关联漏洞
描述
Full chain Chrome 71.0.3578.98 exploit
介绍
https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html
Exploits [CVE-2019-7582](https://nvd.nist.gov/vuln/detail/CVE-2019-5782) and [CVE-2019-13768/P0 issue 1755](https://bugs.chromium.org/p/project-zero/issues/detail?id=1755)
Targets [Chrome 71.0.3578.98](https://web.archive.org/web/20190802133545/http://r2---sn-a5mlrn7k.gvt1.com/edgedl/release2/chrome/AO196ErPGQUF_71.0.3578.98/71.0.3578.98_chrome_installer.exe?mip=207.241.225.236&mvi=1&pl=20&shardbypass=yes&redirect_counter=1&cm2rm=sn-n4ved7z&req_id=c8354c1c8c157341&cms_redirect=yes&mm=34&mn=sn-a5mlrn7k&ms=ltu&mt=1564752822&mv=m)
Needed to update the [original PoC](https://bugs.chromium.org/p/project-zero/issues/detail?id=1755#c3) to work on Windows 10 1909+.
Also needed to increase reliability on a particular target machine where the original PoC had ~0% reliability (but had ~100% on another target)
# Install Dependencies
```
wget https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
python2 get-pip.py
pip2 install cherrypy
```
# Run
`python2 server.py`
# PoC changes:
Replacement of the freed object was not happening so increased the number of allocated 0x140 sized blocks from 0x88 to 0x8000.
Allocation of page at 0x40404040000 was not happening so increased the number of allocated pages from 0xc88 to 2*0xc88
The ROP gadget `mov rcx, rax ; mov rax, rcx ; add rsp, 28h ; ret` is no longer present in ntdll.dll on Windows 1909. Instead the ROP gadgets `mov rcx, rax ; test rcx, rcx ; setne al ; ret` and `mov rax, rcx ; add rsp, 0x28 ; ret` in shell32.dll are used.
`pipe.producer.close()` was causing the sprayed 0x140 sized blocks to be freed. Memory was getting cleaned up too quickly. So the function call was delayed until after the exploit completes.
Shellcode was changed so that an arbitrary command (upto shellcode length 0x200) can be used. To edit the shellcode either modify shellcode.asm and run `yasm -f bin -o shellcode.bin shellcode.asm` or hexedit the commandline string into shellcode.bin. Current payload command is `calc`
文件快照
[4.0K] /data/pocs/4cbcd55c84a60df9b79d52ed665dd4bf93f31714
├── [2.0K] copy_needed_bindings.py
├── [1.6K] index.html
├── [2.0K] README.md
├── [1.4K] server.py
└── [4.0K] win_71.0.3578.98
├── [4.0K] components
│ └── [4.0K] services
│ └── [4.0K] filesystem
│ └── [4.0K] public
│ └── [4.0K] interfaces
│ └── [ 12K] types.mojom.js
├── [2.3K] enable_mojo.js
├── [ 17K] file_writer.js
├── [9.4K] many_args.js
├── [4.0K] mojo
│ └── [4.0K] public
│ ├── [4.0K] js
│ │ └── [166K] mojo_bindings.js
│ └── [4.0K] mojom
│ └── [4.0K] base
│ ├── [8.8K] big_buffer.mojom.js
│ ├── [1.7K] file_error.mojom.js
│ ├── [5.4K] file_info.mojom.js
│ ├── [3.2K] file.mojom.js
│ ├── [2.7K] file_path.mojom.js
│ ├── [5.5K] string16.mojom.js
│ ├── [6.4K] time.mojom.js
│ └── [2.9K] unguessable_token.mojom.js
├── [5.9K] pe64.js
├── [4.0K] services
│ └── [4.0K] network
│ └── [4.0K] public
│ └── [4.0K] mojom
│ ├── [ 15K] data_pipe_getter.mojom.js
│ ├── [6.3K] http_request_headers.mojom.js
│ ├── [3.2K] mutable_network_traffic_annotation_tag.mojom.js
│ ├── [ 19K] network_param.mojom.js
│ ├── [ 16K] url_loader_factory.mojom.js
│ └── [ 72K] url_loader.mojom.js
├── [ 460] shellcode.asm
├── [ 100] shellcode.bin
├── [4.0K] third_party
│ └── [4.0K] blink
│ └── [4.0K] public
│ └── [4.0K] mojom
│ ├── [4.0K] blob
│ │ ├── [ 45K] blob.mojom.js
│ │ ├── [ 44K] blob_registry.mojom.js
│ │ ├── [ 46K] blob_url_store.mojom.js
│ │ ├── [ 46K] data_element.mojom.js
│ │ └── [4.6K] serialized_blob.mojom.js
│ └── [4.0K] filesystem
│ ├── [215K] file_system.mojom.js
│ └── [ 27K] file_writer.mojom.js
├── [2.0K] trigger.js
├── [3.2K] trigger_replace.js
└── [4.0K] url
└── [4.0K] mojom
├── [4.6K] origin.mojom.js
└── [2.6K] url.mojom.js
23 directories, 37 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。