Exploit-DB #49864
Description: Firefox 72 IonMonkey - JIT Type Confusion
Type: local
Platform: windows_x86-64
Date: 2021-05-13
Author: Forrest Orr

Exploit:
# Exploit Title: Firefox 72 IonMonkey - JIT Type Confusion
# Date: 2021-05-10
# Exploit Author: deadlock (Forrest Orr)
# Vendor Homepage: https://www.mozilla.org/en-US/
# Software Link: https://www.mozilla.org/en-US/firefox/new/
# Versions: Firefox < 72 64-bit
# Tested on: Windows 7 x64, Windows 8.1 x64, Windows 10 x64
# CVE: CVE-2019-17026
# Bypasses: DEP, ASLR, CFG, sandboxing
# Credits: maxpl0it, 0vercl0k
# Full explain chain writeup: https://github.com/forrest-orr/DoubleStar

/*
________                 ___.    .__                 _________  __
\______ \    ____   __ __\_ |__  |  |    ____       /   _____/_/  |_ _____  _______
 |    |  \  /  _ \ |  |  \| __ \ |  |  _/ __ \      \_____  \ \   __\\__  \ \_  __ \
 |    `   \(  <_> )|  |  /| \_\ \|  |__\  ___/      /        \ |  |   / __ \_|  | \/
/_______  / \____/ |____/ |___  /|____/ \___  >    /_______  / |__|  (____  /|__|
        \/                    \/            \/             \/             \/
Windows 8.1 IE/Firefox RCE -> Sandbox Escape -> SYSTEM EoP Exploit Chain

                            ______________
                            | Remote PAC | 
                            |____________|  
                                   ^
                                   | HTTPS
_______________  RPC/ALPC   _______________   RPC/ALPC   _______________
| firefox.exe | ----------> | svchost.exe | -----------> | spoolsv.exe |
|_____________|             |_____________| <----------- |_____________|
                                   |          RPC/Pipe
                                   |
               _______________     | 
               | malware.exe | <---| Execute impersonating NT AUTHORY\SYSTEM
               |_____________|

~

Component

Firefox 64-bit IonMonkey JIT/Type Confusion RCE. Represents the initial attack
vector when a user visits an infected web page with a vulnerable version of
Firefox. This component contains a stage one (egg hunter) and stage two (WPAD
sandbox escape) shellcode, the latter of which is only effective on Windows 8.1
due to hardcoded RPC IDL interface details for WPAD.


_______________  JIT spray   ______________  DEP bypass   _______________________
| firefox.exe | -----------> | Egg hunter | ------------> | WPAD sandbox escape |
|_____________|              | shellcode  |               | shellcode (heap)    |
                             |____________|               |_____________________|                                                                    

~

Overview

This is a Windows variation of CVE-2019-17026, an exploit targetting a type
confusion bug in the IonMonkey engine of Firefox up to FF 72. Due to specific
issues with heap grooming, this particular variant of CVE-2019-17026 only works
on versions of Firefox up to FF 69 even though the bug was not fixed until FF
72 and is still technically exploitable on FF 70 and 71.

CVE-2019-17026 represents the initial RCE vector in the Double Star exploit
chain. Unlike my re-creation of CVE-2020-0674, which is limited to efficacy
in IE/WPAD instances running within Windows 7 and 8.1 (with Windows 10 CFG and
WPAD sandboxing being beyond the scope of this project in complexity to bypass)
this particular exploit is effective on any version of Windows, including 10
provided that a vulnerable version of Firefox is installed. The reason for this
is that presence of (and exploit usage of) a JIT engine in this exploit makes
dealing with both DEP and CFG substantially easier.

~

Design

This exploit contains two shellcodes: an egg hunter/DEP bypass shellcode (which
is JIT sprayed) and a primary (stage two) shellcode stored as a static Uint8Array.
The stage one (egg hunter) shellcode is responsible for scanning the entire
memory space of the current firefox.exe process and finding the stage two
shellcode on the heap. This is achieved by prefixing the stage two shellcode
with a special 64-bit egg value which this egg hunter shellcode scans for. Once
it has found the stage two shellcode, it uses KERNEL32.DLL!VirtualProtect to
change its permissions to +RWX, and then directly executes it via a CALL
instruction.

The type confusion bug allows for an array boundscheck to be eliminated, thus
allowing for an OOB R/W via a glitched array. The nursery heap (where the array
is stored) is groomed so that 3 arrays are lined up in memory:

[Array 1][Array 2][Array 3]

The first array is used with the JIT bug to make an OOB write and corrupt the
metadata of the second array. Specifically, it corrupts its length to allow for
OOB R/W at will (without the JIT bug) which is subsequently used throughout
the remainer of the exploit to corrupt the Native Object structure of the third
array to build arbitrary R/W and AddressOf primitives.

A JIT spray is then used to spray an egg hunter shellcode (encoded as double
floats) into +RX memory, encapsulated in a do-nothing function. The JIT code
pointer of this function is leaked and subsequently used with an egg hunter
in the JS itself (using arbitrary read) to find the egg which marks the 
start of the egg hunter shellcode in +RX memory. In this sense, the exploit
contains 2 egg hunters: a JS egg hunter which searches for a JIT sprayed egg
hunter which in turn hunts for the full (stage two) WPAD sandbox escape
shellcode. Once the JIT sprayed (stage one) egg hunter shellcode finds the stage
two shellcode, it sets its memory region to +RWX and directly executes it.

~

Sandboxing

The Firefox sandbox prevents access to the filesystem (besides a special sandbox
temp directory) and registry but additionally (unlike IE11 on Windows 8.1) locks
down access to the desktop window session (which prevents even a MessageBoxA
from popping) and sets a child process creation quota of zero (preventing the
creation of child processes). By adjusting the sandbox content level in the FF
"about:config" settings some of these features can