Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing url handling in iTerm2 and Hyper for code execution

vin01.github.io

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Abusing url handling in iTerm2 and Hyper for code execution

#21

Post by where-group-by »

vbezhenar wrote: post #19
philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

Honestly I never understood the need to replace macOS Terminal. I'm heavy terminal user, that's my most used application by far. But macOS Terminal is absolutely fine for my needs and I never felt the need for any additional features.

MacOS has terrible window management by default. Having one window with multiple panes helps a lot.

You could use screen or tmux of course, but they have a more steep learning curve.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#22

Post by robin_reala »

philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

Just to double-check: you know that option-clicking on the green fullscreen icon does something close to fullscreen-without-spaces-implementation right?

Re: Abusing url handling in iTerm2 and Hyper for code execution

#23

Post by chr4 »

shzhdbi09gv8ioi wrote: post #17
philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

Give wezterm a try: https://wezfurlong.org/wezterm/index.html It is cross OS (learn once and use the same terminal in Windows, macOS and Linux), actively developed and written in rust

Written in Rust is nice, but it also uses `libssh` which has a history of security issues and bad support for recent ciphers. Would be interesting if it also has issues with terminal escape sequences.

I'm not sure I want any features in my terminal at this point...

Re: Abusing url handling in iTerm2 and Hyper for code execution

#24

Post by freeone3000 »

Timber-6539 wrote: post #8
dv_dt wrote: post #7

Earlier quoted context omitted.

I know I prefer my exploits to come from opaque corners of package formats or docker layers as bofh intended. The more indirect handoffs of trust the merrier.

Docker is at least sandboxed by default and requires sudo password to run commands.

But it requires sudo or effective-sudo to run any command, making such a measure worthless

Re: Abusing url handling in iTerm2 and Hyper for code execution

#25

Post by HunterWare »

classified wrote: post #15

I stopped using iTerm2 as soon as I learned it will open arbitrary URLs.

Huh, I just disabled it in Preferences and kept on rolling. This is the other viable option: Settings->Pointer->General and disable cmd-click opens filename/URL.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#26

Post by Tyr42 »

philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

The only reason I use iterm is so I have tmux integration and can scroll my tmux windows. That is the killer feature for me.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#27

Post by tzs »

Dylan16807 wrote: post #12
StableAlkyne wrote: post #9

Earlier quoted context omitted.

I can't believe curl | sh is still the recommended way to install oh-my-zsh

Getting it out of a repository wouldn't make any more vetting appear as if by magic. And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about. And multiply that sophistication…

> Getting it out of a repository wouldn't make any more vetting appear as if by magic.

But it makes it way easier to figure out what happened if you do get attacked.

With "curl | sh" if a compromised site only sends the attack code randomly and I get unlucky I won't have a copy of the attack code afterwards. If I go to the site to grab a copy I'll probably get a copy without the attack code.

With "curl > /tmp/foo.$$; sh If you insist on piping, at least do "curl | tee /tmp/foo.$$ | sh".

Re: Abusing url handling in iTerm2 and Hyper for code execution

#28

Post by scutrell »

shzhdbi09gv8ioi wrote: post #17
philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

Give wezterm a try: https://wezfurlong.org/wezterm/index.html It is cross OS (learn once and use the same terminal in Windows, macOS and Linux), actively developed and written in rust

I had major slow down in wexterm on my MBA. I didn't really look into it because the terminal is something I want to install and forget about, so the solution may be trivial. But it was so laggy as to be unusable.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#29

Post by tracker1 »

shzhdbi09gv8ioi wrote: post #17
philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

Give wezterm a try: https://wezfurlong.org/wezterm/index.html It is cross OS (learn once and use the same terminal in Windows, macOS and Linux), actively developed and written in rust

It's a bit heavy, but I've liked Tabby outside Windows a bit... I really like the new Windows terminal from MS, but it's Windows only, Tabby is about the closest I've found to it.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#30

Post by Joker_vD »

vin10 wrote: post #11
Groxx wrote: post #3

> Any links using those schemes when clicked, would open the MacOS terminal to perform the corresponding action. I'm unclear which of these are being described: 1: when printed and clicked, they may be handled by the terminal, and the terminal's handling allows more behaviors than it should, allowing code execution 2: when printed, these urls are automatically executed by the shell, allowing code execution Neither ar…

It is the first one, they need to be printed and clicked.

There is also another escape sequence, OSC 1337, apparently already implemented in iTerm2 [0], which makes iTerm2 open the URL instead of printing it:

    The hypothetical new control code is different because it does not display a hyperlink; it directly opens the link using the appropriate system URL handler.
[0] https://gitlab.com/gnachman/iterm2/-/issues/10994
Post reply on HN