Coreweb (Defcamp '26)

1. Recon#

First we send a request to footprint the server: Can see that the Chromium version is 130.0.6723.31 Upon searching google I found this repo: https://github.com/Petitoto/chromium-exploit-dev, that targets at the same Chrome version (130)

Chromium vulnerability versions and affected ranges

2. Exploitation#

Inside the folder vuln/calc.js, we already have a sample for RCE on both Linux and Windows The exploit repository's calc.js source

The exploit repository's calc.js source in GitHub

Now I clone the repo to my PC, and I will be using the default configuration:

The default main.js exploit configuration

I will be editing the original calc.js to revshell to my server The edited exploit calling a reverse shell

The edited exploit using a shell command

The edited exploit using netcat

The revshell function is mentioned in kit/shellcodes/x64-linux.js

The revShell helper implementation

Build a JS loader that will load main.js

The HTML loader that fetches and runs main.js

An alternate view of the HTML loader

And point to my exploitation: main.js loading the exploit chain

Start the listener first: The reverse shell listener

The listener waiting for a connection

Upload everything to my server Uploading the exploit files to the server

Generate a SSL certificate, since there’s a lot of JS functions that will requires HTTPS Generating the server SSL certificate

Make a minimal HTTPS server with http.server The minimal Python HTTPS server

Run the server, input the url and pwn: The exploit target page receiving the HTTPS URL

The HTTPS server receiving exploit requests

The resulting reverse shell and captured flag