SecTor 2025 | Sharing Is Caring About an RCE Attack Chain on Quick Share

Why It Matters

The vulnerabilities enable silent file injection and short‑term network hijacking, exposing Windows and Android users to data theft and potential remote code execution, prompting urgent remediation from Google and heightened vigilance from enterprises.

Key Takeaways

• Quick Share's Windows version exposed to remote code execution chain.
• Researchers bypassed user consent, writing files directly to downloads folder.
• Wi‑Fi hotspot upgrade lets attacker monitor victim's internet traffic briefly.
• Fuzzing revealed crashes but logical analysis uncovered exploitable bugs.
• Open‑source code and new Windows API increased attack surface significantly.

Summary

At SecTor 2025, SafeReach researchers Orya and Cohen unveiled a sophisticated remote‑code‑execution (RCE) attack chain targeting Google’s Quick Share, now available on Windows. The talk detailed how the team reverse‑engineered the Nearby Connections protocol, built a custom "QuickSniff" logger, and leveraged both fuzzing and manual analysis to expose critical flaws in the newly released Windows client.

The investigators identified eight vulnerabilities, the most impactful being a file‑acceptance bypass that writes arbitrary files to the victim’s Downloads folder without any user interaction, and a Wi‑Fi hotspot‑upgrade flaw that forces the Windows client to connect to a rogue access point, granting the attacker a short window to sniff internet traffic. Although initial fuzzing only produced crashes, a shift to logical code review uncovered these exploitable bugs, demonstrating the limits of automated testing for complex, multi‑threaded applications.

Live demos showed a file appearing instantly on an Android device despite strict visibility settings, and a Windows machine automatically joining the attacker‑controlled Wi‑Fi network, exposing its traffic for up to thirty seconds. The researchers also released the "quick‑sniff" and exploit scripts on GitHub, emphasizing the ease with which the chain can be assembled from the discovered primitives.

The findings underscore the heightened risk of cross‑platform apps that reuse mobile‑centric APIs on desktop environments. Google must patch the acceptance bypass and Wi‑Fi upgrade logic, while enterprises should monitor Quick Share traffic and enforce strict network segmentation. The work serves as a cautionary tale that open‑source components and rapid feature rollouts can inadvertently expand the attack surface.

Original Description

Quick Share (formerly Nearby Share) has allowed Android users to easily share files for four years now. A year ago, Google introduced a Windows version. Google's promotion of Quick Share for preinstallation on Windows, alongside the limited recent research, ignited our curiosity about its safety, leading to an investigation that uncovered more than we had imagined.

We studied its Protobuf-based protocol using hooks, built tools to communicate with Quick Share devices, and a fuzzer that found non-exploitable crashes in the Windows app. We then diverted to search for logic vulnerabilities, and boy oh boy, we regretted we hadn't done it sooner. We found 10 vulnerabilities, both in Windows & Android, allowing us to remotely write files into devices without approval, force the Windows app to crash in additional ways, redirect its traffic to our WiFi AP, traverse paths to the user's folder, and more. However, we were looking for the holy grail, an RCE. Thus, we returned to the drawing board, where we realized that the RCE is already in our possession in the form of a complex chain.

In this talk, we'll introduce QuickShell - An RCE attack chain on Windows combining 5 out of 10 vulnerabilities in Quick Share. We'll provide an overview of Quick Share's protocol, present our fuzzer, the found vulnerabilities, a new HTTPS MITM technique, and finally, the RCE chain.

By: Or Yair | Security Researcher, SafeBreach

Presentation Materials Available at:

https://blackhat.com/sector/2025/briefings/schedule/?#quickshell-sharing-is-caring-about-an-rce-attack-chain-on-quick-share-47268