DEF CON 32 - QuickShell Sharing is caring abt RCE attack chain on QuickShare - Or Yair, Shmuel Cohen

[Quick Share on Windows enables remote code execution via a creative attack chain combining file acceptance bypass, rogue Wi-Fi connection, and exploitation of Chrome's download process, leveraging metadata to identify and overwrite installers 19:10-38:48.]

Key Takeaways:
• File acceptance bypass allows sending files without user approval, bypassing visibility modes 19:10.
• Rogue Wi-Fi connection can be maintained by crashing Quick Share, enabling man-in-the-middle access to victim traffic for 30+ seconds 22:45-27:54.
• Metadata from HTTPS traffic (domains and file sizes) enables precise detection of executable downloads (e.g., VS Code, Notepad++) 30:05-33:27.
• A persistent timeout vulnerability causes Quick Share to endlessly open files, preventing Chrome from overwriting malicious files during download 36:46-37:59.

The research demonstrates how basic vulnerabilities can be chained into a powerful remote code execution attack, highlighting the importance of addressing non-critical bugs that enable broader exploitation paths. All 10 vulnerabilities were reported to Google, which confirmed and patched them with two CVEs.

Sources:

• 19:10 File acceptance bypass and visibility mode bypass explained.
• 22:45-27:54 Rogue Wi-Fi attack chain and stable connection via crash.
• 30:05-33:27 Use of HTTPS metadata to identify executable downloads.
• 36:46-37:59 Timeout vulnerability used to prevent Chrome from overwriting malicious files.