what you don't know can hurt you
Showing 1 - 23 of 23 RSS Feed

Files from saelo

First Active2013-05-23
Last Active2019-07-09
Spidermonkey Uninitialized Memory Access
Posted Jul 9, 2019
Authored by saelo, Google Security Research

In Spidermonkey, definite properties are incorrectly computed in some cases, leading to uninitialized memory access when unboxed objects are enabled.

tags | advisory
MD5 | 79fc5823bfa08cae2fcfd2ee4bbcd32c
Spidermonkey IonMonkey Incorrect Prediction
Posted Jun 25, 2019
Authored by saelo, Google Security Research

Spidermonkey IonMonkey incorrectly predicts return type of Array.prototype.pop, leading to type confusion vulnerabilities.

tags | exploit, vulnerability
advisories | CVE-2019-11707
MD5 | b9cfb835c09f9ff2359a0ac43fb9d908
Safari Webkit Proxy Object Type Confusion
Posted Jun 2, 2019
Authored by saelo, Ian Beer, Siguza, niklasb | Site metasploit.com

This Metasploit module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the structure of e.g. an argument without causing a bailout, leading to a type confusion (CVE-2018-4233). The type confusion leads to the ability to allocate fake Javascript objects, as well as the ability to find the address in memory of a Javascript object. This allows us to construct a fake JSCell object that can be used to read and write arbitrary memory from Javascript. The module then uses a ROP chain to write the first stage shellcode into executable memory within the Safari process and kick off its execution. The first stage maps the second stage macho (containing CVE-2017-13861) into executable memory, and jumps to its entrypoint. The CVE-2017-13861 async_wake exploit leads to a kernel task port (TFP0) that can read and write arbitrary kernel memory. The processes credential and sandbox structure in the kernel is overwritten and the meterpreter payloads code signature hash is added to the kernels trust cache, allowing Safari to load and execute the (self-signed) meterpreter payload.

tags | exploit, arbitrary, kernel, javascript, shellcode
advisories | CVE-2017-13861, CVE-2018-4233
MD5 | 394148cda471deeb3abbfdccf622fa46
Spidermonkey IonMonkey JS_OPTIMIZED_OUT Value Leak
Posted May 28, 2019
Authored by saelo, Google Security Research

Spidermonkey IonMonkey can, during a bailout, leak an internal JS_OPTIMIZED_OUT magic value to the running script. This magic value can then be used to achieve memory corruption.

tags | exploit
advisories | CVE-2019-9792
MD5 | f548194e2e5ce1c18bacbf389f666b48
JavaScript V8 Turbofan Out-Of-Bounds Read
Posted May 28, 2019
Authored by saelo, Google Security Research

JavaScript V8 Turbofan may read a Map pointer out-of-bounds when optimizing Reflect.construct.

tags | advisory, javascript
MD5 | 36998fe03e21e2360e63455dcd1824ed
Spidermonkey IonMonkey Unsafe Code Execution
Posted May 28, 2019
Authored by saelo, Google Security Research

Spidermonkey IonMonkey suffers from an issue where an unexpected ObjectGroup in the ObjectGroupDispatch operation might lead to potentially unsafe code being executed.

tags | advisory
advisories | CVE-2019-9816
MD5 | 9fd40f0341879df02a9860af01e711aa
JSC DFG Incorrect Decision On Behavior
Posted May 21, 2019
Authored by saelo, Google Security Research

JSC DFG's doesGC() is incorrect about the HasIndexedProperty operation's behavior on StringObjects.

tags | advisory
advisories | CVE-2019-8622
MD5 | 447815ba563e6a4e43af5179de5f3476
JavaScriptCore LICM Uninitialized Stack Variable
Posted May 21, 2019
Authored by saelo, Google Security Research

JavaScriptCore loop-invariant code motion (LICM) in DFG JIT leaves a stack variable uninitialized.

tags | exploit
advisories | CVE-2019-8623
MD5 | e3d6af3254ffc8f7e66b61e4895a6d8a
JavaScriptCore AIR Optimization Incorrectly Removes Assignment To Register
Posted May 21, 2019
Authored by saelo, Google Security Research

JavaScriptCore AIR optimization incorrectly removes assignment to register.

tags | advisory
advisories | CVE-2019-8611
MD5 | fbb7e0f88cf0da1880e1e46b1ff5975a
Chrome V8 Turbofan JSCallReducer::ReduceArrayIndexOfIncludes Failed Check
Posted May 10, 2019
Authored by saelo, Google Security Research

Chrome V8 has an issue where JSCallReducer::ReduceArrayIndexOfIncludes in turbofan fails to insert Map checks.

tags | exploit
MD5 | c3cedb648ac563ef9c4a151be439bf86
JavaScriptCore Out-Of-Bounds Access
Posted Apr 2, 2019
Authored by saelo, Google Security Research

JavaScriptCore suffer from an out-of-bounds access vulnerability in FTL JIT due to LICM moving array access before the bounds check.

tags | advisory
advisories | CVE-2019-8518
MD5 | 666ca0b0b1f37dcfd1113b475c267cad
JavaScriptCore CodeBlock Use-After-Free
Posted Apr 2, 2019
Authored by saelo, Google Security Research

JavaScriptCore suffers from CodeBlock use-after-free vulnerabilities due to dangling Watchpoints.

tags | advisory, vulnerability
advisories | CVE-2019-8558
MD5 | 44941500a9bd200e3ded8e6050b94b65
XNU Unsafe Pidversion Increment During Execve
Posted Apr 1, 2019
Authored by saelo, Google Security Research

XNU has an issue where pidversion increment during execve is unsafe.

tags | exploit
advisories | CVE-2019-8514
MD5 | 98cad986f696210bc1f2b23ff3589ba7
JavaScriptCore createRegExpMatchesArray Fails To Respect Inferred Types
Posted Apr 1, 2019
Authored by saelo, Google Security Research

JavaScriptCore has an issue where createRegExpMatchesArray does not respect inferred types.

tags | exploit
advisories | CVE-2019-8506
MD5 | 890d106035374c388ef370b205c1ca00
SpiderMonkey IonMonkey Type Confusion
Posted Mar 29, 2019
Authored by saelo, Google Security Research

A bug in IonMonkey leaves type inference information inconsistent, which in turn allows the compilation of JITed functions that cause type confusions between arbitrary objects.

tags | exploit, arbitrary
advisories | CVE-2019-9813
MD5 | cdcb535655303de5282b8e9ce3804be5
SpiderMonkey IonMonkey Type Confusion
Posted Mar 27, 2019
Authored by saelo, Google Security Research

A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replacement (OSR) allows the compilation of JITed functions that cause type confusions between arbitrary objects.

tags | exploit, arbitrary
advisories | CVE-2019-9791
MD5 | 2d9234f04f13771cc4ba74f08b736649
Safari Proxy Object Type Confusion
Posted Dec 13, 2018
Authored by saelo | Site metasploit.com

This Metasploit module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the structure of e.g. an argument without causing a bailout, leading to a type confusion.

tags | exploit, arbitrary, javascript
advisories | CVE-2018-4233, CVE-2018-4404
MD5 | c501475e6a50c14cfc8ea6a100c5476d
Mac OS X libxpc MITM Privilege Escalation
Posted Nov 28, 2018
Authored by saelo | Site metasploit.com

This Metasploit module exploits a vulnerability in libxpc on macOS versions 10.13.3 and below. The task_set_special_port API allows callers to overwrite their bootstrap port, which is used to communicate with launchd. This port is inherited across forks: child processes will use the same bootstrap port as the parent. By overwriting the bootstrap port and forking a child processes, we can now gain a MitM position between our child and launchd. To gain root we target the sudo binary and intercept its communication with opendirectoryd, which is used by sudo to verify credentials. We modify the replies from opendirectoryd to make it look like our password was valid.

tags | exploit, root
advisories | CVE-2018-4237
MD5 | 45269b24778bad6f66dc74a38caefbe2
Foxit PDF Reader 9.0.1.1049 Pointer Overwrite Use-After-Free
Posted Aug 24, 2018
Authored by mr_me, saelo, Jacob Robles, bit from meepwnn | Site metasploit.com

Foxit PDF Reader version 9.0.1.1049 has a use-after-free vulnerability in the Text Annotations component and the TypedArray's use uninitialized pointers. The vulnerabilities can be combined to leak a vtable memory address, which can be adjusted to point to the base address of the executable. A ROP chain can be constructed that will execute when Foxit Reader performs the UAF.

tags | exploit, vulnerability
advisories | CVE-2018-9948, CVE-2018-9958
MD5 | e97b836581258dc59d81b67b330175e8
Phrack - Attacking JavaScript Engines
Posted Sep 26, 2017
Authored by phrack, saelo

Phrack: Attacking JavaScript Engines: A case study of JavaScriptCore and CVE-2016-4622.

tags | javascript, magazine
advisories | CVE-2016-4622
MD5 | 7eb5ac7affbfc927e6c0294bb84baa2c
Apple Safari 10.1 Spread Operator Integer Overflow
Posted Jun 5, 2017
Authored by saelo

Apple Safari version 10.1 suffers from a spread operator integer overflow vulnerability.

tags | exploit, overflow
systems | apple
advisories | CVE-2017-2536
MD5 | 3a943d9ae9fc03a27794d0ca8ba5bd54
X86_X32 recvmmsg Arbitrary Write Local Root
Posted Feb 3, 2014
Authored by saelo

Linux 3.4+ arbitrary write exploit for CONFIG_X86_X32 that spawns a root shell.

tags | exploit, arbitrary, shell, root
systems | linux
advisories | CVE-2014-0038
MD5 | f1b57ea21800bad181a5c6367fd1763e
Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow
Posted May 23, 2013
Authored by Greg MacManus, hal, saelo | Site metasploit.com

This Metasploit module exploits a stack buffer overflow in versions 1.3.9 to 1.4.0 of nginx. The exploit first triggers an integer overflow in the ngx_http_parse_chunked() by supplying an overly long hex value as chunked block size. This value is later used when determining the number of bytes to read into a stack buffer, thus the overflow becomes possible.

tags | exploit, overflow
advisories | CVE-2013-2028, OSVDB-93037
MD5 | 94362300dbd4b7f9d4fd7deca32fd52d
Page 1 of 1
Back1Next

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close