what's up what the is up denny's i mean defcon hi i'm jimmy two times
and i'm here to talk about how i broke my chromebook with a pico ducky
i'll also say this i'm a goon i've lost my voice and i'm gonna do my best here so bear with me
um my name is jimmy two times jim ollie as i said before i'm the ceo of lost rabbit labs right now
i am a former member of the u.s national video game team
you can see some history there on osgrelics.com old school gaming
my hacking led me to get involved in the video game industry back in the 80s
i was the first person to get involved in the video game industry back in the 80s
first person to beat mike tyson's punch out a bunch of nes and sega master system games
and i'm actually two characters in two sega master system games zillion two and wonderboy
and monsterland represent um 20 years martial arts student i think that is important to be
scholar warriorly in our hacker and everything we do and so that i just wanted to mention that
and i am dead
dedicated to gamifying our craft because this is all fun um it's my first time presenting
been a goon for six years sky talks for eight and this is a huge honor
so thank you defcon and thank you everybody for showing up appreciate it
so we will be covering gamified hacking container breakouts fuzzing strategy lol binning
living off the land uh retro assessments unorthodox methods and one-liners for the win
um i will say the first off this exploit is on an end-of-life chromebook
it's a known vulnerability that's been patched two years ago however i think some of the
techniques in here will help bug bounty and help other folks secure their chromebooks um this chromebook hack was done in 2016
done in factory reset state and it was done living off of the land really mostly or only
at the end one liners they're like keys it's a string that will open a door and every chance
we can we'll use them here and the pico ducky it is a key it's a shim it's a key you can
shove it in and we'll open the door for you so game of height upwards I feel like we're
better at progressing when we have a challenge or an ankle wait on us so it's often good to
put yourself in jail and really be thorough on how to get out of there to research all aspects
of your environment being tenacious thorough and exhaustive is key in a lot of what we do
looking for the anomaly or the knee
in the haystack so performing retro hacking or retro assessments is really about taking maybe
an older device and taking a look at it and see you know ten years ago we had a device we didn't
know much about ten years later we know way more we're gonna take it further if we take a look at
it even if it's old it's gonna help us gain insight into the new versions we could create
and some of the challenges that we need to solve and again putting yourself in jail here to expand
your horizons this is really about being thorough again with what's in front of you not thinking you
need an exploit or a zero-day or he's it's about being tenacious and trying all possibilities so
again too long get read here took an old ELL Chromebook HP pavilion 14 in an out-of-box
experience state and
it's able with the guest user we're able to gain local access through a cross breakout when Linux
isn't supposed to be enabled at and we're doing that by exploiting a command injection in the set
underscore command set and we're able to utilize shill scripts and the Kronos user accounts and
route before developer mode has been enabled and before any passwords have been assigned to the
existing users one of the other
uh exploits that was discovered was a command injection in dbus and that is where we got our
route from we were able to fuzz a parameter there and gain root access and again there's a couple
of tricks here old school tricks redirection operators internal field separator and we'll
get more into that as we go passionate curiosity is absolutely not a crime it's just not just know
that um right to repair it's our hardware we bought it we should be able to do what we want
um if we're afraid of affecting somebody's upstream infrastructure we can just sever the network
separate Communications in this case I did not I wanted to connect into the Google Cloud and we
did go from there so these are all non-destructive techniques meaning we didn't have to open a laptop
up or we didn't have to do anything crazy to modify anything here and again I was inspired
really to do it I like kiosk breakouts they're fun you know it's a challenge
they're small little CTF so anytime you can break out of a jail you win
the hardware we're using here today is going to be HP Pavilion uh Raspberry Pico and the
Pico duck ducky software and we'll talk about that in a second here
so one thing I'll mention here on the slide deck is it's done sort of in the form of a video game
so this is how to play the game set up the environment
we began by factory resetting the Chromebook power washing it then we boot it up
for the first time boot we log in and we log in as guests that's how we play
the helpful commands here uh during the out-of-box experience are for fun there's
actually something called shark mode I didn't know that one time I was booting up I pounded
on all the keys it's an actual technique to find stuff how did the keys and I saw shark mode shark
and I got to find out it's part of their enrollment process but there's a bunch of shortcut keys we
found there and um you can also force your out-of-box experience back into the original
state by deleting a couple of files out of home chronos and removing any user on the system
so this is our game map we we have a Chromebook we want to choose our attack path so we have the
Chrome browser
um we have the crosh window which has a limited shell we have we can sideload USB SD whatever
else inputs we have network and I started offers with the crosh window just because Linux Linux
terminal we want shells so I ended up going that route and let's see here
just looking at the cross shell by default it's not um Linux enabled all the way in
the back end as far as you can tell there's no shell command yet but you do have crush
dash dash a dev and dash dash removable if you can run the binary
and let's see here so fuzzing we want to we know we're gonna have to fuzz we know we're gonna have
to throw a lot of payloads at inputs and we don't want to do that as a human your hands will hurt
and your brain will hurt so we started off here using the rubber ducky
um I like doing rubber ducky stuff but memory limitations way too slow so ask from the info
booth thank you ask let me know that the Pico ducky software is awesome that Dave Bailey had
created and so I started the engagement started this whole uh project out with a rubber ducky and
I got far but as soon as I put use the Pico it just was night and day and here we go round one
so we know that we have a cross shell we have some commands that we can utilize you can go
through those uh and extract them and put them in a text file we're going to take all the commands
and put them in commands.txt then we're going to take some fuzz payloads and strings and shove
them in another text file this is how we're going to build our test harness and how we're
going to try to attack the duck or the chroma care with using the ducky so I just created a
called it fuzzy ducky it takes the commands one command per line and the fuzz payload one per
line and it will mush them together for you basically tons of payload lists out there fuzz
list I got to give a shout out to Dan McInerney for his little short fuzz list very interesting and
unique and then of course we also have things like the sec list and big list and naughty strings and
anything else you can throw at it
um this is the fuzzy ducky script on the left it's that simple takes the commands in from
one file and the commands and then the fuzz from the other puts them together and converts
it into the payload.dd file which then can be transferred over to the pico ducky and once
again thank you Dave Bailey for a great piece of software you can find it at github.com d-b-i-s-u
um it uses circuit pi it's all simple to set up piece of cake
um we have our ducky we have our shim so we're gonna open our Chromebook with the cross window
control alt T and we're going to direct the input into the browser window from there we plug in our
pico ducky and it starts fuzzing every command and it's probably hard to see some of these
screenshots but if you take a look at the slide deck which is going to be available you'll be able
to see all these commands and I wanted to kind of like picture it didn't happen on every aspect of the
through this project so it's all about sharing all this info so you can see what challenges I
had and how I worked through things um when we run our flies list here we don't see much uh the
first iteration but once we start getting in to some of the other payloads and running binaries
here we we saw a where the scooby-doo is here we can see that we got an eval error and a syntax
error an
unquoted string those are things to get excited about um we definitely saw other errors from
commands that we try to run but we didn't really see anything that showed us we had an actual
binary that would work yet so we keep going and we find even just using a parentheses left
parentheses and right generates an error and it tells you cut dash dash helps so now we know
cuts involved somehow from there we keep on fuzzing and you know once you see a result for
meaning you just want to focus in that one area maybe add more characters double the payloads put
a thousand characters after it and keep nailing that one spot over and over again so analyze the
results checking all the output looking for anomalies and verbose errors the command injection
and going through that whole process is sometimes really tough even doing things like XSS you can't
always get the payload you're looking for unless you spend hours you know trying to figure out how
to get it to work
um IPF we were able to use the internal yeah the IPF stuff here where is it
no okay um we're using existing OS functions to create like our variables and solve our
challenges here and then we use um some redirection tricks for our output because
initially we have blind output we can't see anything in the front part of the shell here
so we ended up trying to redirect output after getting blind results for a while
and we figured out here that using one and over to the ampersand two here we're gonna run
the air output or the regular output through air and that's gonna pop it to the screen here so
this example here shows set underscore apn and we have our parentheses
dash dash help dollar sign ifs 1 over to ampersand 2 that actually takes output and puts it through
the cross shell to where you can see it where normally be on the back end so now we have output
we're no longer blind from there i have like top twice a top 20 we set out top 10 but the first
initial top 20 info gathering commands i would try to run at this point you know this would be
id and things to identify the file system i'm looking for you name and things like that
caddy netzy password tailing var log messages and we were actually able to do all that we're able to
pull using again set underscore apn with the ls dollar sign ifs dash al dollar sign ifs and we
have everything on the screen now from the password file and from the directory listing
and let's see here
exfiltration tool so while we're looking for binaries we can run on the system
it's always good to try to figure out what you can use to input data and output data so we want
to upload we want to exfiltrate we were able to see that we had tar curl sftp scp ssh open ssl
open vpn ping smb client and basics d4 all available to us from behind the curtain there
so
we're going to continue with command injection you know we really want to get a shell at some
point or get some more substantial foothold so we start fuzzing again all these binaries
on the system and we notice that set underscore apn all of them are vulnerable to this command
injection but what we end up finding out is that some command injections require
a parenthesis or brackets around the ifs as opposed to just dollar sign ifs
and when it does that it splits out your parameters and run runs them slightly differently
so on the right you'll see ifs versus dollar sign uh brackets ifs and when we run those
four commands set underscore apn or the arp gw or the cellular underscore ppp or the wake on land
there we will see that three of those commands run as the shill scripts user
one of them runs as chrono so we have an anomalous binary there that's running as a different user so
right now we have access potentially to two users on the backend system we need to hack more so we
are going to do that with the power glove all right so obtaining a reverse shell now that we
know we can't really access anything locally per se through the window we are going to try to get
an out of band shell or access here so i took a laptop attacker box here and i set up a shell
a script on it to make a name pipes and temp directory to use open ssl to connect back into
the chromebook here so on the chromebook side we can take and actually let me finish that up
we also have a python simple web server running on the attacker box
with the open ssl server with our generated key so now back on the chromebox we can do our set
underscore apn command injection using curl dash gap bell and we can run that script
file on the chromebook and we actually get a reverse shell now and we are shill scripts and
i used the duck man over there for that user profile so let's take a look at the other command
set underscore cellular underscore ppp allowed us access to the chronos user
so let's see what happens when we try to get a reverse shell there we do the same method
and we find out we indeed end up as the chronos user instead of shell scripts
so we have access to two users now we want to kind of compare them see how they're different
see if there's any anomalies mount spaces namespaces capabilities so now it's about
trying to identify unique uh privileges or capabilities in these users this you're probably
not going to be able to see all that i'm not sure but again it's more comparison around uh
all the capabilities
see groups namespaces and things like that for comparison and what we do see is that there are
different mount points for these users we know that the chrome users are jailed and in this
version of chrome is 65 they were using mini jail for most everything and so we know that
some users are wrapped in a user script with a mini jail and restricted privileges or elevated
so we run some more commands here for info gathering and looking at the kernel
we find there's a var log debug vboot noisy.log that has some information about the system
firmware etc um our our proc version tells us that we're running
you can see that it's an older chromic there based on the date linux version is 3.8.11 and then again all the cpu
cat issue all the os related information sys control a and we can see where we're being
blocked we can't do we have protected hard links and protected sim links so they secured it pretty
good that way and so this is where i took the approach of trying to run every command on the
system as each of those users literally being thorough and seeing if there was anything that
would be anomalous elevate privilege
is or you know just do something weird so we found out if we try to run the chrome os set dev password
we can't do that because we have no developer mode um we found you generate logs uh binary on there
that will dump all the logs for you and save them to a tar ball and of course now we can exfiltrate
that with our ftp and curl and everything else we have running um we can try to run some of the
processes
um as corona
os but they won't run because you don't have root privileges so like chrome sandbox and
some other disk commands ppp um they won't give you uh they'll let you know you're not root
so you can validate that um i have a screenshot over here just showing also that when we try to
look at the cap mem on a certain process p trace is not enabled for us to do that
and it creates a log of that so again more information keep your eye on the logs as you're
tinkering
so one of the things we figured out i mentioned earlier across uh dash dash dev would upgrade
your cross shell so if you actually do the command injection here and do your cross or
cross dash dash dev you'll actually get the elevated cross shell and that gives you new
commands you can live in a coal mine it puts you in the you know the non-standard software there
packet capture and sys trace for the other two
so we upgrade and we start trying to run these other commands and we find that running the packet
capture fires off a process using user lib exec debug d and it's a capture utility and it puts
it in a mini jail if we look at the bottom here you can see we have a root process running mini
jail with some other parameters here the capture utility the file descriptor
and the device
before i moved on i actually provisioned my attacker box to the fullest i could to communicate
with the chromebook to give me all options available we actually had smb on there so
you can do smb transfers you can do peer-to-peer obviously the open ssl was on there as well
you can run a local open ssl server on the chromebook as well and you can
log in locally if you needed to which we'll look at here in a second as well
um but all these commands are just the normal linux commands that you would run versus the
chromebook command injection formatted commands just for comparison
so after tinkering for some time i realized why didn't i just try to
run bash from the shell like since i had a command injection
well it worked but there was no output but again we know we have our redirector and if you do exec you
know one redirect a ampersand two we now see the output in our terminal so now we actually have a
full local linux shell it's local it didn't need to have an external system to do the shell
so we've basically done a breakout right there and we can validate that we're chrono still we
can do all the same kind of commands we were running before but of course we don't have to
do any command injections we're just free to roam so one of the things i tried to do was i tried to
do here was make a one-liner to basically write to the bash rc so that would permanently put in
the exec command there to for the redirector that just makes it persistent for that session
end center is another one um breakouts with end center i did sqlite you can actually get out of
the sqlite and run in the dot shell bash command from there there's a few other ways that you can
see here dash is on there as well and we have sqlite on there which is nice because
they use a lot of sqlite database valves on the chromebook so that's right there
over with our other user then shill scripts we go back and we run our uh if you remember here
set underscore apn allows uh the shill scripts user whereas set underscore cellular underscore
ppp is our chronos user so we want
we want our shell scripts user and the way we do that is by provisioning open ssl locally
and then running our command injection with uh and actually we have to run it with chronos to
actually have it bind to the system or it doesn't have the right permissions with shell scripts so
it's kind of hybrid-y but we end up getting a shell here and this shell that we get is kind of
special chronos user shuts off when you log out it just gives it a frame when you log out and it's
shuts all the processes off for chronos or if you close the laptop lid um if you're using the shell
scripts reverse shell it doesn't shut down it stays up and running because it doesn't get killed
by the chronos users processes um so we have local access and again this is just how to set it up you
have to set up your key your cert pm and we throw that in var temp and it turns out var temps got
some persistence there across reboots um in chrome tab one we would do our set cellular command as
our chronos user for our open ssl and then our second tab we start the open ssl client running
as a shell scripts user with our set underscore apn and again we had uh we had some issues with
the payload so we had to use base64 to pass it through which works just fine since we have it
on the chromebook and i didn't really mention
it yet but in order to get our interactive tty we use the user bin script dash qc
and using bash there you could use dash or sh or whatever else you wanted
so now we have two users locally we no longer need our attacker box
here's the other cool thing we found out that we have hard-coded keys on the chromebook
through test keys that the chrome os has and they're stored in
user share chrome os dash ssh dash config keys and so what we can do is we can actually
if we couldn't access the private key it turns out we can just curl it from chromium
google source.com where they have the ssh underscore keys dot tar.gz file we save it
to the chromebook we we provision them into the temp director we could use our temp as well
we schmott it we run our ssh on a non-standard port and it's
running and then we can log in locally then with the shill scripts user by ssh or we're already
shill scripts but we use ssh to log in locally using those private keys that are hard-coded then
matching with our keys we put in temp and we're able to log in as chronos via
shill scripts user so a little priv escalation through living off the land again
so really we're trying to get root i guess i mean you know we're still really investigating the
system but we really do want to find root so again we're going to look at the users again
just validate what we have here chronos cannot run the pseudo binary whereas shill scripts can
you can write to a var temp and you can write to home slash chronos for precision
assistance shill scripts can do var temp but not the chronos directory the chronos user can modify
all sqlite 3 database files on the system because the logged in user for the chromebook is chronos
so we're able to to manipulate those files the shill scripts user has access to
debug d and privilege processes though so you know both both accounts looks good to continue
investigating so again
looking at some more normal privest type of stuff looking for low hanging fruit
and we didn't really find any of that we do see files that may run as root or with
root privileges but the way they've done jailing it was pretty secure
sockets we saw some of the sockets laying around so we did try to connect the sockets here
we had cups available avahi demon and a couple other things didn't really make any progress there
so now i go for the unorthodox methods crashing glitching and creating anomalies
and it's something that we did back in the old video game days where
for instance in the sega master system if you cartridge tilted
there was sometimes a second game on the chip sega genesis i think the first like 10 or so
games that came out had both the japanese chips and the american games on there and they didn't
have time to remove the other chips they had and they didn't have time to remove the other chips
ships so they left them both in so if you cartridge still you can actually get a second game out of
these old games um i'll do one more nes uh nintendo uh the first nintendo there was a game called
zanac it was a space shooter and if you took a zapper gun and plugged it into port two and went
on the first controller and then lifted the game up on the nintendo a little bit till it kind of
flickered and you push it back down when you saw the high score change to a fucked up symbol you
knew you had it and it let you access level selectors and all kinds of weird stuff you'd hit
the select key you need to warp three levels or hit the a button just anomalous behavior so we're
going to kind of go for some of that here by doing nested jails and trying to overlap namespaces and
things of that nature so looking at all of your logs you got var log chrome home chronos chrome
underscore debug log uh var log ui ui dot latest and of course var log
messages and secure and d message those are really you know all we had to look at our output
and our results here so we tried to do mini jail by using weird orders of their parameters and we
found that you can access a root user and that's normal you can take mini gl and create a root user
into a container and restrict all the prives but they were anomalous types of
user environments
and permissions set so when we did this mini gl dash cap u decimal m tick tick dash m cap m tick
tick with the nobody user it sets it to root and nobody nobody and we can see that still home chronos
we caused some weird name pipes to happen and overlap and delete each other occasionally
we did some suey
we had weirdness here there's some logs in here that you can look at later just to see
the result but we were able to figure out that running certain commands would cause a
kind of a shadow pts or a tty and they would overlap in the actual screen for the user so it
might be kind of hard to see on the far left here but i tried to exit out of this and it logged me
out but then i'm trying to type stuff and then you can see at the bottom it starts getting weird
something died here crush prompt shows up but then we got three dots and an arrow
um over here same kind of thing we try to exit crush we exit it um error won't let us exit
because it says it's only xi so our characters are being split in some way and we have no idea
no visibility into that so again tinkering more will provide more information in our logs
trying to do pseudos in certain environments would actually half work sort of and leave interesting
logs and we were able to again overlap file descriptors and namespace in really weird ways
that didn't gain us any extra permissions but we did gain a lot of information and
how weird and anomalous these overlapping processes could cause the tty's to be
so we're going to pull back a minute and look at all the users and we're going to
we're going to look at etsy password and etsy group for all of our possible uses and groups
here and we can use minijail to specify our user group and then we can specify a shell or a
command to run after it and so we spent time just kind of
enumerating we could be the bin user and damon and adm and turns out if you have a user id that
doesn't exist your name is i have no name at localhost again over here some of the output
from some of the minijail environment and set here and you can see nobody nobody nobody
sometimes you see you know we got cops here nobody so again we can kind of provision some
of the users but we don't know if they'll work the right way if we don't have the right mount
spaces and capabilities for them but it's interesting to just go through all that and
see if you can find some weird place to progress there and there's definitely room to play there
let's visit all of our cellmates shall we so on the chromebook there's a command called pinky
that will tell you the real world or the real life user information in a quick format there
so that's easy enough to kind of
go through you can see what shelves are set for each user and the description
so here we did uh again our mini jail messing around with the root uh trying to create a root
user and we use this dash um take zero one thousand one one thousand representing the
chronos user and we're trying to see if we can somehow access
uh user one here user id one and user id zero they'll they'll actually do a swap when you run
mini jail so that when you leave the container you get your original rights back out and we found
through tampering you could actually cause some really anomalous stuff where you had slight root
access or you could run root commands that would start to run and maybe fail because you weren't in
the right environment but it's still disclosed information it keeps on providing you with what
you need to move forward
so we're going to try to get that you that root user out using a reverse shell here since we
couldn't get it locally maybe there's something with the set underscore commands that gets
provisioned and does a privask or something so we try to do excuse me a reverse shell
and do our open ssl connection here we see that we are root id zero but we are gid nobody and
group nobody here so that is not root all the way we can check in the environment again here
to see who we really are and we find out that we're howard the duck the chronos user
and we know that our id equals user uh our user that we have here is not really our real
you a real root user it's just mapped to the outside of the mini jail to chronos which again is
expected that's how it's supposed to work but maybe there is some kind of way to get
again this user out so we went back in with cellular ppp tried our reverse shell again
through this error the mini gel bash command and if we do an su it actually would give us
limited root we were able to run su dash with that mini jail configuration from there we try to run
other root commands and find out maybe we're limited still we don't have the right mount space
we don't have the right capabilities yet
so we keep on tinkering here we're trying to break it we're trying su we're trying
sudo and we're getting all kinds of different information back from our phony root user here
if we run chrome sandbox before we couldn't run that now it tells us that the set uid sandbox
provides api version one but you need zero and it says close bad file descriptor and read
on socket pair success i don't know why but that all popped up from that um wasn't able to use it in a
anyway um another one here showing the difference between the first bad root user that we didn't do
the open ssl and the su with if we run dev install there it says your environment appears to be
incomplete when changing to root did you remember to run the full command don't forget the dash
so they literally tell you what you need to run so i ran sudo su dash and now when i run dev install
it just says that it's not in developer mode so that tells me i've gained some kind of
privilege escalation there in a small way so being thorough again and looking at everything i
was kind of at a dead end so we have d bus on the system and d bus is all over the place now
and there are a lot of insecurities there's a lot of processes that can be run as root and
for some reason we don't we're not as resilient around the code and checking input sanitization
there um so dbus can also be complicated to go through there's just a lot of
data to look at so i pretty much wrote a bash script to help me identify all the endpoints
and do introspect and things of that nature but it's still good to go through them manually
and look at things i did a lot of grepping there i would grab for policy user equals root
in the etsy dbus dash one system d directory through all the conf files to see what was
running and see if i could run some of those commands um that's the first thing that i wrote
about the project i think we did an introduction to our operating system
and we did a program called alethran and um one of the components that i wrote was being able to
run a lot of these commands in dbus we took features that are not graded in dbus and we
program and we got that based on the product we want so we're going to you know run some of those
commands and we're using that to the end of the project and and then we're going to D build some of those
components while we're doing that and then we're going to type the code in the dbus and we'll actually output all of the
the interfaces and members inside of a file and you can easily grab those in as well and
when you do um when you connect to dbus that's running versus you know asking for the
activatable members through introspect or interfaces you get different results back
it's better for you to actually connect to the dbus and see what it spits out they might be
obfuscating code or this or that so you just got to try it and what we end up with is a whole bunch
of text files that basically get spit out into a temp directory and i had it pre-populated the gb
gd bus monitor system for all of them so i could quickly just enumerate through those
and then spit the files out uh in this type of way to where we can see cryptohome.com and whoops
all of the um all of the members here and all the
the calls that we can make so cryptohome has to do with encrypting the users you know information
and it looks like we can access that in some way and of course because we are chronos we know we
should be able to access that maybe for our own user so again some of the method and signal
exploration that was done here these are some of the sample commands on some of the endpoints
um you know that actually worked for us we were able to get like our sanitized username from the
home uh interface here and information about blues our bluetooth stack avahi demon everything
that's you know using dbus so we're going to try to start running some of those just to see
what happens um and if we have access to all those some commands we were able to run they
would run as root but we couldn't do anything some commands would actually run you can you
know ping you're not allowed to ping by default before developer mode on chronos but you can use
dbus to do it um you can set the user password uh you can't do it for uh or you could do it but
you can't do it before a dev mode has been disabled and then we looked at enabling chrome
features here just trying and it says use of this tool is restricted to dev mode so we're just being
blocked in a lot of ways from running some of this stuff so now it's time to try to find a
and so this is where the fuzzing comes in again
um we didn't need to use a pico for this part per se because we have the file system
but um we found again this packet capture start which if you remember back we saw
that the packet capture utility runs as root so we have dbus here and
we know that we can run a packet capture because we tested it and so once we get into the fuzzing
we find out that there is a place that accepts a command and it's coming off of the ht location
and so the way i test blind injections like that is to
is to um do reboot it's just really quick way to do it so i was able to find that reboot would
run as root through this command injection so i i tried to run a bunch of commands and none of them
would work really and luckily they didn't work and i was just like wow that's crazy
they were only one word commands and vi almost worked for me when you run vi there runs two
processes as chronos and one as roots but you can't access it you can't break out of the shell
but i found that there's a binary called ex that lets us actually get what we need out of it so
this right here is our let me go back here this is our full attack path to root um this is the
whole probability provisioning process on the chromebook that you need to do that i talked
about before and when you run this packet capture command you can see that every other time i hit
enter i get a different prompt now that's matching up with what we saw before where
things were kind of going into the back so what we found is that one of those processes is root
and one is chronos so we just figure let's just run the same command twice and it's going to work
so i did that and it worked i was able to get ssh run turn on ip tables and let ssh run through so
now we can ssh to our own local port 22 using the home chronos ssh keys and we can log in as root
and when we actually look at our environment there we're root that's it we're done and so we look
at environment and set commands to validate that we're going to go back and look at some of the
things we haven't run before check namespaces everything lines up we are root now and so
we're gonna there's a ip tables command there again we can run fdisk now we can try chrome os
set the password it won't it will work for us now and we can actually cat the devmo dash password
out and see that we can run doug debug fs and access file systems there and actually cat the
fc shadow file so we know we're root all the way
so taking the pico ducky i put one script on the pico ducky so if i plug it into my chromebook
it takes about 30 seconds and i'm going to go through this process and it will leave three
tabs up on the chromebook one is shill scripts one is chronos and one is root so that is where
the master key for the ducky comes in again just trying to be efficient do one-liners
so again here's the actual payload.dd type of format
would look like so if you're not doing it on the command line you're going through the pico
you obviously have to use the ducky language there so that's what the payload.dd file looks like
that's not the whole thing bonus round now that we're root we can run bluetooth control
we don't have to use the bt console anymore and we can do what we want there we can find and
decrypt the wi-fi password and bar cache you'll default that profile and use an echo into gr there
and then we can also
start messing around with firmware updating another trick was again if you stop power d
it will allow all of the users to not be you'll have a persistent shell and the shell won't close
when you close the lid on the chromebook that's all required i hated having to open the lid back
up and wait so i figured that out if you stop power d you don't have to you can just keep the
lid closed and work on it some of the other things you're able to do is inject reverse shell
into the bash rc for the chronos user so when they log in i would get a reverse shell out of
ban then we can tamper with the sql lite files and enumerate the chrome and file functions of
the url bar so real quick sqlite's everywhere in there all of our google data is in there
there's credit card data in there there's your history and then shout out to my boys over here
and red team wins and who we got all their bryce um back when i worked uh at coal fire here
we did something called cookie baking and we figured out we could stuff cookies by deleting
an existing cookie and even if it was encrypted we could put it back in as a null encrypted cookie
and it would it would work so here's an example of stuffing that cookie basically
using the sqlite file and it says lrl was here
i'm using the picoducky you can do a chrome enumeration using the url bar and if you
don't know what options there are you can get them from chrome colon slash slash about you
can grab the file system and you can do the network action predictor by typing one letter
at a time and it will auto fill for you although it won't tell you all the commands in fact you
can grab the system for more and find those hidden ones that they don't tell you about
um here's our file system so by default you can actually access file system output from the
browser this is without exploiting this is normal use so in the chrome browser you can look at the
home chronos user downloads even if they're not logged in they may put something there
as a non in chronos or the non uh authenticated of the system they shouldn't see that
so the question is why do you have to do that but i'm going to show you a quick quick little shout
out here avahi damon so i found a socket lane in and run and i use curl to connect to it
and you can use the unix dash socket parameter for curl to do that and it gave me output that
told me that i should try help so i actually just changed the http verb to help and it spit out this
available commands i went and googled it and i found on github there is a c file here that references that command
code and we have a if fuck equals go fuck yourself in there avahi um anyway that will just lead me
into my shout out to ray leota from goodfellas who passed away here as well and go fuck yourself
that is the end of my talk um if you would like any information about what i've done or the script
or see it work reach out to me i'm happy to show it to you again i'm the ceo at lost rabbit labs
i'd like to shout out to my team tyler and chris over there and again thank you for the
opportunity to speak here at defcon it was an honor and a pleasure and have the best defcon ever