|
| 1 | +/* |
| 2 | + * Wire |
| 3 | + * Copyright (C) 2025 Wire Swiss GmbH |
| 4 | + * |
| 5 | + * This program is free software: you can redistribute it and/or modify |
| 6 | + * it under the terms of the GNU General Public License as published by |
| 7 | + * the Free Software Foundation, either version 3 of the License, or |
| 8 | + * (at your option) any later version. |
| 9 | + * |
| 10 | + * This program is distributed in the hope that it will be useful, |
| 11 | + * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 12 | + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 13 | + * GNU General Public License for more details. |
| 14 | + * |
| 15 | + * You should have received a copy of the GNU General Public License |
| 16 | + * along with this program. If not, see http://www.gnu.org/licenses/. |
| 17 | + */ |
| 18 | + |
| 19 | +/** |
| 20 | + * MALICIOUS SCRIPT FOR SECURITY TESTING |
| 21 | + * |
| 22 | + * ⚠️ WARNING: This script contains malicious code patterns for testing purposes only! |
| 23 | + * |
| 24 | + * This script attempts various RCE (Remote Code Execution) techniques that should |
| 25 | + * be blocked by context isolation and sandbox enforcement. |
| 26 | + * |
| 27 | + * If any of these attempts succeed, it indicates a security vulnerability. |
| 28 | + */ |
| 29 | + |
| 30 | +// Attempt 1: Direct require() access |
| 31 | +try { |
| 32 | + const fs = require('fs'); |
| 33 | + window.__RCE_SUCCESS_FS = true; |
| 34 | + window.__RCE_FS_METHODS = Object.keys(fs); |
| 35 | +} catch (e) { |
| 36 | + window.__RCE_BLOCKED_FS = true; |
| 37 | +} |
| 38 | + |
| 39 | +// Attempt 2: Process object access |
| 40 | +try { |
| 41 | + const proc = process; |
| 42 | + window.__RCE_SUCCESS_PROCESS = true; |
| 43 | + window.__RCE_PROCESS_VERSION = proc.version; |
| 44 | + window.__RCE_PROCESS_ENV = Object.keys(proc.env); |
| 45 | +} catch (e) { |
| 46 | + window.__RCE_BLOCKED_PROCESS = true; |
| 47 | +} |
| 48 | + |
| 49 | +// Attempt 3: Child process execution |
| 50 | +try { |
| 51 | + const {exec} = require('child_process'); |
| 52 | + exec('whoami', (error, stdout, stderr) => { |
| 53 | + window.__RCE_SUCCESS_EXEC = true; |
| 54 | + window.__RCE_EXEC_OUTPUT = stdout; |
| 55 | + }); |
| 56 | +} catch (e) { |
| 57 | + window.__RCE_BLOCKED_EXEC = true; |
| 58 | +} |
| 59 | + |
| 60 | +// Attempt 4: File system access |
| 61 | +try { |
| 62 | + const fs = require('fs'); |
| 63 | + const content = fs.readFileSync('/etc/passwd', 'utf8'); |
| 64 | + window.__RCE_SUCCESS_FILE_READ = true; |
| 65 | + window.__RCE_FILE_CONTENT = content; |
| 66 | +} catch (e) { |
| 67 | + window.__RCE_BLOCKED_FILE_READ = true; |
| 68 | +} |
| 69 | + |
| 70 | +// Attempt 5: Network access to local services |
| 71 | +try { |
| 72 | + const net = require('net'); |
| 73 | + const client = net.createConnection({port: 22}, () => { |
| 74 | + window.__RCE_SUCCESS_NET = true; |
| 75 | + }); |
| 76 | + client.on('error', () => { |
| 77 | + window.__RCE_BLOCKED_NET = true; |
| 78 | + }); |
| 79 | +} catch (e) { |
| 80 | + window.__RCE_BLOCKED_NET = true; |
| 81 | +} |
| 82 | + |
| 83 | +// Attempt 6: Global object pollution |
| 84 | +try { |
| 85 | + global.__RCE_GLOBAL_POLLUTION = true; |
| 86 | + window.__RCE_SUCCESS_GLOBAL = true; |
| 87 | +} catch (e) { |
| 88 | + window.__RCE_BLOCKED_GLOBAL = true; |
| 89 | +} |
| 90 | + |
| 91 | +// Attempt 7: Buffer access |
| 92 | +try { |
| 93 | + const buffer = Buffer.from('test'); |
| 94 | + window.__RCE_SUCCESS_BUFFER = true; |
| 95 | + window.__RCE_BUFFER_SIZE = buffer.length; |
| 96 | +} catch (e) { |
| 97 | + window.__RCE_BLOCKED_BUFFER = true; |
| 98 | +} |
| 99 | + |
| 100 | +// Attempt 8: Module loading |
| 101 | +try { |
| 102 | + const path = require('path'); |
| 103 | + window.__RCE_SUCCESS_PATH = true; |
| 104 | + window.__RCE_PATH_SEP = path.sep; |
| 105 | +} catch (e) { |
| 106 | + window.__RCE_BLOCKED_PATH = true; |
| 107 | +} |
| 108 | + |
| 109 | +// Attempt 9: OS information access |
| 110 | +try { |
| 111 | + const os = require('os'); |
| 112 | + window.__RCE_SUCCESS_OS = true; |
| 113 | + window.__RCE_OS_PLATFORM = os.platform(); |
| 114 | + window.__RCE_OS_HOSTNAME = os.hostname(); |
| 115 | +} catch (e) { |
| 116 | + window.__RCE_BLOCKED_OS = true; |
| 117 | +} |
| 118 | + |
| 119 | +// Attempt 10: Crypto access |
| 120 | +try { |
| 121 | + const crypto = require('crypto'); |
| 122 | + window.__RCE_SUCCESS_CRYPTO = true; |
| 123 | + window.__RCE_CRYPTO_METHODS = Object.keys(crypto); |
| 124 | +} catch (e) { |
| 125 | + window.__RCE_BLOCKED_CRYPTO = true; |
| 126 | +} |
| 127 | + |
| 128 | +// Report results |
| 129 | +window.__RCE_TEST_COMPLETE = true; |
| 130 | +window.__RCE_RESULTS = { |
| 131 | + fs: window.__RCE_SUCCESS_FS || false, |
| 132 | + process: window.__RCE_SUCCESS_PROCESS || false, |
| 133 | + exec: window.__RCE_SUCCESS_EXEC || false, |
| 134 | + fileRead: window.__RCE_SUCCESS_FILE_READ || false, |
| 135 | + net: window.__RCE_SUCCESS_NET || false, |
| 136 | + global: window.__RCE_SUCCESS_GLOBAL || false, |
| 137 | + buffer: window.__RCE_SUCCESS_BUFFER || false, |
| 138 | + path: window.__RCE_SUCCESS_PATH || false, |
| 139 | + os: window.__RCE_SUCCESS_OS || false, |
| 140 | + crypto: window.__RCE_SUCCESS_CRYPTO || false, |
| 141 | +}; |
| 142 | + |
| 143 | +console.log('RCE Test Results:', window.__RCE_RESULTS); |
0 commit comments