PowerShell's curl runs JavaScript code with system access

PowerShell's curl runs JavaScript code with system access(support.microsoft.com)

13 points by goldsteinq 148 days ago | 8 comments

notepad0x90 148 days ago |

Interesting. I was sure at first that the title should be "Jscript", but it really is JavaScript. It uses the MSHTML COM, this isn't the modern Edge/mswebview embedding but the legacy browser engine used by Internet Explorer. It's had lots of vulnerabilities over the users.

I always use -useb with iwr, only because it spits out lots of errors otherwise, I think most people do as well (this isn't an issue). The "system access" in the title might be misleading, the javascript code can't access system resources just the same as it can't if you were running it internet explorer, unless of course there was an exploit.

Also, for OP: Do you mean "access to the system it runs on"? Because I'm pretty sure it doesn't run with "SYSTEM" access (as in privileged user).

It's basically same as using headless chrome to download or scrape things. The Invoke-WebRequest cmdlet here ('curl' is the alias for it), let's you do things like pass the response to some other cmdlet and do stuff with it. You can for example check the status code (even with usebasicparsing/useb), I believe with full DOM rendering here does is that it lets you access the DOM post-render for script manipulation.

There are lots of legit uses for this, especially when it involves interacting with sites that are too outdated and internal, or external sites that publish important information but don't have a proper feed or api.

To do this with curl.exe proper would not be possible (get a fully rendered dom). Even without rendering the whole dom, parsing the html/xml using cli tools or a shell script is very difficult. What Invoke-webrequest does it doesn't 'pipe' or output the raw text response, but an object that contains the rawresponse ( (curl -useb https://news.ycombinator.com).rawresponse ) but also the body, the headers and a other details of the response for shell scripting.

goldsteinq 148 days ago | |

> Also, for OP: Do you mean "access to the system it runs on"? Because I'm pretty sure it doesn't run with "SYSTEM" access (as in privileged user).

Yeah, I mean “access to the system”. It’s not the same as using headless chrome, because it gives you ActiveX and you can shell out to an arbitrary command.

notepad0x90 148 days ago | | |

I see, I didn't know it was possible to load active x without user consent that way. that's wild.

rdtsc 148 days ago |

Curl here is used generically, as in “client for url”? This is not cURL (https://en.wikipedia.org/wiki/CURL). I found it a bit confusing. My first thought was “I sure don’t remember curl running JavaScript from pages it fetches”.

bragh 148 days ago | |

Everybody say "thank you, Microsoft!". Until PowerShell 6, curl in pwsh was an alias to Invoke-WebRequest: https://lazyadmin.nl/powershell/using-curl/

Obviously, it does not cause any confusion at all because all the Windows admins always install the latest and greatest versions of Powershell into the environments they administer.

rdtsc 148 days ago | | |

Oh wow. I had no idea. I bet Daniel had a lot of fun fielding "curl is broken on Windows" issues.

goldsteinq 148 days ago | |

I wanted to make a more descriptive title, mentioning that Microsoft uses its own program for `curl` command, but ran out of characters.

mjmas 148 days ago | |

Older versions of Powershell have it as an alias for Invoke-WebRequest. (Which also overrides using the actual cURL program if you don't put .exe)