csw2017 qidan he+gengming liu_cansecwest2017
TRANSCRIPT
![Page 1: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/1.jpg)
Pwning theNexus ™ ofEveryPixel ™
Qidan HeGengming Liu
CanSecWest 2017Vancouver
![Page 2: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/2.jpg)
#whoami
• Qidan He• Apple/Android/ChromeCVEhunter(dozensofcreditsgot)• SpeakeratBlackHat USA/ASIA,DEFCON,RECON,CanSecWest,HITCON• Pwn2Own2016/MobilePwn2Own2016winner
• Gengming Liu• CTFenthusiastic,DEFCONCTFfinalplayer• CaptainofAAACTFteam• MobilePwn2Own2016winner• ToobusyoccupiedinPwn2OwntotalkL
![Page 3: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/3.jpg)
AboutTencent KeenSecurityLab
• Previously known as KeenTeam•Won iOS 7 category in MobilePwn2Own 2013•Won Nexus 6p/iOS 10.1 and got“Master of Pwn” in MobilePwn2Own 2016
![Page 4: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/4.jpg)
TL;DR:HowwepwnednewestNexus6P/PixelrunningNougat• Threebugsformsacompleteexploitchain• OneV8bugtocompromisetherenderer• OneIPCbugtoescapesandbox• Onebugingappsallowsappinstall
• Googleresponseveryquickly• V8andIPCbugfixedinmidnightof10.26(CVE-2016-5197andCVE-2016-5198)• Gappupdatepushedin10.27(GoogleVRPcredit)
• Alsoaffectsallappsusingwebview/chromium
![Page 5: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/5.jpg)
Agenda• IntroductionandExploitationofV8engine• IntroductionandExploitationofsandboxonAndroid•HowwepwnedNexus/PixelonMobilePwn2Own2016with3bugs• CVE-2016-5197/5198/GoogleVRP bug
![Page 6: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/6.jpg)
HistoryofclassicalChromeexploits
• MWRLabs,Pwn2Own2013• Type-confusioninwebkit• ArbitraryzerowriteinIPC::OnContentBlocked
• PinkiePie,MobilePwn2Own2013• Runtime_TypedArrayInitializeFromArrayLike forrenderercodeexecution• ArbitraryfreeinClipboardHostMsg_WriteObjectsAsync
• Geohot inPwnium 4• PropertyredefinitionleadtoOOBread/writeinrenderer• SpoofIPCMessagetovulnerableextensioninprivilegeddomain
• Lokihart inPwn2Own2015• TOCTOUinGPUprocesssharedmemory
• Juri InPwn2Own2015• UAFinP2PSocketDispatcherHost
![Page 7: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/7.jpg)
V8Javascript Engine
• Widelyknownandused• RuntimeoptimizationandJITtomachinecode• Strongtalk• Crankshaft• Turbofan
![Page 8: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/8.jpg)
ObjectstructureinV8
![Page 9: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/9.jpg)
0x2036cb90a089:[JSArrayBuffer]- map=0xebbd6702db1[FastProperties]- prototype=0x32cfe5005599- elements=0x1b6415782241<FixedArray[0]>[FAST_HOLEY_SMI_ELEMENTS]- internalfields:2- backing_store=0x5652757bea60- byte_length=24929- properties={}- internalfields={00}
vara=newArrayBuffer(0x6161)
![Page 10: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/10.jpg)
0x2036cb90a089:[JSArrayBuffer]- map=0xebbd6702db1[FastProperties]- prototype=0x32cfe5005599- elements=0x1b6415782241<FixedArray[0]>[FAST_HOLEY_SMI_ELEMENTS]- internalfields:2- backing_store=0x5652757bea60- byte_length=24929- properties={}- internalfields={00}
vara=newArrayBuffer(0x6161)
gdb-peda$x/30xg0x00002036cb90a0880x2036cb90a088:0x00000ebbd6702db10x00001b64157822410x2036cb90a098:0x00001b64157822410x00006161000000000x2036cb90a0a8:0x00005652757bea600x0000000000000004
![Page 11: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/11.jpg)
BoxinginV8
• Float&Double encapsulatedinV8heap• HeapNumber object• vmovsd QWORDPTR[rax+0x7],xmm0
• SMI• Taggedpointer
![Page 12: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/12.jpg)
Casestudy:CVE-2016-1646
• V8Array.concat redefinitionout-of-boundsinPwn2Own2016• ReportedbyWenXufromKeenLab
![Page 13: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/13.jpg)
Casestudy:CVE-2016-1646
![Page 14: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/14.jpg)
CVE-2016-5197– ChainofBugs#1
• FoundbyKeenLab andusedforMobilePwn2Own2016• AffectsallenginesbasedonV8andapplicationswithWebview
![Page 15: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/15.jpg)
Howweexploited CVE-2016-5198
![Page 16: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/16.jpg)
CVE-2016-5198ByKeenLab
![Page 17: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/17.jpg)
CVE-2016-5197
![Page 18: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/18.jpg)
HowyourJITsucks
• JITcompileswithtype-infoinmind• Accesscodegeneratedaccordingly• Whatifobjecttypechanged?• Deoptimize andregenerate
• But… therewillbemistakes• WhatifJITed accessonglobals?
![Page 19: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/19.jpg)
function Ctor() {n = new Set();}function Check() {n.xyz = 0x826852f4;parseInt('AAAAAAAA');}for(var i=0; i<2000; ++i) {Ctor();}for(var i=0; i<2000; ++i) {Check();}Ctor();Check();print("finish");
var n;function Ctor() {n=new Set();}function Check() {n.xyz =0x826852f4;}Ctor();Ctor();%OptimizeFunctionOnNextCall(Ctor);Ctor();Check();Check();%OptimizeFunctionOnNextCall(Check);Check();Ctor();Check();parseInt('AAAAAAAA')
![Page 20: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/20.jpg)
![Page 21: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/21.jpg)
OOBinOptimizedJITcode
![Page 22: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/22.jpg)
OOBinOptimizedJITcode
![Page 23: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/23.jpg)
OptimizedcodeforCtor
![Page 24: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/24.jpg)
Non-optimizedcodeforfunc`Check`
![Page 25: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/25.jpg)
Optimized
![Page 26: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/26.jpg)
Optimized
![Page 27: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/27.jpg)
0x3f9385872433548b8c1bf4a339d070000REX.Wmovq rax,0x79d334abfc1;;object:0x79d334abfc1PropertyCell for0x130199d54631<aSetwithmap0x1ffdd430c391>
0x3f93858724d45488b400fREX.Wmovq rax,[rax+0xf]
![Page 28: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/28.jpg)
Optimized
![Page 29: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/29.jpg)
0x3f9385872514949ba0000805e0a4de041REX.Wmovq r10,0x41e04d0a5e8000000x3f93858725b59c4c1f96ec2vmovq xmm0,r100x3f93858726064488b4007REX.Wmovq rax,[rax+0x7]0x3f93858726468488b400fREX.Wmovq rax,[rax+0xf]0x3f93858726872c5fb114007vmovsd [rax+0x7],xmm0
![Page 30: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/30.jpg)
Heapnumberoverwrite
![Page 31: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/31.jpg)
Normally…
• Optimizedcodeassumestheobjectalreadyhaveproperty
![Page 32: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/32.jpg)
Map value
PROP_CELL_MAP0x2ab4ce002a99
Map Properties
elements
PropertyCell n: 0x79d334abfc1
JSSet: 0x130199d5c511
tables
JS_SET_TYPE_MAP
mov rax,QWORD PTR [rax+0xf]
mov rax,QWORD PTR [rax+0x7]
0x41414141
mov rax,QWORD PTR [rax+0xf]
Map length:1
Non-empty FixedArray
Property1 …
Javascript: n.xyz = 0x41414141
![Page 33: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/33.jpg)
However…
• Whatiftheobjectischangedanditdoesn’thavepropertynow?
![Page 34: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/34.jpg)
Map value
PROP_CELL_MAP0x2ab4ce002a99
Map Properties
elements
PropertyCell n: 0x79d334abfc1
JSSet: 0x130199d5c511
tables
JS_SET_TYPE_MAP
Map length:0
Empty FixedArray
Map Hashcode
Null string
length Chars
mov rax,QWORD PTR [rax+0xf]
mov rax,QWORD PTR [rax+0x7]
0x41414141
mov rax,QWORD PTR [rax+0xf]
OUT OF BOUNDS HERE!
Map length:1
Non-empty FixedArray
Property1 Property
![Page 35: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/35.jpg)
Out-of-boundtonullstring
• Overwritingfieldsofnullstring• Withheapnumber overwritewecandoanindirectwrite
![Page 36: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/36.jpg)
Map value
PROP_CELL_MAP0x2ab4ce002a99
Map Properties
elements
PropertyCell n: 0x79d334abfc1
JSSet: 0x130199d5c511
tables
JS_SET_TYPE_MAP
Map length:0
Empty FixedArray
Map length:1
Non-empty FixedArray
Property1
Map Hashcode
Null string
length Chars0x4141414141..
mov rax,QWORD PTR [rax+0xf]
mov rax,QWORD PTR [rax+0x7]
0x826852f4
mov rax,QWORD PTR [rax+0xf]
OUT OF BOUNDS HERE!
Map …type
Map for ONE_BYTE_INTERNALIZED_STRING_TYPE
…
vmovsd QWORD PTR [rax+0x7],xmm0
0x41e04d0a5e800000
Confused to EXTERNAL_STRING
Chars interpreted as Pointer
Property
![Page 37: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/37.jpg)
ExploitationSteps
• OOBwritecharsfieldofnullstringtoleakArrayBufferaddress• OverwriteArrayBufferbacking_store toleakFunctioncodeaddress• OverwriteArrayBufferbacking_store withFunctioncodeaddress• WriteshellcodetoArrayBufferandexec!
![Page 38: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/38.jpg)
Primitives
• Writeprimitive:• HeapNumber write• *(p+8)=v
• Readprimitive• ArrayBuffer lengthisourfriend• Butfirst… leakanArrayBuffer address
• Use#nullstringtocoldstart!
StructureofONE_BYTE_INTERNALIZED_STRINGpwndbg>job0x28b4ff7ab259#fuckpwndbg>x/40xg0x28b4ff7ab2580x28b4ff7ab258: 0x0000090b4b182361 0x000000005887594a0x28b4ff7ab268: 0x0000000400000000 0xdeadbeed6b637566
![Page 39: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/39.jpg)
#nullstringascoldstart– Run#1
• OOBwritenullstringlength• OOBwritecharsfield• m.d =ab(newArrayBuffer)• newString(null)
• charCodeAt foreachbyte• ArrayBuffer and#nullstringaddressleaked!
• Gotsomethingtowriteat…• Butstill,howtoturnsequentialwriteintoarbitraryaddresswrite?
![Page 40: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/40.jpg)
#nullstringascoldstart– Run#2
• Writeaddressof#nullitselftoitsfield!• m.d =null_str
• PerformHeapNumber overwriteinnextoptimizationrun• m.d =unpackIEEE754(ab_len_ptr)
![Page 41: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/41.jpg)
PlaywithFunction– Run#3
• AllocateFunctionatbegining• ab_storage_ptr =ab_len_ptr +8• m.b =unpackIEEE754(addr_of_code - 8)
• HeapNumber overwrite*ab_storage_ptr =code_loc – 8• Code_ptr =ab[3]<<32+ab[2]
![Page 42: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/42.jpg)
PlaywithFunction- Run##
• m.b =unpackIEEE754(code_ptr)• *ab_storage_ptr =code_ptr• Writeshellcodewithabaccess• CallFunction• Gameover!J
![Page 43: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/43.jpg)
Sorenderercodeexecutiongot…
• Nowwhat?
![Page 44: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/44.jpg)
Theanatomy ofChromesandbox
• AlluntrustedcoderunsinTargetprocess• RelaymostoperationstoBroker• Trybestto• lockdownthecapabilitiesofrenderer
• Evenrendereriscompromised• Accessisstillstrictlyprohibited
• GPUprocesshavehigherlevelaccess• Thannormalsandboxprocess
![Page 45: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/45.jpg)
![Page 46: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/46.jpg)
Thenewcomer:GPUprocess
![Page 47: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/47.jpg)
EvolutionoftheAndroidSandbox(oldtime)
![Page 48: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/48.jpg)
EvolutionoftheAndroidSandbox(currentstate)
![Page 49: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/49.jpg)
Untrusted_app
ProcessprivilegesinAndroid
Isolated_app
media
radio
System_server
KernelAdb shell
![Page 50: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/50.jpg)
State-of-artdefenseofAndroidsandbox
• DACintroducedbynatureofLinux• IsolatedProcess introducedinJellyBean• SELinux enforcedinKitKat• Furtherrestrictedinsubsequentrelease
![Page 51: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/51.jpg)
ChromiumAndroidSandbox(cont.)
• OnAndroid,ChromiumleveragestheisolatedProcess featuretoimplementitssandbox.
![Page 52: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/52.jpg)
ChromiumAndroidSandbox(cont.)
• IsolatedprocesswasintroducedaroundAndroid4.1• "Ifsettotrue,thisservicewillrununderaspecialprocessthatisisolatedfromtherestofthesystemandhasnopermissionsofitsown.”• Chromiumrenderprocess
![Page 53: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/53.jpg)
ChromiumAndroidSandbox(cont.)
• Inherits• App.te• Domain.te• Domain_deprecated.te
![Page 54: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/54.jpg)
ChromiumAndroidSandbox(cont.)
• Neverallow triggerscompile-timeerrorsifdisobeyed
![Page 55: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/55.jpg)
Per interface constraint• Activity,display,webview_update canbeaccessed,but• Only interfaces without enforceNotIsolatedCaller can be invoked
![Page 56: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/56.jpg)
Possiblewaysforescapingthechromesandbox
•ExploitingChromeIPC(!theold-fashionedway)•ExploitingbasicBinderclasses• Libutils/libcutils• Serialization
•ExploitingKernel
![Page 57: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/57.jpg)
Possiblewaysforescapingthechromesandbox
•ExploitingChromeIPC(!theold-fashionedway)•ExploitingbasicBinderclasses• Libutils/libcutils• Serialization
•ExploitingKernel
![Page 58: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/58.jpg)
Exploitingbinderobjecttransaction/lib*utils
• CVE-2014-7911• Lackofserializable validationinObjectInputStream• Supplynativefieldsviade-serialization
• CVE-2015-1528• LackoftransientfieldinX509Certificateclassdefinition
• CVE-2015-3875• SharedBuffer integeroverflow• VectorImpl::setCapacity
• Complexobjectsinbundleareautomaticallyunboxedwhentouched
![Page 59: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/59.jpg)
So… HowdoweescapethesandboxinMobilePwn2Own2016?ChainofBugs#2
![Page 60: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/60.jpg)
void RenderViewImpl::LaunchAndroidContentIntent(const GURL&intent,size_t request_id,bool is_main_frame){if (request_id !=expected_content_intent_id_)return;
//Removethecontenthighlightingifany.ScheduleComposite();
if (!intent.is_empty()){base::RecordAction(base::UserMetricsAction("Android.ContentDetectorActivated"));Send(newViewHostMsg_StartContentIntent(GetRoutingID(),intent,is_main_frame));}}//src/content/renderer/renderer_view_impl.cc
![Page 61: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/61.jpg)
bool RenderWidgetHostViewAndroid::OnMessageReceived(const IPC::Message&message){if (IPC_MESSAGE_ID_CLASS(message.type())==SyncCompositorMsgStart){return SyncCompositorOnMessageReceived(message);}bool handled=true;IPC_BEGIN_MESSAGE_MAP(RenderWidgetHostViewAndroid,message)IPC_MESSAGE_HANDLER(ViewHostMsg_StartContentIntent,OnStartContentIntent)IPC_MESSAGE_HANDLER(ViewHostMsg_SmartClipDataExtracted,OnSmartClipDataExtracted)IPC_MESSAGE_HANDLER(ViewHostMsg_ShowUnhandledTapUIIfNeeded,OnShowUnhandledTapUIIfNeeded)IPC_MESSAGE_UNHANDLED(handled=false)IPC_END_MESSAGE_MAP()return handled;}
![Page 62: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/62.jpg)
void RenderWidgetHostViewAndroid::OnStartContentIntent(const GURL&content_url,boolis_main_frame){if (content_view_core_)content_view_core_->StartContentIntent(content_url,is_main_frame);}
//...
src/content/browser/android/content_view_core_impl.cc //inrendererprocesscontext
void ContentViewCoreImpl::StartContentIntent(const GURL&content_url,boolis_main_frame){JNIEnv*env =AttachCurrentThread();ScopedJavaLocalRef<jobject>j_obj =java_ref_.get(env);if (j_obj.is_null())return;ScopedJavaLocalRef<jstring>jcontent_url =ConvertUTF8ToJavaString(env,content_url.spec());Java_ContentViewCore_startContentIntent(env,j_obj,jcontent_url,is_main_frame);}
![Page 63: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/63.jpg)
CVE-2016-5197Arbitraryintentstartinrenderer
![Page 64: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/64.jpg)
Webviewinappisnotisolated
• Webview stillrunsinthesameuid/processasordinaryapp• Withthearbitraryactivitystartability• Findsomeappwhichacceptscontrolled-URLtoattack!
![Page 65: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/65.jpg)
MobilePwn2OwnChainofBugs#3
• SeethatholyGoogleDrive• HavefullaccesstoGoogleaccount• TrustedbyGooglePlay• To“install”app
• Blindlyopensanyintent-controlledURL• Pwn ittojumpfromisolatedtountrusted• PlusAppinstallationability!
![Page 66: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/66.jpg)
• Installarbitrarycustomapp• GotAllpermissions• GoogleVRPcredit
![Page 67: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/67.jpg)
Chainitalltogether
• UseCVE-2016-5198togaincontrolofrendererinChromebrowser• Note:chromecurrentlyis32bit
• SearchforIPCobjects,issueViewHostMsg_StartContentIntentrequest• JumptoGoogleDrive,openEXPpageagain• Note:GoogleDriveisa64bitappsoitswebview isalso64bit
• Gotashellinuntrusted_app contextfromGoogleDrive• Reloadplay.google.com,uploadcookies.db inappdatadirectory• Sendinstallapprequest,waitforBOOM
![Page 68: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/68.jpg)
DEMO
![Page 69: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/69.jpg)
Acknowledgements
• GengmingLiu• LiangChen• Wushi
![Page 70: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/70.jpg)
Questions?
![Page 71: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/71.jpg)
![Page 72: CSW2017 Qidan he+Gengming liu_cansecwest2017](https://reader035.vdocuments.us/reader035/viewer/2022081723/58d0e94c1a28abba558b5993/html5/thumbnails/72.jpg)
KeyfeaturesofV8
• Fastpropertyaccess• Dynamicmachinecodegeneration