RCE exploit for the latest Safari

综合技术 2018-12-07 阅读原文

PLEASE READ THIS FIRST

This is currently only patched in the WebKit sources and works with the latest version of Safari (macOS and iOS, although this needs to be updated in order to work with iOS).

Please don't do evil stuff with this.

And if you're a normal user, this will be useless for you.

WebKit-RegEx-Exploit

This is an exploit for the latest version of Safari (as of Dec. 6 2018). Fixed in the current WebKit release, therefore I decided to make this public.

Huge thanks to Samuel Groß (@5aelo) for his awesome Int64 library.

You need to have a WebSocket Server running at Port 5000 or you get "Initialization failed".

Building

If you want to rebuild stage2, cd into stage2 then run python make.py.

For building you need to have gobjcopy installed. (brew install binutils)

The Bug

This is an optimization error in the way RegEx matching is handled. By setting lastIndex on a RegEx object to a JavaScript object which has the function toString defined, you can run code although the JIT thinks that RegEx matching is side effect free.

Exploitation is pretty similar to @5aelo's exploit for CVE-2018-4233, which can be found here
.

TODO

Clean up the code a bit, add some comments and do a proper writeup. Maybe even add iOS support? Feel free to create a PR if you want to help me.

Github

责编内容by:Github阅读原文】。感谢您的支持!

您可能感兴趣的

前端文件下载兼容方案(兼容主流浏览器,包括IE与Safari)... 之前处理文件下载功能一直使用的是window.open(URL)的方式。这样当然也是可以实现文件下载功能的,而且使用起来还很方便。 但是有一次测试发现这个方法在Safari浏览器中并不能正常下载,于是我又开始寻找兼容性更好的下载功能实现...
蘋果和 Google 溫馨相擁~推出最新技術預覽版,以後用 Safari 也可以視訊了!... 【我們為什麼挑選這篇文章】 蘋果跟 Google 的合作,造福的就是我們啊哈哈哈,以後 iPhone 使用者也可以用 Safari 視訊了欸,只是這樣以後會不會一直被老闆追殺開會? (責任編輯:謝秉芸) 提起開源...
Advanced CORS Exploitation Techniques Preface I’ve seen some fantastic research done by Linus Särud and by Bo0oM on how Safari’s handling of spec...
蒙皮再更新 徕卡推出Leica Q Safari限量款... 徕卡在出推出旗下相机的限量款,这次的限量款是Leica Q。徕卡正式发布限量款机型Leica Q Safari。这款新限量款的Q最主要的变化是更换了机身蒙皮,相机采用了军绿色的机身蒙皮和银色金属机身的搭配。新机限量推出50台,且仅在日本销售...
iOS 11 Tips: Using Drag and Drop in Safari to Open... A few weeks ago, I wrote a Tips and Tricks article on how to open and use Safari Split View windows. It’s a ver...