Windows Protocol Handler Argument Injection RCE in Electron

This repository contains a single Metasploit module (exodus.rb) that exploits a remote code execution vulnerability (CVE-2018-1000006) in the Exodus Wallet application for Windows, which is built on the ElectronJS framework. The exploit leverages a flaw in the application's handling of the custom 'exodus://' protocol handler. By enticing a user to click a specially crafted URL, the attacker can execute arbitrary PowerShell commands on the victim's machine. The module sets up an HTTP server (default port 80) to serve both the malicious HTML (which redirects to the crafted protocol handler) and the payload (typically a Meterpreter or similar shell). The payload is delivered and executed via PowerShell, and the exploit is fully integrated into the Metasploit framework, allowing for customizable payloads and automated exploitation. The code is mature and weaponized, suitable for real-world exploitation scenarios.

This repository demonstrates a proof-of-concept (POC) exploit for CVE-2018-1000006, a remote code execution vulnerability in Electron applications prior to version 1.8.2-beta.4. The repository contains pre-built vulnerable and fixed Electron app binaries, as well as source code for building and testing the exploit. The main exploit leverages a custom protocol handler (e.g., 'chybeta://') registered by the Electron app. By crafting a malicious URL (as shown in 'poc.html'), an attacker can trigger the Electron app to execute arbitrary system commands, such as launching calc.exe. The exploit is demonstrated for Windows (Electron v1.7.8), and the repository includes both vulnerable and fixed versions for comparison. The structure includes directories for the vulnerable app, the fixed app, and test code, with the main logic in 'main.js' files and the POC payload in 'poc.html'.