Author: Kenny P.B.

1. Contents

• Many Heap Overflow Bugs Can Be Exploited in a Similar Way
• PoC of the V8 Heap Overflow Vulnerability – *CTF 2019 oob-v8
• Exploitation Idea
• Actual Exploitation Steps of the V8 Heap Overflow Bug
  • V8 Environment Setup
  • Auxiliary Type Conversion Functions
  • Prepare Objects in Memory
  • Leak Addresses and Fake Objects
  • Arbitrary Reads and Writes
  • RWX Page and Shellcode Injection
• Summary

2. Many Heap Overflow Bugs Can Be Exploited in a Similar Way

I have introduced a v8 heap overflow bug before: V8 Array Overflow Exploitation: 2019 KCTF Problem 5 小虎还乡 – Pwn By Kenny. This is another one: *CTF 2019 oob-v8. The interesting things I’m going to show you in this post are: 1) This bug only allows you to read or overwrite specific 8 bytes. But you can use it to achieve arbitrary reads and writes. 2) This is a different heap overflow bug. But you can exploit it in a very similar way to the 2019 KCTF Problem 5. In fact, many heap overflow bugs can all be exploited in such a similar way. To show you this, I will use the same headings as the 2019 KCTF Problem 5 post. Feel free to compare the two posts!

3. PoC of the V8 Heap Overflow Vulnerability – *CTF 2019 oob-v8

PoC code is what triggers a bug. For this *CTF 2019 oob-v8 bug, we are able to read out-of-bounds with “JSArray.oob();”, and write out-of-bounds with “JSArray.oob(value);”. JSArray is a v8 object used to represent an array. For example, if you write code like “var arr = [1.1];”, you will have a JSArray object in the memory. And “arr.oob();” allows you to read the next 8 bytes beyond the array’s element area. “arr.oob(2.2);” allows you to overwrite the 8 bytes with 2.2. For more information about JSArray, please visit V8 Objects and Their Structures – Pwn By Kenny