POC详情: 4cbcd55c84a60df9b79d52ed665dd4bf93f31714

来源
关联漏洞
标题: Google Chrome 输入验证错误漏洞 (CVE-2019-5782)
描述:Google Chrome是美国谷歌(Google)公司开发的一款Web浏览器。V8是其中的一套开源JavaScript引擎。 Google Chrome 72.0.3626.81之前版本中的V8存在安全漏洞。目前尚无此漏洞的相关信息,请随时关注CNNVD或厂商公告。
描述
Full chain Chrome 71.0.3578.98 exploit
介绍
https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html

Exploits [CVE-2019-7582](https://nvd.nist.gov/vuln/detail/CVE-2019-5782) and [CVE-2019-13768/P0 issue 1755](https://bugs.chromium.org/p/project-zero/issues/detail?id=1755)

Targets [Chrome 71.0.3578.98](https://web.archive.org/web/20190802133545/http://r2---sn-a5mlrn7k.gvt1.com/edgedl/release2/chrome/AO196ErPGQUF_71.0.3578.98/71.0.3578.98_chrome_installer.exe?mip=207.241.225.236&mvi=1&pl=20&shardbypass=yes&redirect_counter=1&cm2rm=sn-n4ved7z&req_id=c8354c1c8c157341&cms_redirect=yes&mm=34&mn=sn-a5mlrn7k&ms=ltu&mt=1564752822&mv=m)

Needed to update the [original PoC](https://bugs.chromium.org/p/project-zero/issues/detail?id=1755#c3) to work on Windows 10 1909+.

Also needed to increase reliability on a particular target machine where the original PoC had ~0% reliability (but had ~100% on another target) 


# Install Dependencies
```
wget https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
python2 get-pip.py
pip2 install cherrypy
```

# Run

`python2 server.py`

# PoC changes:

Replacement of the freed object was not happening so increased the number of allocated 0x140 sized blocks from 0x88 to 0x8000. 

Allocation of page at 0x40404040000 was not happening so increased the number of allocated pages from 0xc88 to 2*0xc88

The ROP gadget `mov rcx, rax ; mov rax, rcx ; add rsp, 28h ; ret` is no longer present in ntdll.dll on Windows 1909. Instead the ROP gadgets `mov rcx, rax ; test rcx, rcx ; setne al ; ret` and `mov rax, rcx ; add rsp, 0x28 ; ret` in shell32.dll are used.

`pipe.producer.close()` was causing the sprayed 0x140 sized blocks to be freed. Memory was getting cleaned up too quickly. So the function call was delayed until after the exploit completes.

Shellcode was changed so that an arbitrary command (upto shellcode length 0x200) can be used. To edit the shellcode either modify shellcode.asm and run `yasm -f bin -o shellcode.bin shellcode.asm` or hexedit the commandline string into shellcode.bin. Current payload command is `calc`
文件快照

[4.0K] /data/pocs/4cbcd55c84a60df9b79d52ed665dd4bf93f31714 ├── [2.0K] copy_needed_bindings.py ├── [1.6K] index.html ├── [2.0K] README.md ├── [1.4K] server.py └── [4.0K] win_71.0.3578.98 ├── [4.0K] components │   └── [4.0K] services │   └── [4.0K] filesystem │   └── [4.0K] public │   └── [4.0K] interfaces │   └── [ 12K] types.mojom.js ├── [2.3K] enable_mojo.js ├── [ 17K] file_writer.js ├── [9.4K] many_args.js ├── [4.0K] mojo │   └── [4.0K] public │   ├── [4.0K] js │   │   └── [166K] mojo_bindings.js │   └── [4.0K] mojom │   └── [4.0K] base │   ├── [8.8K] big_buffer.mojom.js │   ├── [1.7K] file_error.mojom.js │   ├── [5.4K] file_info.mojom.js │   ├── [3.2K] file.mojom.js │   ├── [2.7K] file_path.mojom.js │   ├── [5.5K] string16.mojom.js │   ├── [6.4K] time.mojom.js │   └── [2.9K] unguessable_token.mojom.js ├── [5.9K] pe64.js ├── [4.0K] services │   └── [4.0K] network │   └── [4.0K] public │   └── [4.0K] mojom │   ├── [ 15K] data_pipe_getter.mojom.js │   ├── [6.3K] http_request_headers.mojom.js │   ├── [3.2K] mutable_network_traffic_annotation_tag.mojom.js │   ├── [ 19K] network_param.mojom.js │   ├── [ 16K] url_loader_factory.mojom.js │   └── [ 72K] url_loader.mojom.js ├── [ 460] shellcode.asm ├── [ 100] shellcode.bin ├── [4.0K] third_party │   └── [4.0K] blink │   └── [4.0K] public │   └── [4.0K] mojom │   ├── [4.0K] blob │   │   ├── [ 45K] blob.mojom.js │   │   ├── [ 44K] blob_registry.mojom.js │   │   ├── [ 46K] blob_url_store.mojom.js │   │   ├── [ 46K] data_element.mojom.js │   │   └── [4.6K] serialized_blob.mojom.js │   └── [4.0K] filesystem │   ├── [215K] file_system.mojom.js │   └── [ 27K] file_writer.mojom.js ├── [2.0K] trigger.js ├── [3.2K] trigger_replace.js └── [4.0K] url └── [4.0K] mojom ├── [4.6K] origin.mojom.js └── [2.6K] url.mojom.js 23 directories, 37 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。