Chrome DevTools Protocol Exploited for Post-Compromise Session Hijacking on Windows
A post-exploitation technique leverages Chrome DevTools Protocol to hijack authenticated browser sessions on Windows, allowing attackers with existing code execution to access cookies and sensitive data.
Cybersecurity researchers have detailed a novel post-exploitation technique that weaponizes the Chrome DevTools Protocol (CDP) within live Google Chrome and Microsoft Edge browser processes on Windows. This method allows an attacker who already possesses code execution on a target system to access sensitive information such as cookies, saved data, and authenticated browser sessions. Crucially, this technique does not rely on exploiting a new vulnerability in the browsers themselves but rather on manipulating existing functionalities.
The technique, dubbed CDP-Enable-BOF by its creators at SpecterOps, operates by injecting a Beacon Object File (BOF) into a running chrome.exe or msedge.exe process. This BOF then activates the browser's debugging server, exposing its internal context over a specified CDP port. This approach builds upon prior research into injecting CDP into running browsers and modern session hijacking methods.
SpecterOps outlines a multi-step process for the BOF. It begins by locating the target browser process and its main window, followed by identifying the loaded browser DLL. The BOF then resolves internal Chromium symbols using masked byte signatures before allocating memory for necessary stubs and a context block. It temporarily installs a remote window procedure and executes a final call on the browser's user interface thread to ensure reliability against security mechanisms like Control Flow Guard (CFG) and CET. Finally, it invokes Chromium's internal StartRemoteDebuggingServer function on the designated port.
Once the CDP debugging server is active, attackers can utilize SpecterOps' CDP-Toolkit to interact directly with the browser or automate its web interface. The toolkit supports several post-exploitation workflows, including cookie collection via Storage.getCookies, comprehensive browser data retrieval (history, bookmarks, extensions, screenshots, saved password metadata), and saved password recovery by interacting with the browser's autofill features.
Perhaps most concerning is the "Browser takeover" capability. This allows attackers to perform interactive screencasting of the victim's browser session, effectively gaining live control. Alternatively, they can proxy HTTP and HTTPS requests through the compromised browser, leveraging the victim's authenticated state and cookies to bypass security controls and access internal resources. This proxy mode preserves the victim's cookies and user agent, making malicious traffic appear legitimate.
While Google has implemented measures such as App-Bound Encryption and changes in Chrome 136 to mitigate cookie theft via remote debugging, this new technique circumvents these protections by initiating the debugging server from within the already compromised process. Furthermore, Google's recent introduction of Device Bound Session Credentials (DBSC) in Chrome 146, designed to bind session refresh to hardware keys, may also be sidestepped as the attack operates within the authenticated browser context on the victim's machine.
Defenders are advised to monitor for signs of process injection targeting chrome.exe and msedge.exe using Windows Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess). The public repository for CDP-Enable-BOF currently lists specific tested versions of Chrome and Edge, indicating that signature-based detection might be effective against older, unpatched versions. However, the technique's reliance on internal browser functions means it could be adapted to newer versions, necessitating ongoing vigilance.
The implications of this technique are significant, particularly in scenarios where attackers have already gained a foothold on a system. The ability to hijack authenticated sessions without exploiting a browser vulnerability lowers the bar for lateral movement and data exfiltration, turning legitimate browser processes into tools for further compromise. The research highlights the persistent cat-and-mouse game between defenders and attackers, where new methods constantly emerge to exploit the complex interactions between operating systems and applications.