标题: Google Chrome 78.0.3904.70 - Remote Code Execution EDB-ID: 50917 CVE: 2019-13720 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Google Chrome 78.0.3904.70 - Remote Code Execution
# Date: 2022-05-03
# Exploit Author: deadlock (Forrest Orr)
# Type: RCE
# Platform: Windows
# Website: https://forrest-orr.net
# Twitter: https://twitter.com/_ForrestOrr
# Vendor Homepage: https://www.google.com/chrome/
# Software Link: https://github.com/forrest-orr/WizardOpium/blob/main/Google_Chrome_Portable_64bit_v76.0.3809.132.zip
# Versions: Chrome 76 - 78.0.3904.70
# Tested on: Chrome 76.0.3809.132 Official Build 64-bit on Windows 10 x64
# CVE: CVE-2019-13720
# Bypasses: DEP, High Entropy ASLR, CFG, CET
# Github: https://github.com/forrest-orr/WizardOpium

html
script


 Shellcode                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          
 Egghunter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
 DebugEgg   
 GcPreventer  
 IIRFilters  
 SharedAudioCtx  undefined
 FeedforwardSuperPageMetadata  undefined
 OutputFloatArray   
 MutableFreeListAudioBufs  
 DoubleAllocAudioBufs  
 ImageDataArray  
 EnableDebug  
 AlertOutput  
 HelperBuf   
 HelperDbl   HelperBuf
 HelperDword   HelperBuf
 HelperBigInt   HelperBuf
 HelperUint8   HelperBuf

 Message 
    EnableDebug 
        AlertOutput 
            Message
        
         
            consoleMessage 
        
    


 delay 
      resolve  resolve delay


 Val 
     ReversedVal  
     TempVal  Val

      i   i   i 
        ReversedVal  ReversedVal  
        ReversedVal  TempVal  
        TempVal  TempVal  
    

     ReversedVal


 Val 
     BitMask       
     ClearedVal  Val  BitMask 
     ClearedVal


 GetSuperPageBase  ClearBigIntLow21

 LeakedPtr 
     SuperPageBase  LeakedPtr
     SuperPageBase   


 LeakedPtr 
     Low21Mask      
     Index  LeakedPtr  Low21Mask  
     Index



 LeakedPtr 
     Index  LeakedPtr
     partitionPageMetadataPtr  LeakedPtr  Index  
     partitionPageMetadataPtr


 LeakedPtr Index 
     SuperPageBase  LeakedPtr
     PartitionPageBase  SuperPageBase  Index  
     PartitionPageBase


  
     MyPromise   GcCallback 
         Arg
        
          i   i   i 
                 buffer
        
        
        Arg
    
    
     MyPromise




 FreeListHead TargetAddress 
    FreeListHead  TargetAddress
     TempVal   
    TempValbuffer
    GcPreventerTempVal
     FreeListHead

 
 FreeListHead TargetAddress Val 
    FreeListHead  TargetAddress
     TempVal   
    TempValbuffer
    TempVal  Val
    GcPreventerTempVal


  
    
    
     ImportObj   imports  imported_func arg  consolearg  
     WasmModuleBytes                                                                               
     WasmCode   WasmModuleBytes
     WasmModule    WasmCode ImportObj
     WasmModuleexportsexported_func




 FreeListHead SlotSize SuperPageMetadataBase 
     SpanIndex   SpanIndex   SpanIndex 
        SlotSpanMetaAddress  SuperPageMetadataBase  SpanIndex       
        HelperBigInt  SlotSpanMetaAddress
          HelperDword  HelperDword    SpanIndex
        BucketAddress  FreeListHead SlotSpanMetaAddress
        HelperBigInt  BucketAddress
          HelperDword  HelperDword    SpanIndex
        
        BucketAddress   
            BucketAddress  BucketAddress   
            BucketSize  FreeListHead BucketAddress
            HelperBigInt  BucketSize
              HelperDword    HelperDword    SpanIndex
            
            HelperDword  SlotSize 
                
                SlotSpanFreeListAddress  SuperPageMetadataBase  SpanIndex     
                HelperBigInt  FreeListHead SlotSpanFreeListAddress
                  HelperDword  HelperDword    SpanIndex
                 HelperBigInt
            
        
    


 FreeListHead 
     WasmExport  
     FileReaderObj   
     FileReaderLoaderSize   
    
    
    FileReaderObjonerror  WasmExport
     FileReaderLoaderPtr  FreeListHead FileReaderLoaderSize FeedforwardSuperPageMetadata

     FileReaderLoaderPtr 
        
        
    
     
    HelperBigInt  FileReaderLoaderPtr
      HelperDword  HelperDword
    FileReaderObj  
     ValidationPtr  FreeListHead FileReaderLoaderSize FeedforwardSuperPageMetadata
    
    ValidationPtr  FileReaderLoaderPtr 
        HelperBigInt  ValidationPtr
          HelperDword  HelperDword

         FileReaderPtr  FreeListHead FileReaderLoaderPtr    
         VectorPtr  FreeListHead FileReaderPtr  
         RegisteredEventListenerPtr  FreeListHead VectorPtr
         EventListenerPtr  FreeListHead RegisteredEventListenerPtr
         EventHandlerPtr  FreeListHead EventListenerPtr  
         JsFuncObjPtr  FreeListHead EventHandlerPtr  
         JsFuncPtr  FreeListHead JsFuncObjPtr  
         SharedFuncInfoPtr  FreeListHead JsFuncPtr    
         WasmExportedFunctDataPtr  FreeListHead SharedFuncInfoPtr    
         WasmInstancePtr  FreeListHead WasmExportedFunctDataPtr    
         StubAddrFieldOffset  undefined

         MajorVersion 
             
                StubAddrFieldOffset    
                
             
                StubAddrFieldOffset    
                
        
        
         RwxJitStubPtr  FreeListHead WasmInstancePtr  StubAddrFieldOffset
        HelperBigInt  RwxJitStubPtr
          HelperDword  HelperDword

         x   x  Egghunterlength x   
            JitChunkAddress  RwxJitStubPtr  x
            HelperBigInt  JitChunkAddress
            
            
             y   y   y 
                HelperUint8y  Egghunterx  y
            
            
            FreeListHead JitChunkAddress HelperBigInt
        
        
        HelperBigInt  RwxJitStubPtr
          HelperDword  HelperDword
        
    
     
          HelperDword  HelperDword
    


   
    
     
    DoubleAllocAudioBufs   

      j   j   j 
        MutableFreeListAudioBufsSharedAudioCtx  
    

    
    
    IIRFilters   
     

      j   j   j 
        ImageDataArray  
    
    
    ImageDataArray   
     

      j   j  MutableFreeListAudioBufslength j 
         MutableFreeListEntry   MutableFreeListAudioBufsjbuffer
         MutableFreeListEntry   
             FreeListHeadPtr  MutableFreeListEntry 
             AllocCount  
            MutableFreeListEntry  FreeListHeadPtr
            
            
            
             
                GcPreventer 
                
                 AllocCount   
                    
                     
                
              MutableFreeListEntry  
            
            
            
             FreeListHead     
            GcPreventerFreeListHead
            FreeListHead
            
        
    

    


  FeedforwardAddress CallbackFunc 
     NumberOfChannels  
     TempAudioCtx   NumberOfChannels    
     AudioBufferSourceNode  TempAudioCtx
     ConvolverNode  TempAudioCtx
     Finished  

    

     BigSourceBuf  TempAudioCtxNumberOfChannels  
     SmallUafBuf  TempAudioCtxNumberOfChannels  
 
    SmallUafBuf
 
      i   i  NumberOfChannels i 
         ChannelData   BigSourceBufibuffer
        ChannelData  FeedforwardAddress
    
 
    AudioBufferSourceNodebuffer  BigSourceBuf
    ConvolverNodebuffer  SmallUafBuf
 
    

    AudioBufferSourceNodeloop  
    AudioBufferSourceNodeloopStart  
    AudioBufferSourceNodeloopEnd  
    AudioBufferSourceNodeConvolverNode
    ConvolverNodeTempAudioCtxdestination
    AudioBufferSourceNode
 
    TempAudioCtxBuf 
        Buf  

         Finished 
            TempAudioCtx  
            CallbackFunc 
            
          
            Finished  
              FeedforwardAddress CallbackFunc  
        
    
 
     Finished 
        ConvolverNodebuffer  
          

         Finished 
            
        

          i   i  IIRFilterslength i 
           OutputFloatArray 
           IIRFiltersiOutputFloatArray OutputFloatArray OutputFloatArray

             OutputFloatArray   
                Finished  
                DoubleAllocAudioBufsTempAudioCtx   
                DoubleAllocAudioBufsTempAudioCtx  
                AudioBufferSourceNode
                ConvolverNode
                
            
        

        ConvolverNodebuffer  SmallUafBuf
         
    


 LeakedFlinkPtr RenderCount 
    SharedAudioCtx      
    HelperBigInt  LeakedFlinkPtr
      RenderCount    HelperDword  HelperDword
    HelperBigInt  LeakedFlinkPtr
      HelperDword  HelperDword
    FeedforwardSuperPageBase  HelperBigInt     
    HelperBigInt  FeedforwardSuperPageBase
      HelperDword  HelperDword
    HelperBigInt  FeedforwardSuperPageBase
    FeedforwardSuperPageMetadata  HelperBigInt 
    IIRFilterFeedforwardAllocPtr  FeedforwardSuperPageBase    
    HelperBigInt  IIRFilterFeedforwardAllocPtr
      HelperDword  HelperDword
    IIRFilterFeedforwardAllocPtr PrePayloadHeapGroom


  CallbackFunc  
     TempAudioCtx        
     AudioBufferSourceNode  TempAudioCtx
     ConvolverNode  TempAudioCtx 
     ScriptNode  TempAudioCtx   
     ChannelBuf  TempAudioCtx  
     OriginBuf  TempAudioCtx   
     Finished  
     RenderCount  

    ConvolverNodebuffer  ChannelBuf
    AudioBufferSourceNodebuffer  OriginBuf 

    AudioBufferSourceNodeloop  
    AudioBufferSourceNodeloopStart  
    AudioBufferSourceNodeloopEnd  

    ChannelBuf 
    AudioBufferSourceNodeConvolverNode
    ConvolverNodeScriptNode
    ScriptNodeTempAudioCtxdestination

    AudioBufferSourceNode
    
    ScriptNode  Evt 
        RenderCount
          i   i   i 
             ChannelInputBuf   EvtinputBufferibuffer

              j   j  ChannelInputBuflength j 
                

                 j    ChannelInputBuflength  ChannelInputBufj    ChannelInputBufj     
                     TempHelperBigInt   
                     TempHelperDword   TempHelperBigIntbuffer
                    
                    TempHelperDword  ChannelInputBufj   
                    TempHelperDword  ChannelInputBufj  
                    
                     LeakedFlinkPtr  TempHelperBigInt

                    
                    
                     LeakedFlinkPtr     
                        LeakedFlinkPtr   
                    

                     LeakedFlinkPtr    LeakedFlinkPtr   
                        
                        
                        Finished  
                        Evt  
                        AudioBufferSourceNode
                        ScriptNode
                        ConvolverNode
                          LeakedFlinkPtr RenderCount  
                        
                    
                
            
        
    

    TempAudioCtxBuf 
        Buf   

         Finished 
            Finished  
            CallbackFunc

        
    

    
    
     Finished 
        ConvolverNodebuffer  
        ConvolverNodebuffer  ChannelBuf
          
    


   
     TempAudioCtx       
     FeedforwardArray    
     FeedbackArray    

    

    FeedbackArray  DebugEgg 
    FeedforwardArray   
    FeedforwardArray  

      i   i     i  
        IIRFiltersTempAudioCtxFeedforwardArray FeedbackArray
    

    

     Bucket240Slots   

     x   x  Bucket240Slots x  
        TempConvolver  TempAudioCtx
        AudioBuf  TempAudioCtx  
        TempConvolverbuffer  AudioBuf
        GcPreventerAudioBuf
        GcPreventerTempConvolver
    

    

     Bucket200Slots   

     x   x  Bucket200Slots   x 
        TempConvolver  TempAudioCtx 
        GcPreventerTempConvolver
    


 
     BrowserVersion  navigatoruserAgent
    MajorVersion  BrowserVersion 
    
     MajorVersion   
        ValidBrowser  

        MajorVersion   
            
        
    
     
        
    

  
    


ValidBrowser 
    
    InfoleakUAFCallback

 
      navigatoruserAgent

script
html URL: https://www.exploit-db.com/exploits/50917