Abusing url handling in iTerm2 and Hyper for code execution
vin01.github.io
Abusing url handling in iTerm2 and Hyper for code execution
1–10 of 58 posts
Re: Abusing url handling in iTerm2 and Hyper for code execution
#2[deleted]
Re: Abusing url handling in iTerm2 and Hyper for code execution
#3>Any links using those schemes when clicked, would open the MacOS terminal to perform the corresponding action.
I'm unclear which of these are being described:
1: when printed and clicked, they may be handled by the terminal, and the terminal's handling allows more behaviors than it should, allowing code execution
2: when printed, these urls are automatically executed by the shell, allowing code execution
Neither are good of course, but they're different levels of badness, and I feel like I must be missing a single critical word somewhere to be able to figure out which it is.
---
That said, oh boy I do not want this:
>Most terminal emulators these days allow using Osc 8 to directly generate hyperlinks from arbitrary text.
Is there a standard way to disable it? That sounds awful, terminals don't have even a small fraction of browsers' malicious-link-defense mechanisms (as demonstrated). I always want to see the full url in a terminal.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#4> Any links using those schemes when clicked, would open the MacOS terminal to perform the corresponding action. I'm unclear which of these are being described: 1: when printed and clicked, they may be handled by the terminal, and the terminal's handling allows more behaviors than it should, allowing code execution 2: when printed, these urls are automatically executed by the shell, allowing code execution Neither ar…
You never want to see raw, attacker-supplied text in a terminal, actually.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#5> Any links using those schemes when clicked, would open the MacOS terminal to perform the corresponding action. I'm unclear which of these are being described: 1: when printed and clicked, they may be handled by the terminal, and the terminal's handling allows more behaviors than it should, allowing code execution 2: when printed, these urls are automatically executed by the shell, allowing code execution Neither ar…
You never want to see raw, attacker-supplied text in a terminal, actually.
It sure is a good thing we never run anything in our terminals without fully vetting all output.
curl -s -L https://raw.githubusercontent.com/Groxx/rickrollrc/master/roll.sh | bashRe: Abusing url handling in iTerm2 and Hyper for code execution
#6Earlier quoted context omitted.
You never want to see raw, attacker-supplied text in a terminal, actually.
It sure is a good thing we never run anything in our terminals without fully vetting all output. curl -s -L https://raw.githubusercontent.com/Groxx/rickrollrc/master/roll.sh | bash
You know the rules, and so do I.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#7Earlier quoted context omitted.
It sure is a good thing we never run anything in our terminals without fully vetting all output. curl -s -L https://raw.githubusercontent.com/Groxx/rickrollrc/master/roll.sh | bash
You know the rules, and so do I.
I know I prefer my exploits to come from opaque corners of package formats or docker layers as bofh intended. The more indirect handoffs of trust the merrier.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#8Earlier quoted context omitted.
You know the rules, and so do I.
I know I prefer my exploits to come from opaque corners of package formats or docker layers as bofh intended. The more indirect handoffs of trust the merrier.
Docker is at least sandboxed by default and requires sudo password to run commands.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#9Earlier quoted context omitted.
You never want to see raw, attacker-supplied text in a terminal, actually.
It sure is a good thing we never run anything in our terminals without fully vetting all output. curl -s -L https://raw.githubusercontent.com/Groxx/rickrollrc/master/roll.sh | bash
I can't believe curl | sh is still the recommended way to install oh-my-zsh
Re: Abusing url handling in iTerm2 and Hyper for code execution
#10> This is of course a harmless PoC and you can try it out using docker pull vin01/escape-seq-test:latest --platform darwin/arm64 or docker run --rm vin01/escape-seq-test and you should see the injected link as shown below.
Wow, I wouldn't have expected `docker pull` in particular to allow arbitrary content injection. Does anyone know of any tools which scan images being pulled before passing them over to `docker` for processing?