got an eval error and a syntax error, 211 00:11:08,520 --> 00:11:10,290 an unterminated quoted string, 212 00:11:10,290 --> 00:11:12,190 those are things to get excited about. 213 00:11:13,230 --> 00:11:15,270 We definitely saw other errors from commands 214 00:11:15,270 --> 00:11:18,570 that we tried to run, but we didn't really see anything 215 00:11:18,570 --> 00:11:22,530 that showed us we had a actual binary that would work yet. 216 00:11:22,530 --> 00:11:26,130 So we keep going and we find, even just using a parenthesis, 217 00:11:26,130 --> 00:11:28,290 left parenthesis and right, generates an error 218 00:11:28,290 --> 00:11:30,660 and it tells you cut --help, 219 00:11:30,660 --> 00:11:32,560 so now we know cut's involved somehow. 220 00:11:33,720 --> 00:11:36,390 From there, we keep on fuzzing and, you know, 221 00:11:36,390 --> 00:11:39,510 once you see a result for something, 222 00:11:39,510 --> 00:11:41,790 you just wanna focus in that one area, 223 00:11:41,790 --> 00:11:44,280 maybe add more characters, double the payloads, 224 00:11:44,280 --> 00:11:47,100 put 1000 characters after it, and keep nailing 225 00:11:47,100 --> 00:11:49,710 that one spot over and over again. 226 00:11:49,710 --> 00:11:52,890 So analyze the results, checking all the output, 227 00:11:52,890 --> 00:11:55,383 looking for anomalies and verbose errors. 228 00:11:56,730 --> 00:11:59,220 The command injection and going through that whole process 229 00:11:59,220 --> 00:12:01,350 is sometimes really tough. 230 00:12:01,350 --> 00:12:03,090 Even doing things like XSS, 231 00:12:03,090 --> 00:12:04,800 you can't always get the payload you're looking for 232 00:12:04,800 --> 00:12:06,720 unless you spend hours, you know, 233 00:12:06,720 --> 00:12:08,870 trying to figure out how to get it to work. 234 00:12:09,900 --> 00:12:12,570 IPF, we were able to use the internal, yeah, 235 00:12:12,570 --> 00:12:16,923 the IPF stuff here, where is it? 236 00:12:16,923 --> 00:12:18,250 No, okay. 237 00:12:18,250 --> 00:12:20,910 We're using existing OS functions 238 00:12:20,910 --> 00:12:24,300 to create like our variables and solve our challenges here. 239 00:12:24,300 --> 00:12:28,500 And then we use some redirection tricks for our output 240 00:12:28,500 --> 00:12:30,270 because initially, we have blind output, 241 00:12:30,270 --> 00:12:33,150 we can't see anything in the front part of the shell here. 242 00:12:33,150 --> 00:12:36,780 So we ended up trying to redirect output 243 00:12:36,780 --> 00:12:39,480 after getting blind results for a while, 244 00:12:39,480 --> 00:12:44,480 and we figured out here that using 1 and over 245 00:12:46,320 --> 00:12:51,180 to the &2 here, we're gonna run the error output 246 00:12:51,180 --> 00:12:53,523 or the regular output through error. 247 00:12:54,810 --> 00:12:57,510 And that's gonna pop it to the screen here, 248 00:12:57,510 --> 00:13:02,370 so this example here shows set_apn, 249 00:13:02,370 --> 00:13:05,010 and we have our parenthesis or sorry, ticks here, 250 00:13:05,010 --> 00:13:09,692 curl$IFS, no, so that's our space character, 251 00:13:09,692 --> 00:13:14,692 - -help$IFS1 over to &2, that actually takes output 252 00:13:17,790 --> 00:13:20,340 and puts it through the Crosh shell to where you can see it 253 00:13:20,340 --> 00:13:23,010 where normally, it'd be on the backend. 254 00:13:23,010 --> 00:13:25,563 So now we have output, we're no longer blind. 255 00:13:27,600 --> 00:13:31,260 From there, I have like top, well, I say top 20, 256 00:13:31,260 --> 00:13:35,130 we said, oh, top 10, but the first initial top 20 257 00:13:35,130 --> 00:13:38,220 info gathering commands I would try to run at this point. 258 00:13:38,220 --> 00:13:40,200 You know, this would be ID and things 259 00:13:40,200 --> 00:13:44,130 to identify the file system, I'm looking for uname 260 00:13:44,130 --> 00:13:45,423 and things like that. 261 00:13:45,423 --> 00:13:49,830 Catting /etc/passwd, tailing /var/log messages. 262 00:13:49,830 --> 00:13:51,420 And we were actually able to do all that, 263 00:13:51,420 --> 00:13:53,283 we're able to pull, using, again, 264 00:13:53,283 --> 00:13:56,560 set_apn with the ls$IFS -al$IFS. 265 00:13:59,640 --> 00:14:01,290 And we have everything on the screen now 266 00:14:01,290 --> 00:14:06,290 from the password file and from the directory listing. 267 00:14:06,510 --> 00:14:08,073 And let's see here. 268 00:14:09,717 --> 00:14:13,800 Exfiltration tools, so while we're looking for binaries 269 00:14:13,800 --> 00:14:16,290 we can run on the system, it's always good to try 270 00:14:16,290 --> 00:14:19,080 to figure out what you can use to input data 271 00:14:19,080 --> 00:14:23,880 and output data, so we wanna upload, we wanna exfiltrate. 272 00:14:23,880 --> 00:14:28,647 We were able to see that we had tar, curl, SFTP, SCP, SSH, 273 00:14:29,760 --> 00:14:34,170 OpenSSL, OpenVPN, ping, smbclient, and base64 all available 274 00:14:34,170 --> 00:14:36,843 to us from behind the curtain there. 275 00:14:38,820 --> 00:14:40,860 So we're gonna continue with command injection, you know, 276 00:14:40,860 --> 00:14:42,510 we really wanna get a shell at some point 277 00:14:42,510 --> 00:14:44,970 or get some more substantial foothold. 278 00:14:44,970 --> 00:14:47,880 So we start fuzzing, again, 279 00:14:47,880 --> 00:14:49,950 all these binaries on the system, 280 00:14:49,950 --> 00:14:54,480 and we notice that set_apn, all of them are vulnerable 281 00:14:54,480 --> 00:14:56,250 to this command injection. 282 00:14:56,250 --> 00:14:58,110 But what we end up finding out 283 00:14:58,110 --> 00:15:03,110 is that some command injections require a parenthesis 284 00:15:04,560 --> 00:15:09,090 or brackets around the IFS as opposed to just $IFS. 285 00:15:09,090 --> 00:15:11,280 And when it does that, it splits out your parameters 286 00:15:11,280 --> 00:15:13,740 and runs them slightly differently. 287 00:15:13,740 --> 00:15:18,480 So on the right, you'll see IFS versus dollar sign, 288 00:15:18,480 --> 00:15:20,130 brackets IFS. 289 00:15:20,130 --> 00:15:22,320 And when we run those four commands, 290 00:15:22,320 --> 00:15:27,320 set_apn or the or the arpgw or the cellular_ppp 291 00:15:27,900 --> 00:15:30,480 or the wake_on_lan there, we will see that three 292 00:15:30,480 --> 00:15:33,780 of those commands run as the shill-scripts user, 293 00:15:33,780 --> 00:15:35,490 one of them runs as chronos, 294 00:15:35,490 --> 00:15:37,350 so we have an anomalous binary there 295 00:15:37,350 --> 00:15:38,850 that's running as a different user. 296 00:15:38,850 --> 00:15:40,560 So right now, we have access potentially 297 00:15:40,560 --> 00:15:42,603 to two users on the backend system. 298 00:15:43,680 --> 00:15:46,170 We need to hack more, so we are going to do that 299 00:15:46,170 --> 00:15:47,220 with the Power Glove. 300 00:15:48,330 --> 00:15:51,000 All right, so obtaining a reverse shell, 301 00:15:51,000 --> 00:15:54,660 now that we know we can't really access anything locally 302 00:15:54,660 --> 00:15:57,720 per se through the window, we are going to try 303 00:15:57,720 --> 00:16:00,630 to get an out of band shell or access here. 304 00:16:00,630 --> 00:16:04,230 So I took a laptop, attacker box here, 305 00:16:04,230 --> 00:16:07,320 and I set up a shell, a script on it, 306 00:16:07,320 --> 00:16:10,020 to make a named pipes and tmp directory 307 00:16:10,020 --> 00:16:14,850 to use OpenSSL to connect back into the Chromebook here. 308 00:16:14,850 --> 00:16:18,090 So on the Chromebook side, we can take, 309 00:16:18,090 --> 00:16:19,560 and actually, let me finish that up. 310 00:16:19,560 --> 00:16:22,560 We also have a Python simple web server running 311 00:16:22,560 --> 00:16:25,830 on the attacker box with the OpenSSL server 312 00:16:25,830 --> 00:16:27,450 with our generated key. 313 00:16:27,450 --> 00:16:28,890 So now back on the Chrome box, 314 00:16:28,890 --> 00:16:33,183 we can do our set_apn command injection using curl -L, 315 00:16:34,350 --> 00:16:36,990 and we can run that script file on the Chromebook 316 00:16:36,990 --> 00:16:39,090 and we actually get a reverse shell now, 317 00:16:39,090 --> 00:16:43,050 and we are shill-scripts, and I used the duck man over there 318 00:16:43,050 --> 00:16:45,303 for that user profile. 319 00:16:46,890 --> 00:16:48,765 So let's take a look at the other command, 320 00:16:48,765 --> 00:16:53,765 set_cellular_ppp allowed us access to the chronos user. 321 00:16:55,560 --> 00:16:56,790 So let's see what happens when we try 322 00:16:56,790 --> 00:16:58,590 to get a reverse shell there. 323 00:16:58,590 --> 00:17:02,820 We do the same method and we find out we indeed end up 324 00:17:02,820 --> 00:17:05,613 as the chronos user instead of shill-scripts. 325 00:17:08,370 --> 00:17:11,400 So we have access to two users now. 326 00:17:11,400 --> 00:17:13,170 We want to kind of compare them, 327 00:17:13,170 --> 00:17:16,440 see how they're different, see if there's any anomalies, 328 00:17:16,440 --> 00:17:19,770 mount spaces, name spaces, capabilities. 329 00:17:19,770 --> 00:17:24,770 So now it's about trying to identify unique privileges 330 00:17:25,080 --> 00:17:26,943 or capabilities in these users. 331 00:17:29,160 --> 00:17:30,990 This, you're probably not gonna be able to see all that, 332 00:17:30,990 --> 00:17:34,520 I'm not sure, but again, it's more comparison around all 333 00:17:34,520 --> 00:17:37,500 of the capabilities, cgroups, name spaces, 334 00:17:37,500 --> 00:17:39,600 and things like that for comparison. 335 00:17:39,600 --> 00:17:42,330 And what we do see is that there are different mount points 336 00:17:42,330 --> 00:17:46,710 for these users, we know that the Chrome users are jailed. 337 00:17:46,710 --> 00:17:49,203 And in this version of Chrome, it's 65, 338 00:17:50,250 --> 00:17:52,773 they were using minijail for most everything. 339 00:17:54,390 --> 00:17:59,390 And so we know that some users are wrapped in a user script 340 00:17:59,790 --> 00:18:03,483 with a minijail and restricted privileges or elevated. 341 00:18:05,970 --> 00:18:09,540 So we run some more commands here for info gathering 342 00:18:09,540 --> 00:18:11,310 and looking at the kernel. 343 00:18:11,310 --> 00:18:15,600 We find there's a /var/log/debug_vboot_noisy.log 344 00:18:15,600 --> 00:18:17,460 hat has some information about the system, 345 00:18:17,460 --> 00:18:18,873 firmware, et cetera. 346 00:18:21,210 --> 00:18:24,423 Our proc version tells us that we're running that. 347 00:18:28,020 --> 00:18:29,700 You can see that it's an older Chromebook there 348 00:18:29,700 --> 00:18:30,960 based on the date. 349 00:18:30,960 --> 00:18:34,050 Linux version is 3.8.11. 350 00:18:34,050 --> 00:18:37,230 And then you're getting all the CPU, cat issue, 351 00:18:37,230 --> 00:18:40,980 all the OS-related information, sysctl -a. 352 00:18:40,980 --> 00:18:44,760 And we can see where we're being blocked, we can't do, 353 00:18:44,760 --> 00:18:47,580 we have protected hard links and protected simlinks, 354 00:18:47,580 --> 00:18:50,583 so they secured it pretty good that way. 355 00:18:52,110 --> 00:18:55,590 And so this is where I took the approach of trying 356 00:18:55,590 --> 00:18:58,860 to run every command on the system as each of those users, 357 00:18:58,860 --> 00:19:02,580 literally being thorough and seeing if there was anything 358 00:19:02,580 --> 00:19:06,240 that would be anomalous, elevate privileges 359 00:19:06,240 --> 00:19:08,670 or, you know, just do something weird. 360 00:19:08,670 --> 00:19:11,943 So we found out, if we tried to run chromeos-setdevpassword, 361 00:19:12,870 --> 00:19:15,513 we can't do that 'cause we have no developer mode. 362 00:19:16,440 --> 00:19:19,590 We found a generate_logs binary on there 363 00:19:19,590 --> 00:19:21,120 that will dump all the logs for you 364 00:19:21,120 --> 00:19:22,800 and save them to a tarball, and of course, 365 00:19:22,800 --> 00:19:25,890 now we can exfiltrate that with our FTP and curl 366 00:19:25,890 --> 00:19:27,993 and everything else we have running. 367 00:19:30,150 --> 00:19:34,190 We can try to run some of the processes as chronos, 368 00:19:36,060 --> 00:19:38,160 but they won't run 'cause you don't have root privileges, 369 00:19:38,160 --> 00:19:43,143 so like chrome-sandbox and some other dist commands, ppp, 370 00:19:44,640 --> 00:19:47,340 they won't give you, they'll let you know you're not root, 371 00:19:47,340 --> 00:19:48,590 so you can validate that. 372 00:19:51,000 --> 00:19:53,670 I have a screenshot over here just showing also that, 373 00:19:53,670 --> 00:19:57,333 when we tried to look at the cat mem on a certain process, 374 00:19:58,200 --> 00:20:00,660 ptrace is not enabled for us to do that, 375 00:20:00,660 --> 00:20:03,030 and it creates a log of that, so again, more information, 376 00:20:03,030 --> 00:20:05,330 keep your eye on the logs as you're tinkering. 377 00:20:07,620 --> 00:20:10,332 So one of the things we figured out, I mentioned earlier, 378 00:20:10,332 --> 00:20:14,190 crosh --dev would upgrade your Crosh shell. 379 00:20:14,190 --> 00:20:17,280 So if you actually do the command injection here 380 00:20:17,280 --> 00:20:21,510 and do your crosh --dev, you'll actually get 381 00:20:21,510 --> 00:20:23,430 the elevated Crosh shell. 382 00:20:23,430 --> 00:20:24,870 And that gives you new commands, 383 00:20:24,870 --> 00:20:27,630 you can live in a coal mine, it puts you in the, 384 00:20:27,630 --> 00:20:31,353 you know, the nonstandard software there. 385 00:20:32,245 --> 00:20:35,670 Packet_capture and systrace were the other two. 386 00:20:35,670 --> 00:20:40,590 So we upgrade and we start trying 387 00:20:40,590 --> 00:20:43,350 to run these other commands, and we find that running 388 00:20:43,350 --> 00:20:47,850 the packet_capture fires off a process 389 00:20:47,850 --> 00:20:52,140 using /usr/libexec/debugd, and it's a capture utility, 390 00:20:52,140 --> 00:20:53,970 and it puts it in a minijail. 391 00:20:53,970 --> 00:20:55,980 And if we look at the bottom here, you can see, 392 00:20:55,980 --> 00:21:00,900 we have a root process running minijail 393 00:21:00,900 --> 00:21:03,930 with some other parameters here, the capture utility, 394 00:21:03,930 --> 00:21:06,873 the file descriptor, and the device. 395 00:21:09,300 --> 00:21:12,300 Before I moved on, I actually provisioned my attacker box 396 00:21:12,300 --> 00:21:15,030 to the fullest I could to communicate with the Chromebook 397 00:21:15,030 --> 00:21:17,280 to give me all options available. 398 00:21:17,280 --> 00:21:21,420 We actually had SMB on there, so you can do SMB transfers. 399 00:21:21,420 --> 00:21:23,520 You can do peer-to-peer. 400 00:21:23,520 --> 00:21:26,580 Obviously, the OpenSSL was on there as well. 401 00:21:26,580 --> 00:21:28,457 You can run a local OpenSSL server 402 00:21:28,457 --> 00:21:32,790 on the Chromebook as well and you can log in locally 403 00:21:32,790 --> 00:21:34,680 if you needed to, which we'll look at here 404 00:21:34,680 --> 00:21:35,680 in a second as well. 405 00:21:37,230 --> 00:21:40,680 But all these commands are just the normal Linux commands 406 00:21:40,680 --> 00:21:43,740 that you would run versus the Chromebook command injection 407 00:21:43,740 --> 00:21:45,753 formatted commands, just for comparison. 408 00:21:48,450 --> 00:21:52,680 So after tinkering for some time, I realized, 409 00:21:52,680 --> 00:21:55,560 why didn't I just try to run bash from the shell, 410 00:21:55,560 --> 00:21:57,410 like since I had a command injection? 411 00:21:58,320 --> 00:22:01,770 Well, it worked, but there was no output, but again, 412 00:22:01,770 --> 00:22:05,190 we know we have our redirector, and if you do exec, 413 00:22:05,190 --> 00:22:08,370 you know, one redirect to &2, 414 00:22:08,370 --> 00:22:10,620 we now see the output in our terminal, 415 00:22:10,620 --> 00:22:14,040 so now we actually have a full local Linux shell. 416 00:22:14,040 --> 00:22:15,270 It's local. 417 00:22:15,270 --> 00:22:18,780 It didn't need to have an external system to do the shell. 418 00:22:18,780 --> 00:22:22,350 So we've basically done a breakout right there. 419 00:22:22,350 --> 00:22:26,070 And we can validate there with chronos still, 420 00:22:26,070 --> 00:22:27,450 we can do all the same kind of commands 421 00:22:27,450 --> 00:22:29,040 we were running before, but of course, 422 00:22:29,040 --> 00:22:30,750 we don't have to do any command injections, 423 00:22:30,750 --> 00:22:32,220 we're just free to roam. 424 00:22:32,220 --> 00:22:36,990 So one of the things I tried to do here was make a one-liner 425 00:22:36,990 --> 00:22:39,780 to basically write to the .bashrc 426 00:22:39,780 --> 00:22:44,040 so that it would permanently put in the exec command there 427 00:22:44,040 --> 00:22:46,260 for the redirector, that just makes it persistent 428 00:22:46,260 --> 00:22:47,343 for that session. 429 00:22:51,672 --> 00:22:55,800 Nsenter is another one, breakouts with nsenter, 430 00:22:55,800 --> 00:22:58,257 I did SQLite, you can actually get out of there with SQLite 431 00:22:58,257 --> 00:23:00,873 and run in a .shell bash command from there. 432 00:23:03,000 --> 00:23:05,200 There's a few other ways that you can do it. 433 00:23:06,150 --> 00:23:06,983 Let's see here. 434 00:23:08,520 --> 00:23:10,770 Dash is on there as well. 435 00:23:10,770 --> 00:23:13,230 And we have SQLite on there, which is nice, 436 00:23:13,230 --> 00:23:15,870 'cause they use a lot of SQLite database valves 437 00:23:15,870 --> 00:23:18,023 on the Chromebook, so that's why it's there. 438 00:23:19,050 --> 00:23:21,060 Over with our other user then, shill-scripts, 439 00:23:21,060 --> 00:23:24,899 we go back and we run our, if you remember here, 440 00:23:24,899 --> 00:23:28,740 set_apn allows the shill-scripts user, 441 00:23:28,740 --> 00:23:33,740 whereas set_cellular_ppp is our chronos user. 442 00:23:34,320 --> 00:23:37,710 So we want our shill-scripts user, 443 00:23:37,710 --> 00:23:41,760 and the way we do that is by provisioning OpenSSL locally 444 00:23:41,760 --> 00:23:45,453 and then running our command injection with, 445 00:23:46,710 --> 00:23:48,480 and actually, we have to run it with chronos 446 00:23:48,480 --> 00:23:51,060 to actually have it bind to the system 447 00:23:51,060 --> 00:23:53,580 or it doesn't have the right permissions with shill-scripts, 448 00:23:53,580 --> 00:23:57,450 so it's kind of hybridy, but we end up getting a shell here. 449 00:23:57,450 --> 00:24:02,190 And this shell that we get is kind of special, 450 00:24:02,190 --> 00:24:05,100 chronos user shuts off when you log out, 451 00:24:05,100 --> 00:24:07,440 it shuts all the processes off for chronos, 452 00:24:07,440 --> 00:24:09,990 or if you close the laptop lid. 453 00:24:09,990 --> 00:24:12,480 If you're using the shill-scripts reverse shell, 454 00:24:12,480 --> 00:24:14,970 it doesn't shut down, it stays up and running 455 00:24:14,970 --> 00:24:16,170 'cause it doesn't get killed 456 00:24:16,170 --> 00:24:18,273 by the chronos user's processes. 457 00:24:20,310 --> 00:24:22,470 So we have local access, and again, 458 00:24:22,470 --> 00:24:23,760 this is just how to set it up, 459 00:24:23,760 --> 00:24:26,610 you have to set up your key, your cert.pem. 460 00:24:26,610 --> 00:24:28,107 And we throw that in /var/tmp, 461 00:24:28,107 --> 00:24:30,690 and it turns out /var/tmp's got some persistence there 462 00:24:30,690 --> 00:24:31,863 across reboots. 463 00:24:33,810 --> 00:24:38,130 In Chrome tab one, we would do our set_cellular command 464 00:24:38,130 --> 00:24:41,970 as our chronos user for our OpenSSL. 465 00:24:41,970 --> 00:24:45,960 And in our second tab, we start the OpenSSL client running 466 00:24:45,960 --> 00:24:49,710 as a shill-scripts user with our set_apn. 467 00:24:49,710 --> 00:24:53,370 And again, we had some issues with the payload, 468 00:24:53,370 --> 00:24:55,770 so we had to use base64 to pass it through, 469 00:24:55,770 --> 00:24:58,560 which works just fine since we have it on the Chromebook. 470 00:24:58,560 --> 00:25:00,870 And I haven't really mentioned it yet, 471 00:25:00,870 --> 00:25:02,880 but in order to get our interactive TTY, 472 00:25:02,880 --> 00:25:06,480 we use /usr/bin/script -qc and using bash there, 473 00:25:06,480 --> 00:25:09,663 you could use dash or sh or whatever else you wanted. 474 00:25:11,670 --> 00:25:13,410 So now we have two users locally, 475 00:25:13,410 --> 00:25:15,363 we no longer need our attacker box. 476 00:25:16,980 --> 00:25:19,320 Here's the other cool thing, we found out 477 00:25:19,320 --> 00:25:24,320 that we have hard coded keys on the Chromebook, 478 00:25:24,450 --> 00:25:28,110 they're test keys that ChromeOS has. 479 00:25:28,110 --> 00:25:33,110 And they're stored in /usr/share/chromeos-ssh-config/keys. 480 00:25:34,380 --> 00:25:38,040 And so what we can do is we can actually, 481 00:25:38,040 --> 00:25:40,410 if we couldn't access the private key, 482 00:25:40,410 --> 00:25:41,850 it turns out we can just curl it 483 00:25:41,850 --> 00:25:44,610 from chromium.googlesource.com 484 00:25:44,610 --> 00:25:49,170 where they have the ssh_keys.tar.gz file. 485 00:25:49,170 --> 00:25:51,150 We save it to the Chromebook. 486 00:25:51,150 --> 00:25:53,130 We provision them into the tmp directory, 487 00:25:53,130 --> 00:25:54,860 we could use /var/tmp as well. 488 00:25:54,860 --> 00:25:58,680 We chmod it, we run our SSH on a non-standard port, 489 00:25:58,680 --> 00:26:00,240 and it's running. 490 00:26:00,240 --> 00:26:03,870 And then we can log in locally then 491 00:26:03,870 --> 00:26:07,080 with the shill-scripts user by SSHing, 492 00:26:07,080 --> 00:26:10,500 or we're already shill-scripts, 493 00:26:10,500 --> 00:26:15,500 but we use SSH to log in locally using those private keys 494 00:26:15,600 --> 00:26:18,000 that are hard coded then, matching with our keys 495 00:26:18,000 --> 00:26:20,580 we put in tmp, and we're able to log in 496 00:26:20,580 --> 00:26:24,240 as chronos via the shill-scripts user. 497 00:26:24,240 --> 00:26:26,910 So a little priv escalation 498 00:26:26,910 --> 00:26:28,833 through living off the land again. 499 00:26:34,890 --> 00:26:38,400 So really, we're trying to get root, I guess, I mean, 500 00:26:38,400 --> 00:26:41,910 you know, we're still really investigating the system, 501 00:26:41,910 --> 00:26:43,740 but we really do wanna find root. 502 00:26:43,740 --> 00:26:46,380 So again, we're gonna look at the users again, 503 00:26:46,380 --> 00:26:48,543 just validate what we have here. 504 00:26:49,560 --> 00:26:52,530 Chronos cannot run the sudo binary, 505 00:26:52,530 --> 00:26:54,663 whereas shill-scripts can. 506 00:26:55,500 --> 00:26:57,600 You can write to /var/tmp and you can write 507 00:26:57,600 --> 00:27:01,080 to /home/chronos for persistence. 508 00:27:01,080 --> 00:27:02,622 Shrill-scripts can do /var/tmp 509 00:27:02,622 --> 00:27:04,143 but not the chronos directory. 510 00:27:05,010 --> 00:27:09,780 The chronos user can modify all SQLite3 database files 511 00:27:09,780 --> 00:27:11,670 on this system 'cause the logged in user 512 00:27:11,670 --> 00:27:13,620 for the Chromebook is chronos, 513 00:27:13,620 --> 00:27:16,203 so we're able to manipulate those files. 514 00:27:18,090 --> 00:27:21,870 The shill-scripts user has access to /debugd 515 00:27:21,870 --> 00:27:25,830 and privileged processes though so, you know, 516 00:27:25,830 --> 00:27:29,130 both accounts look good to continue investigating. 517 00:27:29,130 --> 00:27:33,180 So again, looking at some more normal priv esc type 518 00:27:33,180 --> 00:27:35,883 of stuff, looking for low-hanging fruit. 519 00:27:36,750 --> 00:27:38,340 And we didn't really find any of that, 520 00:27:38,340 --> 00:27:40,410 we do see files that may run as root 521 00:27:40,410 --> 00:27:43,890 or with root privileges, but the way they've done jailing, 522 00:27:43,890 --> 00:27:45,453 it was pretty secure. 523 00:27:47,040 --> 00:27:49,590 Sockets, we saw some of the sockets laying around, 524 00:27:49,590 --> 00:27:52,110 so we did try to connect to the sockets here. 525 00:27:52,110 --> 00:27:54,900 We had CUPS available, Avahi-daemon, 526 00:27:54,900 --> 00:27:56,970 and a couple other things. 527 00:27:56,970 --> 00:27:59,043 Didn't really make any progress there. 528 00:28:00,120 --> 00:28:02,580 So now I go for the unorthodox methods, 529 00:28:02,580 --> 00:28:06,480 crashing, glitching, and creating anomalies. 530 00:28:06,480 --> 00:28:07,890 And it's something that we did back 531 00:28:07,890 --> 00:28:10,860 in the old video game days where, for instance, 532 00:28:10,860 --> 00:28:14,490 in the Sega Master System, if your cartridge tilted, 533 00:28:14,490 --> 00:28:16,983 there was sometimes a second game on the chip. 534 00:28:17,910 --> 00:28:21,660 Sega Genesis, I think the first like 10 or so games 535 00:28:21,660 --> 00:28:24,240 that came out had both the Japanese chips 536 00:28:24,240 --> 00:28:27,060 and the American games on there. 537 00:28:27,060 --> 00:28:29,790 And they didn't have time to remove the other chips, 538 00:28:29,790 --> 00:28:32,070 so they left them both then, so if you cartridge tilt, 539 00:28:32,070 --> 00:28:34,970 you can actually get a second game out of these old games. 540 00:28:35,880 --> 00:28:40,880 I'll do one more, NES, Nintendo, the first Nintendo, 541 00:28:41,250 --> 00:28:44,580 there was a game called Zanac, it was a space shooter. 542 00:28:44,580 --> 00:28:48,330 And if you took a zapper gun and plugged it into port two 543 00:28:48,330 --> 00:28:52,260 and went on the first controller and then lifted the game up 544 00:28:52,260 --> 00:28:54,780 on the Nintendo a little bit till it kind of flickered 545 00:28:54,780 --> 00:28:57,210 and you pushed it back down, when you saw the high score 546 00:28:57,210 --> 00:29:00,377 change to a fucked up symbol, you knew you had it. 547 00:29:00,377 --> 00:29:03,900 And it let you access level selectors 548 00:29:03,900 --> 00:29:06,210 and all kinds of weird stuff, you'd hit the select key 549 00:29:06,210 --> 00:29:09,030 and you'd warp three levels or hit the A button, 550 00:29:09,030 --> 00:29:10,350 just anomalous behavior. 551 00:29:10,350 --> 00:29:12,990 So we're gonna kind of go for some of that here 552 00:29:12,990 --> 00:29:16,770 by doing nested jails and trying to overlap name spaces 553 00:29:16,770 --> 00:29:17,940 and things of that nature. 554 00:29:17,940 --> 00:29:22,903 So looking at all of your logs, you got /var/log/chrome, 555 00:29:22,903 --> 00:29:27,903 /home/chronos/chrome_debug.log, /var/log/ui/ui.LATEST, 556 00:29:28,290 --> 00:29:31,170 and of course, /var/log/messages and secure. 557 00:29:31,170 --> 00:29:33,270 And dmesg, those are really, you know, 558 00:29:33,270 --> 00:29:37,620 all we had to look at our output and our results here. 559 00:29:37,620 --> 00:29:42,620 So we tried to do minijail by using weird orders 560 00:29:43,590 --> 00:29:47,970 of their parameters, and we found that you can access 561 00:29:47,970 --> 00:29:50,910 a root user, and that's normal, you can take minijail 562 00:29:50,910 --> 00:29:53,130 and create a root user into a container 563 00:29:53,130 --> 00:29:55,410 and restrict all the privs. 564 00:29:55,410 --> 00:29:56,910 But they were anomalous types 565 00:29:56,910 --> 00:30:00,810 of user environments and permission sets, 566 00:30:00,810 --> 00:30:04,663 so when we did this minijail -U -m'' -M'' 567 00:30:08,520 --> 00:30:12,660 with a nobody user, it sets it to root and nobody, nobody, 568 00:30:12,660 --> 00:30:14,760 and we can see that's still /home/chronos. 569 00:30:20,940 --> 00:30:23,910 We caused some weird named pipes to happen 570 00:30:23,910 --> 00:30:26,883 and overlap and delete each other occasionally. 571 00:30:27,780 --> 00:30:31,590 We did some SUID weirdness here, there's some logs in here 572 00:30:31,590 --> 00:30:34,203 that you can look at later just to see the result. 573 00:30:36,240 --> 00:30:41,240 But we were able to figure out that running certain commands 574 00:30:42,210 --> 00:30:47,210 would cause a kind of a shadow PTS or a TTY, 575 00:30:47,940 --> 00:30:52,080 and they would overlap in the actual screen for the user. 576 00:30:52,080 --> 00:30:54,720 So it might be kind of hard to see on the far left here, 577 00:30:54,720 --> 00:30:57,840 but I tried to exit out of this and it logged me out, 578 00:30:57,840 --> 00:30:59,610 but then I'm trying to type stuff, 579 00:30:59,610 --> 00:31:01,710 and then you can see at the bottom, it starts getting weird, 580 00:31:01,710 --> 00:31:05,430 something died here, Crosh prompt shows up, 581 00:31:05,430 --> 00:31:07,833 but then we got three dots and an arrow. 582 00:31:09,516 --> 00:31:12,720 Over here, same kind of thing, we try to exit Crosh, 583 00:31:12,720 --> 00:31:15,870 we exit it, or it won't let us exit 584 00:31:15,870 --> 00:31:19,050 'cause it says it's only xi, so our characters 585 00:31:19,050 --> 00:31:21,300 are being split in some way and we have no idea, 586 00:31:21,300 --> 00:31:22,833 no visibility into that. 587 00:31:24,240 --> 00:31:28,560 So again, tinkering more will provide more information 588 00:31:28,560 --> 00:31:32,130 in our logs, trying to do sudos in certain environments 589 00:31:32,130 --> 00:31:36,900 would actually half work sort of and leave interesting logs. 590 00:31:36,900 --> 00:31:40,800 And we were able to, again, overlap file descriptors 591 00:31:40,800 --> 00:31:43,980 and name space in really weird ways 592 00:31:43,980 --> 00:31:48,090 that didn't gain us any extra permissions. 593 00:31:48,090 --> 00:31:52,140 But we did gain a lot of information in how weird 594 00:31:52,140 --> 00:31:55,890 and anomalous these overlapping processes 595 00:31:55,890 --> 00:31:57,603 could cause the TTYs to be. 596 00:31:59,280 --> 00:32:01,890 So we're gonna pull back a minute and look at all the users. 597 00:32:01,890 --> 00:32:06,890 And we're gonna look at /etc/passwd and /etc/group 598 00:32:08,070 --> 00:32:10,950 for all of our possible users and groups here. 599 00:32:10,950 --> 00:32:14,490 And we can use minijail to specify our user group. 600 00:32:14,490 --> 00:32:16,020 And then we can specify a shell 601 00:32:16,020 --> 00:32:18,360 or a command to run after it. 602 00:32:18,360 --> 00:32:21,840 And so we spent time just kind of enumerating, 603 00:32:21,840 --> 00:32:25,053 and we could be the bin user and daemon and adm, 604 00:32:25,890 --> 00:32:30,120 and turns out, if you have a user ID that doesn't exist, 605 00:32:30,120 --> 00:32:33,273 your name is I have no name @localhost. 606 00:32:35,700 --> 00:32:37,920 Again, over here, some of the output from some 607 00:32:37,920 --> 00:32:42,360 of the minijail environment and set here, 608 00:32:42,360 --> 00:32:45,090 and you can see nobody, nobody, nobody. 609 00:32:45,090 --> 00:32:49,350 Sometimes, you see, you know, we got CUPS here, nobody. 610 00:32:49,350 --> 00:32:51,840 So again, we can kind of provision some of the users, 611 00:32:51,840 --> 00:32:53,190 but we don't know if they'll work the right way 612 00:32:53,190 --> 00:32:54,960 if we don't have the right mount spaces 613 00:32:54,960 --> 00:32:56,760 and capabilities for them. 614 00:32:56,760 --> 00:32:58,710 But it's interesting to just go through all that 615 00:32:58,710 --> 00:33:02,430 and see if you can find some weird place to priv esc there, 616 00:33:02,430 --> 00:33:04,530 and there's definitely room to play there. 617 00:33:06,150 --> 00:33:09,270 Let's visit all of our cellmates, shall we? 618 00:33:09,270 --> 00:33:12,600 So on the Chromebook, there's a command called pinky 619 00:33:12,600 --> 00:33:15,540 that will tell you the real world 620 00:33:15,540 --> 00:33:20,070 or the real life user information in a quick format there. 621 00:33:20,070 --> 00:33:21,690 So that's easy enough to kind of go through, 622 00:33:21,690 --> 00:33:22,980 you can see what shells are set 623 00:33:22,980 --> 00:33:25,383 for each user and description. 624 00:33:34,260 --> 00:33:37,470 So here, we did, again, our minijail, 625 00:33:37,470 --> 00:33:41,040 messing around with the root, trying to create a root user. 626 00:33:41,040 --> 00:33:45,483 And we use this -m'0 1000 and 1, 627 00:33:45,483 --> 00:33:47,880 1000 representing the chronos user. 628 00:33:47,880 --> 00:33:49,050 And we're trying to see 629 00:33:49,050 --> 00:33:54,050 if we can somehow access user one here, user ID one, 630 00:33:54,750 --> 00:33:58,410 and user ID zero, they'll actually do a swap 631 00:33:58,410 --> 00:34:00,720 when you run minijail so that, when you leave the container, 632 00:34:00,720 --> 00:34:03,000 you get your original rights back out. 633 00:34:03,000 --> 00:34:04,320 And we found through tampering, 634 00:34:04,320 --> 00:34:07,290 you could actually cause some really anomalous stuff 635 00:34:07,290 --> 00:34:09,720 where you had slight root access 636 00:34:09,720 --> 00:34:13,530 or you could run root commands that would start to run 637 00:34:13,530 --> 00:34:16,170 and maybe fail because you weren't in the right environment, 638 00:34:16,170 --> 00:34:18,000 but it still disclosed information, 639 00:34:18,000 --> 00:34:20,010 it keeps on providing you with what you need 640 00:34:20,010 --> 00:34:21,003 to move forward. 641 00:34:25,140 --> 00:34:28,620 So we're gonna try to get that root user out 642 00:34:28,620 --> 00:34:30,450 using a reverse shell here. 643 00:34:30,450 --> 00:34:31,950 Since we couldn't get it locally, 644 00:34:31,950 --> 00:34:35,220 maybe there's something with the set_ commands 645 00:34:35,220 --> 00:34:38,250 that gets provisioned and does a priv esc or something. 646 00:34:38,250 --> 00:34:41,730 So we try to do, excuse me, a reverse shell 647 00:34:41,730 --> 00:34:45,090 and do our OpenSSL connection here. 648 00:34:45,090 --> 00:34:47,910 We see that we are root, ID zero, 649 00:34:47,910 --> 00:34:52,050 but we are GID nobody and group nobody here, 650 00:34:52,050 --> 00:34:54,870 so that is not root all the way. 651 00:34:54,870 --> 00:34:56,550 We can check in the environment again here 652 00:34:56,550 --> 00:34:58,620 to see who we really are, and we find out 653 00:34:58,620 --> 00:35:01,083 that we're Howard the Duck, the chronos user. 654 00:35:02,280 --> 00:35:06,153 And we know that our ID equals user, 655 00:35:06,990 --> 00:35:11,550 our user that we have here is not really our real root user. 656 00:35:11,550 --> 00:35:14,730 It's just mapped to the outside of the minijail to Chronos 657 00:35:14,730 --> 00:35:18,270 which, again, is expected, that's how it's supposed to work. 658 00:35:18,270 --> 00:35:21,060 But maybe there is some kind of way to get, again, 659 00:35:21,060 --> 00:35:25,050 this user out, so we went back in with set_cellular_ppp, 660 00:35:25,050 --> 00:35:29,160 tried our reverse shell again through this 661 00:35:29,160 --> 00:35:31,260 or the minijail bash command. 662 00:35:31,260 --> 00:35:35,520 And if we do an su, it actually would give us limited root, 663 00:35:35,520 --> 00:35:40,083 we were able to run su - with that minijail configuration. 664 00:35:40,980 --> 00:35:44,190 From there, we try to run other root commands 665 00:35:44,190 --> 00:35:46,200 and find out, maybe we're limited still, 666 00:35:46,200 --> 00:35:48,065 we don't have the right mount space, 667 00:35:48,065 --> 00:35:50,700 we don't have the right capabilities yet. 668 00:35:50,700 --> 00:35:53,400 So we keep on tinkering here, we're trying to break it, 669 00:35:53,400 --> 00:35:55,470 we're trying su, we're trying sudo, 670 00:35:55,470 --> 00:35:58,110 and we're getting all kinds of different information back. 671 00:35:58,110 --> 00:36:02,040 From our phony root user here, if we run chrome-sandbox, 672 00:36:02,040 --> 00:36:04,830 before, we couldn't run that, now it tells us 673 00:36:04,830 --> 00:36:08,070 that the setuid sandbox provides API version one, 674 00:36:08,070 --> 00:36:09,330 but you need zero. 675 00:36:09,330 --> 00:36:12,510 And it says close: bad file descriptor 676 00:36:12,510 --> 00:36:14,910 and read on socketpair: success, 677 00:36:14,910 --> 00:36:17,913 I don't know why, but that all popped up from that. 678 00:36:19,350 --> 00:36:21,100 Wasn't able to use that in any way. 679 00:36:22,860 --> 00:36:24,570 Another one here, showing the difference 680 00:36:24,570 --> 00:36:29,520 between the first bad root user 681 00:36:29,520 --> 00:36:34,520 that we didn't do the OpenSSL and the su with. 682 00:36:34,680 --> 00:36:36,450 If we run dev_install there, 683 00:36:36,450 --> 00:36:39,000 it says your environment appears to be incomplete 684 00:36:39,000 --> 00:36:40,410 when changing to root. 685 00:36:40,410 --> 00:36:42,330 Did you remember to run the full command? 686 00:36:42,330 --> 00:36:43,860 Don't forget the dash. 687 00:36:43,860 --> 00:36:46,860 So they literally tell you what you need to run, 688 00:36:46,860 --> 00:36:50,820 so I ran sudo su -, and now when I run dev_install, 689 00:36:50,820 --> 00:36:52,767 it just says that it's not in developer mode, 690 00:36:52,767 --> 00:36:54,870 and so that tells me I've gained some kind 691 00:36:54,870 --> 00:36:57,453 of privilege escalation there in a small way. 692 00:36:59,310 --> 00:37:02,280 So being thorough again and looking at everything, 693 00:37:02,280 --> 00:37:06,447 I was kind of at a dead end, so we have DBUS on the system, 694 00:37:06,447 --> 00:37:09,120 and DBUS is all over the place now 695 00:37:09,120 --> 00:37:11,700 and there are a lot of insecurities, 696 00:37:11,700 --> 00:37:14,160 there's a lot of processes that can be run as root, 697 00:37:14,160 --> 00:37:18,750 and for some reason, we're not as resilient around the code 698 00:37:18,750 --> 00:37:20,793 and checking input sanitization there. 699 00:37:21,750 --> 00:37:25,170 So DBUS can also be complicated to go through, 700 00:37:25,170 --> 00:37:27,840 there's just a lot of data to look at. 701 00:37:27,840 --> 00:37:30,600 So I pretty much wrote a bash script 702 00:37:30,600 --> 00:37:33,780 to help me identify all the endpoints and do introspect 703 00:37:33,780 --> 00:37:35,220 and things of that nature. 704 00:37:35,220 --> 00:37:38,130 But it's still good to go through them manually and look 705 00:37:38,130 --> 00:37:41,280 at things, I did a lot of grepping there. 706 00:37:41,280 --> 00:37:44,430 I would grep for policy user equals root 707 00:37:44,430 --> 00:37:48,180 in the /etc/dbus-1/system.d directory 708 00:37:48,180 --> 00:37:50,910 through all the conf files to see what was root 709 00:37:50,910 --> 00:37:53,103 versus chronos versus shill. 710 00:37:54,390 --> 00:37:56,790 That's a good place to start there. 711 00:37:56,790 --> 00:37:59,640 And from there, we start trying to maybe figure out 712 00:37:59,640 --> 00:38:02,250 if we can run some of these commands. 713 00:38:02,250 --> 00:38:03,840 And again, through introspection, 714 00:38:03,840 --> 00:38:05,220 we're gonna do an introspect 715 00:38:05,220 --> 00:38:07,323 and see what all of our options are. 716 00:38:09,840 --> 00:38:14,160 This is a script that I wrote, it's a really nominal script, 717 00:38:14,160 --> 00:38:18,990 but it will connect to DBUS and it will actually output all 718 00:38:18,990 --> 00:38:23,990 of the interfaces and members inside of a file. 719 00:38:24,120 --> 00:38:26,820 And you can easily grep those in as well. 720 00:38:26,820 --> 00:38:31,820 And when you connect to DBUS that's running versus, 721 00:38:33,960 --> 00:38:38,027 you know, asking for the activatable members 722 00:38:39,210 --> 00:38:42,240 through introspect or interfaces, 723 00:38:42,240 --> 00:38:44,490 you get different results back, it's better for you 724 00:38:44,490 --> 00:38:46,830 to actually connect to the DBUS and see what it spits out, 725 00:38:46,830 --> 00:38:49,380 they might be obfuscating code or this or that, 726 00:38:49,380 --> 00:38:51,150 so you just gotta try it. 727 00:38:51,150 --> 00:38:55,710 And what we end up with is a whole bunch of text files 728 00:38:55,710 --> 00:38:58,440 that basically get spit out into a tmp directory. 729 00:38:58,440 --> 00:39:03,210 And I had it prepopulated, the gdbus monitor system 730 00:39:03,210 --> 00:39:05,700 for all of them, so I could quickly just enumerate 731 00:39:05,700 --> 00:39:10,230 through those and then spit the files out in this type 732 00:39:10,230 --> 00:39:13,800 of way to where we can see Cryptohome.conf and, whoops, 733 00:39:13,800 --> 00:39:17,760 all of the members here and all of the calls 734 00:39:17,760 --> 00:39:20,970 that we can make, so Cryptohome has to do with encrypting 735 00:39:20,970 --> 00:39:24,390 the user's, you know, information. 736 00:39:24,390 --> 00:39:26,940 And it looks like we can access that in some way, 737 00:39:26,940 --> 00:39:28,890 and of course, because we are chronos, we know 738 00:39:28,890 --> 00:39:31,690 we should be able to access that maybe for our own user. 739 00:39:34,050 --> 00:39:36,483 So again, some of the method and signal exploration 740 00:39:36,483 --> 00:39:39,210 that was done here, these are some of the sample commands 741 00:39:39,210 --> 00:39:42,030 and some of the endpoints, you know, 742 00:39:42,030 --> 00:39:43,770 that actually worked for us, we were able 743 00:39:43,770 --> 00:39:46,320 to get like our sanitized username 744 00:39:46,320 --> 00:39:51,320 from the Cryptohome interface here and information 745 00:39:51,330 --> 00:39:55,650 about BlueZ, our Bluetooth stack, Avahi-daemon, 746 00:39:55,650 --> 00:39:57,723 everything that's, you know, using DBUS. 747 00:39:59,010 --> 00:40:00,563 So we're gonna try to start running some of those 748 00:40:00,563 --> 00:40:05,100 just to see what happens and if we have access to all those, 749 00:40:05,100 --> 00:40:06,690 Some commands we were able to run, 750 00:40:06,690 --> 00:40:09,570 they would run as root, but we couldn't do anything. 751 00:40:09,570 --> 00:40:11,760 Some commands would actually run. 752 00:40:11,760 --> 00:40:14,280 You can, you know, ping, you're not allowed to ping 753 00:40:14,280 --> 00:40:16,770 by default before developer mode and chronos, 754 00:40:16,770 --> 00:40:18,453 but you can use DBUS to do it. 755 00:40:20,640 --> 00:40:23,790 You can set the user password. 756 00:40:23,790 --> 00:40:27,270 You can't do it for, or you could do it, 757 00:40:27,270 --> 00:40:32,270 but you can't do it before dev mode has been disabled. 758 00:40:32,580 --> 00:40:35,850 And then we looked at enabling Chrome features here, 759 00:40:35,850 --> 00:40:36,990 just trying. 760 00:40:36,990 --> 00:40:39,870 And it says, use of this tool is restricted to dev mode, 761 00:40:39,870 --> 00:40:41,370 so we're just being blocked in a lot of ways 762 00:40:41,370 --> 00:40:43,053 from running some of this stuff. 763 00:40:44,130 --> 00:40:48,060 So now it's time to try to find a vulnerability. 764 00:40:48,060 --> 00:40:50,853 And so this is where the fuzzing comes in again. 765 00:40:52,200 --> 00:40:54,360 We didn't need to use a Pico for this part per se 766 00:40:54,360 --> 00:40:56,223 because we have the file system. 767 00:40:58,260 --> 00:41:03,260 But we found, again, this packet capture start which, 768 00:41:03,780 --> 00:41:05,190 if you remember, back when we saw 769 00:41:05,190 --> 00:41:08,100 that the packet capture utility runs as root. 770 00:41:08,100 --> 00:41:11,670 So we have DBUS here and we know 771 00:41:11,670 --> 00:41:14,490 that we can run a packet capture 'cause we tested it. 772 00:41:14,490 --> 00:41:18,330 And so once we get into the fuzzing, 773 00:41:18,330 --> 00:41:22,770 we find out that there is a place that accepts a command. 774 00:41:22,770 --> 00:41:25,890 And it's coming off of the HT location. 775 00:41:25,890 --> 00:41:29,110 And so the way I test blind injections like that 776 00:41:32,924 --> 00:41:36,570 is to do reboot, it's just really a quick way to do it. 777 00:41:36,570 --> 00:41:39,960 So I was able to find that reboot would run as root 778 00:41:39,960 --> 00:41:41,510 through this command injection. 779 00:41:42,660 --> 00:41:45,720 So I tried to run a bunch of commands 780 00:41:45,720 --> 00:41:47,130 and none of them would work really 781 00:41:47,130 --> 00:41:50,040 unless they were only one-word commands. 782 00:41:50,040 --> 00:41:54,660 And vi almost worked for me, when you run vi there, 783 00:41:54,660 --> 00:41:58,230 it runs two processes as chronos and one as root, 784 00:41:58,230 --> 00:42:01,260 but you can't access it and you can't break out 785 00:42:01,260 --> 00:42:02,340 of the shell. 786 00:42:02,340 --> 00:42:05,580 But I found that there's a binary called ex 787 00:42:05,580 --> 00:42:09,030 that lets us actually get what we need out of it. 788 00:42:09,030 --> 00:42:13,350 So this right here is our, I'm just gonna go back here. 789 00:42:13,350 --> 00:42:15,363 This is our full attack path to root. 790 00:42:16,650 --> 00:42:20,460 This is the whole provisioning process on the Chromebook 791 00:42:20,460 --> 00:42:23,130 that you need to do that I talked about before. 792 00:42:23,130 --> 00:42:26,190 And when you run this packet capture command, 793 00:42:26,190 --> 00:42:30,150 you can see that, every other time I hit Enter, 794 00:42:30,150 --> 00:42:31,650 I get a different prompt. 795 00:42:31,650 --> 00:42:33,510 Now, that's matching up with what we saw before 796 00:42:33,510 --> 00:42:35,730 where things were kind of going into the back. 797 00:42:35,730 --> 00:42:39,090 So what we found is that one of those processes is root 798 00:42:39,090 --> 00:42:41,010 and one is chronos. 799 00:42:41,010 --> 00:42:46,010 So we just figure, let's just run the same command twice 800 00:42:46,020 --> 00:42:47,250 and it's gonna work. 801 00:42:47,250 --> 00:42:52,250 So I did that and it worked, I was able to get SSH running, 802 00:42:53,550 --> 00:42:57,990 turn on iptables, and let SSH run through. 803 00:42:57,990 --> 00:43:02,250 So now we can SSH to our own local port 22 804 00:43:02,250 --> 00:43:05,190 using the /home/chronos/.ssh keys 805 00:43:05,190 --> 00:43:07,860 and we can log in as root, and when we actually look 806 00:43:07,860 --> 00:43:11,760 at our environment there, we're root, that's it, we're done. 807 00:43:11,760 --> 00:43:14,340 And so we look at environment and set commands 808 00:43:14,340 --> 00:43:16,290 to validate that, we're gonna go back and look at some 809 00:43:16,290 --> 00:43:18,180 of the other commands we haven't run before, 810 00:43:18,180 --> 00:43:22,560 check namespaces, everything lines up, we are root now. 811 00:43:22,560 --> 00:43:27,560 And so we're gonna, there's a iptables commands there again. 812 00:43:27,960 --> 00:43:32,960 We can run fdisk now, we can try chromeos-setdevpasswd, 813 00:43:33,360 --> 00:43:36,030 it will work for us now, and we can actually cat 814 00:43:36,030 --> 00:43:38,820 the devmode.passwd out and see that. 815 00:43:38,820 --> 00:43:43,590 We can run debugfs and access file systems there 816 00:43:43,590 --> 00:43:45,710 and actually cat the /etc/shadow file, 817 00:43:45,710 --> 00:43:48,060 so we know we're root all the way. 818 00:43:48,060 --> 00:43:53,060 So taking the Pico Ducky, I put one script 819 00:43:53,220 --> 00:43:56,370 on the Pico Ducky, so if I plug it into my Chromebook, 820 00:43:56,370 --> 00:43:58,650 it takes about 30 seconds, and I'm gonna go 821 00:43:58,650 --> 00:44:01,890 through this process, and it will leave three tabs up 822 00:44:01,890 --> 00:44:04,140 on the Chromebook, one is shill-scripts, 823 00:44:04,140 --> 00:44:06,570 one is chronos, and one is root. 824 00:44:06,570 --> 00:44:09,780 So that is where the master key for the Ducky comes in. 825 00:44:09,780 --> 00:44:13,140 Again, just trying to be efficient, do one liners. 826 00:44:13,140 --> 00:44:17,220 So again, here's the actual payload.dd type of format 827 00:44:17,220 --> 00:44:18,810 would look like, so if you're not doing it 828 00:44:18,810 --> 00:44:21,180 on the command line, you're doing through the Pico, 829 00:44:21,180 --> 00:44:23,730 you obviously have to use the ducky language there. 830 00:44:23,730 --> 00:44:26,250 So that's what the payload.dd file looks like, 831 00:44:26,250 --> 00:44:27,600 that's not the whole thing. 832 00:44:29,070 --> 00:44:32,700 Bonus round, now that we're root, we can run bluetoothctl, 833 00:44:32,700 --> 00:44:34,620 we don't have to use the BT console anymore 834 00:44:34,620 --> 00:44:36,420 and we can do what we want there. 835 00:44:36,420 --> 00:44:38,430 We can find and decrypt the WiFi password 836 00:44:38,430 --> 00:44:40,860 in /var/cache/shill/default.profile 837 00:44:40,860 --> 00:44:44,550 and use an echo into tr there. 838 00:44:44,550 --> 00:44:47,940 And then we can also start messing around 839 00:44:47,940 --> 00:44:49,800 with firmware updating. 840 00:44:49,800 --> 00:44:53,970 Another trick was, again, if you stop powerd, 841 00:44:53,970 --> 00:44:57,600 it will allow all of the users to not be, 842 00:44:57,600 --> 00:45:01,230 you'll have a persistent shell and the shell won't close 843 00:45:01,230 --> 00:45:02,910 when you close the lid on the Chromebook, 844 00:45:02,910 --> 00:45:04,410 that's all required. 845 00:45:04,410 --> 00:45:06,540 I hated having to open the lid back up and wait, 846 00:45:06,540 --> 00:45:08,580 so I figured that out, if you stop powerd, 847 00:45:08,580 --> 00:45:10,500 you don't have to, you can just keep the lid closed 848 00:45:10,500 --> 00:45:11,333 and work on it. 849 00:45:14,130 --> 00:45:15,300 Some of the other things we're able to do 850 00:45:15,300 --> 00:45:18,480 is inject reverse shell into the .bashrc 851 00:45:18,480 --> 00:45:21,300 for the chronos user, so when they log in, 852 00:45:21,300 --> 00:45:23,553 I would get a reverse shell out of band then. 853 00:45:25,380 --> 00:45:30,380 We can tamper with the SQLite files and enumerate the Chrome 854 00:45:31,590 --> 00:45:35,190 and file functions of the URL bar. 855 00:45:35,190 --> 00:45:38,700 So real quick, SQLite's everywhere in there, 856 00:45:38,700 --> 00:45:40,530 all of our Google data's in there, 857 00:45:40,530 --> 00:45:44,310 there's credit card data in there, there's your history. 858 00:45:44,310 --> 00:45:46,350 And then shout out to my boys over here, 859 00:45:46,350 --> 00:45:51,213 poncho and red team wins and, who we got all there, Bryce. 860 00:45:52,320 --> 00:45:56,790 Back when I worked at Coalfire here, 861 00:45:56,790 --> 00:45:58,920 we did something called cookie baking, 862 00:45:58,920 --> 00:46:00,810 and we figured out we could stuff cookies 863 00:46:00,810 --> 00:46:02,640 by deleting an existing cookie, 864 00:46:02,640 --> 00:46:04,860 and even if it was encrypted, we could put it back in 865 00:46:04,860 --> 00:46:08,250 as a null encrypted cookie and it would work. 866 00:46:08,250 --> 00:46:12,810 So here's an example of stuffing that cookie, basically, 867 00:46:12,810 --> 00:46:16,743 using the SQLite file, and it says LRL was here. 868 00:46:18,930 --> 00:46:23,010 Using the Pico Ducky, you can do a Chrome enumeration 869 00:46:23,010 --> 00:46:26,670 using the URL bar, and if you don't know 870 00:46:26,670 --> 00:46:28,890 what options there are, you can get them 871 00:46:28,890 --> 00:46:33,810 from chrome://about, you can grep the file system, 872 00:46:33,810 --> 00:46:36,750 and you can do the network action predictor 873 00:46:36,750 --> 00:46:39,420 by typing one letter at a time and it will autofill for you, 874 00:46:39,420 --> 00:46:41,340 although it won't tell you all the commands. 875 00:46:41,340 --> 00:46:43,350 In fact, you can grep the system for more 876 00:46:43,350 --> 00:46:46,103 and find there's hidden ones that they don't tell you about. 877 00:46:48,720 --> 00:46:51,870 Here's our file system, so by default, 878 00:46:51,870 --> 00:46:55,920 you can actually access file system output from the browser, 879 00:46:55,920 --> 00:46:58,710 this is without exploiting, this is just normal use. 880 00:46:58,710 --> 00:47:01,290 So in the Chrome browser, you can look 881 00:47:01,290 --> 00:47:03,030 at the /home/chronos/user/Downloads, 882 00:47:03,030 --> 00:47:06,930 even if they're not logged in, they may put something there, 883 00:47:06,930 --> 00:47:11,703 as a non-chronos or the non-authenticated user 884 00:47:13,200 --> 00:47:15,150 of the system, they shouldn't see that. 885 00:47:17,250 --> 00:47:20,460 Quick little shout out here, Avahi-daemon, 886 00:47:20,460 --> 00:47:24,000 so I found a socket laying in run. 887 00:47:24,000 --> 00:47:26,730 And I used curl to connect to it. 888 00:47:26,730 --> 00:47:29,370 And you can use the unix-socket parameter 889 00:47:29,370 --> 00:47:30,930 for curl to do that. 890 00:47:30,930 --> 00:47:35,930 And it gave me output that told me that I should try HELP. 891 00:47:36,810 --> 00:47:40,110 So I actually just changed the HTTP verb to HELP, 892 00:47:40,110 --> 00:47:42,570 and it spit out this available commands. 893 00:47:42,570 --> 00:47:44,880 I went and Googled it, and I found on GitHub, 894 00:47:44,880 --> 00:47:48,030 there is a C file here that references that code. 895 00:47:48,030 --> 00:47:53,030 And we have a if FUCK equals go fuck yourself in there, 896 00:47:53,700 --> 00:47:54,573 Avahi. 897 00:47:55,980 --> 00:47:58,770 Anyway, that will just lead me into my shout out 898 00:47:58,770 --> 00:48:02,280 to Ray Liotta from Goodfellas, who passed away here as well, 899 00:48:02,280 --> 00:48:03,783 and go fuck yourself. 900 00:48:05,070 --> 00:48:06,573 That is the end of my talk. 901 00:48:07,470 --> 00:48:10,170 If you would like any information about what I've done 902 00:48:10,170 --> 00:48:13,380 or the script or see it work, reach out to me, 903 00:48:13,380 --> 00:48:15,420 I'm happy to show it to you. 904 00:48:15,420 --> 00:48:17,880 Again, I'm the CEO at Lost Rabbit Labs. 905 00:48:17,880 --> 00:48:18,990 I'd like to shout out to my team, 906 00:48:18,990 --> 00:48:20,700 Tyler and Chris over there. 907 00:48:20,700 --> 00:48:23,070 And again, thank you for the opportunity 908 00:48:23,070 --> 00:48:25,710 to speak here at DEF CON, it was an honor and a pleasure, 909 00:48:25,710 --> 00:48:28,184 and have the best DEF CON ever. 910 00:48:28,184 --> 00:48:31,048 (audience cheering)