This was originally published at http://stackoverflow.com/questions/41246721/javascript-warning-i-created-dangerous-troyan-keylogger-in-javascript-vulnerab . It was removed, but I pulled this from the Google search cache.

Posted by "lucyheartfilia"

-----------------------------------------

I downloaded v8 source code and I studied it a lot. After more than two months of trying, I finally found a hole in it. I succeeded to execute assembly code directly in Chrome's memory using pure JavaScript. I could use it to hack someone, but no, I decided to tell everyone, so it Google can fix it as soon as possible.

Ok, this is how my code works. Based on concepts on how v8 works, I came with the following idea, which actually turned to be true and it works pretty well. My script is based on the following steps:

1. Create a new function using Function constructor and put assembly code in a string somewhere in function's body.
2. Use some clever reference manipulation to dereference a function from its variable.
3. Create a closure, but force dereferenced function to stay pointing to deleted object.
4. Exploit v8 engine's garbage collection. Use clever mechanisms to keep a callable reference of non-existing function.
5. Replace function with a buffer and call it (it will be threated like a function).

Lets explain it briefly. Firstly, we create a simple function with eval in it, and we must return a function from it (create a closure) like this:

const main = (a => {
  return b => a(b);
})(eval);

So, now we can manipulate this closure anyway we want, because we can execute whatever we want in it. We also need a buffer (in browser you can use UInt8Array or ArrayBuffer or whatever you want, but you should be able to put arbitrary order of consecutive bytes in it). Lets create an empty buffer:

const buff = fs.readFileSync('test.o');

Here test.o is just compiled assembly code (i.e. using nasm). In browser, you can obtain file content in many ways, for example using XMLHttpRequest. Now we need to execute Clever Dereference script [[[ This is a link to https://wsdwa1022.github.io/clever-dereference.min.js which is now dead. -- Avi]]] I made based on disadvantages of v8 which actually allow us to free memory region of any function or object, but KEEPING its reference (we can still call a function or access object's properties). The problem is because if we execute anything after it, theoretically something may be written to that memory location, because it is now FREE. So, we MUST execute function immediatelly after it. But firstly, we need to change it's content. This is how you call it:

const func = Function('return "' + '\x90'.repeat(0x400) + '"');

CleverDereference.remove(main, func, 8, 0x400);
CleverDereference.assign(buff, 0, 0x400);

Ok, let me explain what we did here. Firstly, we create a new function using Function constructor which returns string containing only bytes of char code 0x90 (this is 8086 nop code which does nothing). So, somewhere in memory we have 1KB space for our assembly program. Now call my function which forces v8 to free this memory region. Here 8 is offset (because of return ") and 0x400 is the actual length.

After that using my another function we switch references. Now, we made buff (which is a Buffer instance) callable. Now, we can call it like this buff(). The thread will immediatelly jump to its memory location and start executin our code. What a huge vulnerability issue.

Now, let me show you how it actually works. I've created a simple hello world assembly program in nasm and compiled it to an object file.

; Push these two, because Chrome uses it for data tracing
push eax
push ebx

; Call some procedures to prevent Chrome from killing this thread
xor edx, eax
add edx, ebx
xor ebx, ecx
call dword [edx]
mov edx, ebx
inc edx
call dword [edx]

; Import message box function from `user32.dll` (or reuse imported)
xor eax, eax
push eax
push ecx
call dword [edx]
push ebx
call dword [edx]

; Pop important values back, so Chrome will know we are done
pop ebx
pop eax

Now lets test it. I did it in browser just to mention how vulnerable it is, but it can be also done in Node.js. This is how it looks when executed: you can see HERE. [[[ https://i.imgur.com/S14kUMS.png ; I am attaching in case it comes down. -- Avi]]]

You can see random characters, but it is because I tried to show here minimal assembly code. We could pass some arguments when calling MessageBoxA, but we just called it with whatever was on stack at that time, that is why scrambled text.

Imagine what attackers can do with this. Anyone can clickbait you to website where this script will be executed. They can create new thread in your Chrome which will trace all data and all sites you visit and sent to attackers. This should be fixed asap.
 

Deleted: S14kUMS.png 67.7 KB

	S14kUMS.png 67.7 KB View Download