从 0 开始学 V8 漏洞利用之 V8 通用利用链（二）

作者：hcamael@知道创宇404实验室

相关阅读：从 0 开始学 V8 漏洞利用之环境搭建（一）经过一段时间的研究，先进行一波总结，不过因为刚开始研究没多久，也许有一些局限性，以后如果发现了，再进行修正。

概述

‍我认为，在搞漏洞利用前都得明确目标。比如打CTF做二进制的题目，大部分情况下，目标都是执行system(/bin/sh)或者execve(/bin/sh,0,0)。

在v8利用上，我觉得也有一个明确的目标，就是执行任意shellcode。当有了这个目标后，下一步就是思考，怎么写shellcode呢？那么就需要有写内存相关的洞，能写到可读可写可执行的内存段，最好是能任意地址写。配套的还需要有任意读，因为需要知道rwx内存段的地址。就算没有任意读，也需要有办法能把改地址泄漏出来（V8的binary保护基本是全开的）。接下来就是需要能控制RIP，能让RIP跳转到shellcode的内存段。

接下来将会根据该逻辑来反向总结一波v8的利用过程。

调试V8程序

在总结v8的利用之前，先简单说说v8的调试。

1.把该文件v8/tools/gdbinit，加入到~/.gdbinit中：

$ cp v8/tools/gdbinit gdbinit_v8$ cat ~/.gdbinitsource /home/ubuntu/pwndbg/gdbinit.pysource /home/ubuntu/gdbinit_v8

2.使用%DebugPrint(x);来输出变量x的相关信息

3.使用%SystemBreak();来抛出int3，以便让gdb进行调试

$ cat test.jsa = [1];%DebugPrint(a);%SystemBreak();

如果直接使用d8运行，会报错：

$ ./d8 test.jstest.js:2: SyntaxError: Unexpected token '%'%DebugPrint(a);^SyntaxError: Unexpected token '%'

因为正常情况下，js是没有%这种语法的，需要加入--allow-natives-syntax参数：

$ ./d8 --allow-natives-syntax test.jsDebugPrint: 0x37640804965d: [JSArray] - map: 0x376408203a41  [FastProperties] - prototype: 0x3764081cc139  - elements: 0x3764081d30d1  [PACKED_SMI_ELEMENTS (COW)] - length: 1 - properties: 0x37640800222d  - All own properties (excluding elements): {    0x376408004905: [String] in ReadOnlySpace: #length: 0x37640814215d  (const accessor descriptor), location: descriptor } - elements: 0x3764081d30d1  {           0: 1 }0x376408203a41: [Map] - type: JS_ARRAY_TYPE - instance size: 16 - inobject properties: 0 - elements kind: PACKED_SMI_ELEMENTS - unused property fields: 0 - enum length: invalid - back pointer: 0x3764080023b5  - prototype_validity cell: 0x376408142405  - instance descriptors #1: 0x3764081cc5ed  - transitions #1: 0x3764081cc609 Transition array #1:     0x376408005245 : (transition to HOLEY_SMI_ELEMENTS) -> 0x376408203ab9  - prototype: 0x3764081cc139  - constructor: 0x3764081cbed5  - dependent code: 0x3764080021b9  - construction counter: 0[1]    35375 trace trap  ./d8 --allow-natives-syntax test.js

接下来试试使用gdb来调试该程序：

$ gdb d8pwndbg> r --allow-natives-syntax test.js[New Thread 0x7f6643a61700 (LWP 35431)][New Thread 0x7f6643260700 (LWP 35432)][New Thread 0x7f6642a5f700 (LWP 35433)][New Thread 0x7f664225e700 (LWP 35434)][New Thread 0x7f6641a5d700 (LWP 35435)][New Thread 0x7f664125c700 (LWP 35436)][New Thread 0x7f6640a5b700 (LWP 35437)]DebugPrint: 0x3a0c08049685: [JSArray] - map: 0x3a0c08203a41  [FastProperties] - prototype: 0x3a0c081cc139  - elements: 0x3a0c081d30d1  [PACKED_SMI_ELEMENTS (COW)] - length: 1 - properties: 0x3a0c0800222d  - All own properties (excluding elements): {    0x3a0c08004905: [String] in ReadOnlySpace: #length: 0x3a0c0814215d  (const accessor descriptor), location: descriptor } - elements: 0x3a0c081d30d1  {           0: 1 }0x3a0c08203a41: [Map] - type: JS_ARRAY_TYPE - instance size: 16 - inobject properties: 0 - elements kind: PACKED_SMI_ELEMENTS - unused property fields: 0 - enum length: invalid - back pointer: 0x3a0c080023b5  - prototype_validity cell: 0x3a0c08142405  - instance descriptors #1: 0x3a0c081cc5ed  - transitions #1: 0x3a0c081cc609 Transition array #1:     0x3a0c08005245 : (transition to HOLEY_SMI_ELEMENTS) -> 0x3a0c08203ab9  - prototype: 0x3a0c081cc139  - constructor: 0x3a0c081cbed5  - dependent code: 0x3a0c080021b9  - construction counter: 0

然后就能使用gdb命令来查看其内存布局了，另外在之前v8提供的gdbinit中，加入了一些辅助调试的命令，比如job，作用跟%DebufPrint差不多：

pwndbg> job 0x3a0c080496850x3a0c08049685: [JSArray] - map: 0x3a0c08203a41  [FastProperties] - prototype: 0x3a0c081cc139  - elements: 0x3a0c081d30d1  [PACKED_SMI_ELEMENTS (COW)] - length: 1 - properties: 0x3a0c0800222d  - All own properties (excluding elements): {    0x3a0c08004905: [String] in ReadOnlySpace: #length: 0x3a0c0814215d  (const accessor descriptor), location: descriptor } - elements: 0x3a0c081d30d1  {           0: 1 }

不过使用job命令的时候，其地址要是其真实地址+1，也就是说，在上面的样例中，其真实地址为：0x3a0c08049684：

pwndbg> x/4gx 0x3a0c08049685-10x3a0c08049684: 0x0800222d08203a41 0x00000002081d30d10x3a0c08049694: 0x0000000000000000 0x0000000000000000

如果使用job命令，后面跟着的是其真实地址，会被解析成SMI（small integer）类型：

pwndbg> job 0x3a0c08049685-1Smi: 0x4024b42 (67259202)

0x4024b42 * 2 == 0x8049684 (SMI只有32bit)

对d8进行简单的调试只要知道这么多就够了。

WASM

现如今的浏览器基本都支持WASM，v8会专门生成一段rwx内存供WASM使用，这就给了我们利用的机会。

我们来调试看看：

测试代码：

$ cat test.js%SystemBreak();var wasmCode = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);var wasmModule = new WebAssembly.Module(wasmCode);var wasmInstance = new WebAssembly.Instance(wasmModule, {});var f = wasmInstance.exports.main;%DebugPrint(f);%DebugPrint(wasmInstance);%SystemBreak();

然后使用gdb进行调试，在第一个断点的时候，使用vmmap来查看一下内存段，这个时候内存中是不存在可读可写可执行的内存断的，我们让程序继续运行。

在第二个断点的时候，我们再运行一次vmmap来查看内存段：

pwndbg> vmmap0x1aca69e92000     0x1aca69e93000 rwxp     1000 0      [anon_1aca69e92]

因为WASM代码的创建，内存中出现可rwx的内存段。接下来的问题就是，我们怎么获取到改地址呢？

首先我们来看看变量f的信息：

DebugPrint: 0x24c6081d3645: [Function] in OldSpace - map: 0x24c6082049e1  [FastProperties] - prototype: 0x24c6081c3b5d  - elements: 0x24c60800222d  [HOLEY_ELEMENTS] - function prototype:  - shared_info: 0x24c6081d3621  - name: 0x24c6080051c5  - builtin: GenericJSToWasmWrapper - formal_parameter_count: 0 - kind: NormalFunction - context: 0x24c6081c3649  - code: 0x24c60000b3a1  - Wasm instance: 0x24c6081d3509  - Wasm function index: 0 - properties: 0x24c60800222d  - All own properties (excluding elements): {    0x24c608004905: [String] in ReadOnlySpace: #length: 0x24c608142339  (const accessor descriptor), location: descriptor    0x24c608004a35: [String] in ReadOnlySpace: #name: 0x24c6081422f5  (const accessor descriptor), location: descriptor    0x24c608004029: [String] in ReadOnlySpace: #arguments: 0x24c60814226d  (const accessor descriptor), location: descriptor    0x24c608004245: [String] in ReadOnlySpace: #caller: 0x24c6081422b1  (const accessor descriptor), location: descriptor } - feedback vector: feedback metadata is not available in SFI0x24c6082049e1: [Map] - type: JS_FUNCTION_TYPE - instance size: 28 - inobject properties: 0 - elements kind: HOLEY_ELEMENTS - unused property fields: 0 - enum length: invalid - stable_map - callable - back pointer: 0x24c6080023b5  - prototype_validity cell: 0x24c608142405  - instance descriptors (own) #4: 0x24c6081d0735  - prototype: 0x24c6081c3b5d  - constructor: 0x24c608002235  - dependent code: 0x24c6080021b9  - construction counter: 0

可以发现这是一个函数对象，我们来查看一下f的shared_info结构的信息：

 - shared_info: 0x24c6081d3621 pwndbg> job 0x24c6081d36210x24c6081d3621: [SharedFunctionInfo] in OldSpace - map: 0x24c6080025f9  - name: 0x24c6080051c5  - kind: NormalFunction - syntax kind: AnonymousExpression - function_map_index: 185 - formal_parameter_count: 0 - expected_nof_properties: - language_mode: sloppy - data: 0x24c6081d35f5  - code (from data): 0x24c60000b3a1  - script: 0x24c6081d3491