Video wird geladen...
Video konnte nicht geladen werden
I found a Remote Code Execution in MECCHA CHAMELEON! If you play a map, that map can abuse a few cool neat bugs to write arbitrary files with (semi-)arbitrary content anywhere on your system, eventually leading to RCE 🧮 🧵 Want to know how? Read this thread 👇
44,176 Aufrufe • vor 1 Monat •via X (Twitter)
29 Kommentare
A MECCHA CHAMELEON map is more than just assets. It can also contain Blueprints. These are Unreal Engine's visual programming system where you can connect nodes to program. I starting digging through all the functions that a MECCHA CHAMELEON map can call and ...
One stood out to me: Finish Recording Output It takes in some audio and saved that to a path. This means that we can easily just set the path to the Windows startup location and write files there right? %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/
Well, it's not quite as easy. The saved file get the `.wav` extension, so it's not really useful. We're just saving a real WAV file in a folder.
That's when I remembered a neat Windows trick: If you have a NULL (\u0000) byte in a filename, everything past the NULL gets dropped. So we could save our file as POC.exe\u0000. Unreal Engine will append .wav, making it POC.exe\u0000.wav But Windows removes all that!
But in the end, we're still saving a real audio file to this file. It may have the `exe` extension but it's not a real executable
So how do we get around that? Well, I've written a blog post going into a lot more detail on this, so definitely check it out 👇
This is very cool! But please don’t call it RCE. A user has to download the map, which makes it LCE. Still a major problem, and it’s a very fun bug. Congrats!
Pretty cool escalation. Congrats!
Thanks 🔥
What are your vmware settings mine super slow
Gosh, I just gave it like all the juice for this recording 😅 Also, some parts are a bit sped up (like the restarting)
Haven't read it yet, but I hope it involves whistling in binary.
Great job!
how is it RCE if the user has to download and run something that's LCE at best
If you join a server, you're pushed to install a map almost automayically with a button press, else you can't play. The delivery vector here is so trivial and has been exploited in the past that I think it's fair to call this RCE
this is so incredibly dope, nice find!
This is dope
is this not just an ACE with a RAT?
Not really because a map is not supposed to be able to execute code. This abuses a couple of neat tricks in functions that maps expose. Take a look at the blog (end of thread) for all the technical details!
The interesting part is the delivery: a map the lobby auto-downloads. Same shape as the Unit 42 case this week. No novel zero-day required once untrusted input is already executing. Branch protection was the only control that actually held there. Signed maps the equivalent here?
Ayy this is really cool. Nice find! I always enjoy reading stuff like that.
Thanks! 🔥🤘
You are like 4 months late dude
4 months ago this game didn't exist. This was fixed due to my report on the 20th.
2 months whatever This was basically the same way the discord server got hacked. Malware was put inside the map files and the when you loaded the custom map it would run everything in the folder
Check the blog post attached to the final section of this thread. It's a totally different technique. That previous one was fixed already.
Ah, my bad. Nice find
Correction: “I used AI and I have no skill”
Sure, after a decade as ethical hacker, I indeed have no skills whatsoever
![🔥Arbitrary Code Execution in AWS Kiro with Indirect Prompt Injection Multiple ways actually... 1) Write to settings.json to put Kiro into YOLO mode by adding: "kiroAgent.trustedCommands": ["*"] -> immediate arbitrary OS command execution without user approval 2) Write to kiro's mcp.json file to add a fake mcp server that runs arbitrary python code -> immediate arbitrary code execution AWS fixed the issues quickly, but no CVE issued. If you use Kiro make sure to run the latest version, before someone else updates it for you.](https://image.24vids.com/tw-1960365246301995194/amplify_video_thumb/1960363894830145536/img/6quTEcsuD-lS3y9C.jpg)
![The Rhythm In Anything (TRIA) An AI system to map arbitrary sound to high-fidelity drum recordings! Mind-blowing 🤯 we've probably watched this video a thousand times now 🥁 [SOUND: ON🎵]](https://image.24vids.com/tw-1856320935642472823/ext_tw_video_thumb/1856320910451527680/pu/img/9LB-vonrtTskL13l.jpg)
![Here's a copy/paste prompt recipe and vid showing exactly how to ask an LLM for an interactive map with satellite/map layers + a georeferencer that lets you see how old maps correspond with modern geography. Today the computer can’t make good print maps (that's your hill to climb ) but it can, with five bucks and twenty minutes, make good interactive maps. No software/GIS knowledge necessary, you just need a few nouns and an LLM. Scroll to the bottom for the repo/live map if you want those. I'm using Claude Code as an extension in VS Code but you can use the Claude CLI, Cursor, whatever. 1) Let's grab an old cadastral map and see who owned big tracts of a city; I found this an 1854 map of Niagara Falls, NY I found in the Library of Congress: , grabbed the .jp2, saved as a jpg from photoshop. 2) Let's ask Claude Code for a map. You can see exactly what I did in the video but my prompt, sans simple "hey it's busted" debugging, is written out in the following paragraphs. I explain the map-specific nouns in brackets. You can likely dump this whole thing in your LLM window and it'll work; I'd try plan mode + skip permissions. THE PROMPT Make an interactive map with MapLibre GL JS [maplibre is a javascript mapping library, a FOSS version of Mapbox GL JS. This lets us display tiled map data and arbitrary images on the map] Add basemap toggles with Esri satellite, Carto Positron, and OSM [these map layers require no API keys for light usage; Carto Positron is a nice road map layer and OSM is ugly but comprehensive] Add a globe/mercator projection toggle [I think the globe looks better at low zooms] Add a layer panel on the left with visibility checkboxes and delete buttons. Add a search box on the map that flies to results, with deletable pin markers [Makes this easy to get to your area of interest] Include an interactive local georeferencer: drop a JPG, pick ground control points on a zoomable/pannable image viewer, place them on the map, watch it warp with a progress bar centered on the map. [The georeferencer uses math ("affine transform"??) to match points on the old map to points on the new map; generally you click road intersections on the old map, match them on the new map, repeat a dozen times and everything aligns] The georeferenced map overlay defaults to 25% opacity with a slider above the control point list. [I want it easy to see the underlying modern geography] Add Export/import control point buttons [this saves the control points as a JSON so you can save and reimport your work] Add a button to export the warped image as a GeoTIFF with a .prj [In case you want to add the georeferenced image to a real GIS program like QGIS] Look up all relevant docs before starting [Claude sometimes uses outdated stuff] Split everything into separate HTML/CSS/JS files [Claude tends to pile everything in index.html, which is hard to read] Use Optima font, base color #FEFAF6 [I just like this style] Let me test with a local server [it serves it on a simple server so you can nav your host to localhost:8000 and try it out] Log all errors [so you don't have to play telephone with the LLM describing what's busted] 3) Once your LLM finishes, test it out in your browser; if it doesn't work, ask the LLM to check logs. Repeat 'til functional. 4) After this works on your computer, you can show it to everyone by hosting it on GitHub: prompt with "write a README explaining what everything does, add it to a new GitHub repo, deploy using GitHub pages, gimme the live URL" Here's what Claude made for me, try it yourself: • Upload the JPG in the repo, which is linked below • "Add GCP" • Click somewhere recognizable on the old map, like the tip of an island or a road intersection • Click the matching point on the new map • Repeat til you have least 3x points • Hit "georeference" • You'll see the old map atop the new map; if you want a better fit, delete bad points or add a dozen new ones, hit georeference again, repeat Repo: Is this map robust? Human-maintainable? Elegant? Performant? Secure? No, but *your* personal web map need not be. It just needs to work for *your* narrow use case, because it’s *your* map.](https://image.24vids.com/tw-2034005299972174112/amplify_video_thumb/2034000250713870337/img/BT1RIvJqMcNZrhwG.jpg)
