Bruce Chen bruce30262

IERAE CTF 2024 - Intel CET Bypass Challenge

IERAE CTF had one of the coolest pwn challenges I've done in the while. It was written by hugeh0ge.

Here's the full source:

// gcc chal.c -fno-stack-protector -static -o chal
#include <stdio.h>
#include

test.js

var arr = new Array(1.1, 2.2, 3.3);
function test(obj) {
    arr[0] = obj;
}
test({});

Print bytecode of test function:

Some quick notes about the CVE-2023-3079(V8 type confusion), no PoC yet.

Official patch: https://chromium-review.googlesource.com/c/v8/v8/+/4584248

Patch come from KeyedStoreIC::StoreElementHandler(), it returns fast path code(Turbofan builtin) for keyed store depends on "receiver_map" and "store_mode". Based on the content of this function is all about element STORE, I personally believe that this is an OOB writes vulnerability.

If we divide the PoC exploration into two parts based on this func, they are:

Chat GPT "DAN" (and other "Jailbreaks")

yoyoyoyo

reading v8

todo / summary

editor setup
- compilation database
- vscode debugger
  - debug cctest
  - debug mjsunit
testing

IDAPython CTREE

Important links

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

	import re, subprocess, idaapi, ida_segment, ida_kernwin

	# To install this, simply put it in your ida_install/loaders folder and open
	# a `/proc/<pid>/mem` file!
	#
	# You might need to set `echo 0 > /proc/sys/kernel/yama/ptrace_scope` if you
	# want to be able to dump processes depending on your system configuration.

	# Check if the file is supported by our loader
	def accept_file(li, filename):

	import * as module from "1.mjs";

	/*
	=> 1.mjs
	export let x = {};
	export let y = {};
	export let z = {};
	*/

	var f64 = new Float64Array(1);

	use std::str;

	fn main() {
	// -- FROM: vec of chars --
	let src1: Vec<char> = vec!['j','{','"','i','m','m','y','"','}'];
	// to String
	let string1: String = src1.iter().collect::<String>();
	// to str
	let str1: &str = &src1.iter().collect::<String>();
	// to vec of byte