saelo

//
// Quick and dirty exploit for the "roll a d8" challenge of PlaidCTF 2018.
// N-day exploit for https://chromium.googlesource.com/v8/v8/+/b5da57a06de8791693c248b7aafc734861a3785d
//
// Scroll down do "BEGIN EXPLOIT" to skip the utility functions.
//
// Copyright (c) 2018 Samuel Groß
//

//

saelo

|=-----------------------------------------------------------------------=|
|=-------------=[ 3 Years of Attacking JavaScript Engines ]=-------------=|
|=-----------------------------------------------------------------------=|
|=------------------------------=[ saelo ]=------------------------------=|
|=-----------------------------------------------------------------------=|

The following are some brief notes about the changes that have taken place
since the release of the "Attacking JavaScript Engines" paper [1]. In
general, no big conceptional changes have happened since. Mitigations have
been added to break some of the presented techniques and, as expected, a

saelo

package main

import (
    "fmt"
    "reflect"
)

func Decorate(impl interface{}) interface{} {
                fn := reflect.ValueOf(impl)

saelo

Dezhou Instrumentz

The challenge consisted of an iOS app (Calc.app) which implemented a simple calculator. Moreover, the app also registered a custom URL scheme (icalc://) which would simply evaluate the content of the URL. The calculator was implemented using NSExpressions and the input string would simply be parsed as such an expression and executed. NSExpressions are pretty powerful and allow for example calls to ObjC Methods (e.q. typing in sqrt(42) would end up calling +[_NSPredicateUtilities sqrt:@42]). Further, there are two interesting helper functions available in NSExpressions:

FUNCTION(obj, 'foo', "bar")

Which will result in a call of the method 'foo' on object obj with parameter "bar" (an NSString).

saelo

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <pthread.h>
#include <sys/mman.h>

#include <IOKit/IOKitLib.h>
#include <CoreFoundation/CFPropertyList.h>

const char* kMyDriversIOKitClassName = "io_oooverflow_IPwnKit";

saelo

import Foundation

let rightname = "sys.openfile.readonly./tmp/cantread.txt"

var status: OSStatus

var authref: AuthorizationRef?
let flags = AuthorizationFlags([.interactionAllowed, .extendRights, .preAuthorize])
status = AuthorizationCreate(nil, nil, flags, &authref)
assert(status == errAuthorizationSuccess)

saelo

// ===== [ Program B22F0D31-BFB5-40C1-B23B-EC221F2003A6 ] =====
// Corpus entry #8902 on instance CFC51903-38C9-46A1-A7FD-E83AF97694C4
v0 <- LoadBuiltin 'Int32Array'
v1 <- LoadInteger '0'
v2 <- LoadInteger '5'
v3 <- LoadInteger '0'
v4 <- LoadInteger '5'
v5 <- LoadInteger '0'
v6 <- LoadInteger '10'
v7 <- LoadInteger '1'

saelo

#!/usr/bin/env python3
#
# Exploit for "assignment" of GoogleCTF 2017
#
# CTF-quality exploit...
#
# Slightly simplified and shortened explanation:
#
# The bug is a UAF of one or both values during add_assign() if a GC is
# triggered during allocate_value(). The exploit first abuses this to leak a

saelo

#!/usr/bin/env python3
#
# Exploit for "ragnarok" of HITCON CTF 2017.
#
# Bug:
# ----
# In Odin::add_weapon, the following line of code is executed:
#
#   cast_spell(shared_ptr<Figure>(this));
#

saelo

//
// Exploit for the EC3 qemu escape challenge of Defcon CTF Qualifiers 2018
//
// Also see https://kitctf.de/writeups/hitb2017/babyqemu
//
// Copyright (c) 2018 Samuel Groß
//

#include <fcntl.h>
#include <inttypes.h>