Full chain Chrome 71.0.3578.98 exploithttps://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html
Exploits [CVE-2019-7582](https://nvd.nist.gov/vuln/detail/CVE-2019-5782) and [CVE-2019-13768/P0 issue 1755](https://bugs.chromium.org/p/project-zero/issues/detail?id=1755)
Targets [Chrome 71.0.3578.98](https://web.archive.org/web/20190802133545/http://r2---sn-a5mlrn7k.gvt1.com/edgedl/release2/chrome/AO196ErPGQUF_71.0.3578.98/71.0.3578.98_chrome_installer.exe?mip=207.241.225.236&mvi=1&pl=20&shardbypass=yes&redirect_counter=1&cm2rm=sn-n4ved7z&req_id=c8354c1c8c157341&cms_redirect=yes&mm=34&mn=sn-a5mlrn7k&ms=ltu&mt=1564752822&mv=m)
Needed to update the [original PoC](https://bugs.chromium.org/p/project-zero/issues/detail?id=1755#c3) to work on Windows 10 1909+.
Also needed to increase reliability on a particular target machine where the original PoC had ~0% reliability (but had ~100% on another target)
# Install Dependencies
```
wget https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
python2 get-pip.py
pip2 install cherrypy
```
# Run
`python2 server.py`
# PoC changes:
Replacement of the freed object was not happening so increased the number of allocated 0x140 sized blocks from 0x88 to 0x8000.
Allocation of page at 0x40404040000 was not happening so increased the number of allocated pages from 0xc88 to 2*0xc88
The ROP gadget `mov rcx, rax ; mov rax, rcx ; add rsp, 28h ; ret` is no longer present in ntdll.dll on Windows 1909. Instead the ROP gadgets `mov rcx, rax ; test rcx, rcx ; setne al ; ret` and `mov rax, rcx ; add rsp, 0x28 ; ret` in shell32.dll are used.
`pipe.producer.close()` was causing the sprayed 0x140 sized blocks to be freed. Memory was getting cleaned up too quickly. So the function call was delayed until after the exploit completes.
Shellcode was changed so that an arbitrary command (upto shellcode length 0x200) can be used. To edit the shellcode either modify shellcode.asm and run `yasm -f bin -o shellcode.bin shellcode.asm` or hexedit the commandline string into shellcode.bin. Current payload command is `calc`
[4.0K] /data/pocs/4cbcd55c84a60df9b79d52ed665dd4bf93f31714
├── [2.0K] copy_needed_bindings.py
├── [1.6K] index.html
├── [2.0K] README.md
├── [1.4K] server.py
└── [4.0K] win_71.0.3578.98
├── [4.0K] components
│ └── [4.0K] services
│ └── [4.0K] filesystem
│ └── [4.0K] public
│ └── [4.0K] interfaces
│ └── [ 12K] types.mojom.js
├── [2.3K] enable_mojo.js
├── [ 17K] file_writer.js
├── [9.4K] many_args.js
├── [4.0K] mojo
│ └── [4.0K] public
│ ├── [4.0K] js
│ │ └── [166K] mojo_bindings.js
│ └── [4.0K] mojom
│ └── [4.0K] base
│ ├── [8.8K] big_buffer.mojom.js
│ ├── [1.7K] file_error.mojom.js
│ ├── [5.4K] file_info.mojom.js
│ ├── [3.2K] file.mojom.js
│ ├── [2.7K] file_path.mojom.js
│ ├── [5.5K] string16.mojom.js
│ ├── [6.4K] time.mojom.js
│ └── [2.9K] unguessable_token.mojom.js
├── [5.9K] pe64.js
├── [4.0K] services
│ └── [4.0K] network
│ └── [4.0K] public
│ └── [4.0K] mojom
│ ├── [ 15K] data_pipe_getter.mojom.js
│ ├── [6.3K] http_request_headers.mojom.js
│ ├── [3.2K] mutable_network_traffic_annotation_tag.mojom.js
│ ├── [ 19K] network_param.mojom.js
│ ├── [ 16K] url_loader_factory.mojom.js
│ └── [ 72K] url_loader.mojom.js
├── [ 460] shellcode.asm
├── [ 100] shellcode.bin
├── [4.0K] third_party
│ └── [4.0K] blink
│ └── [4.0K] public
│ └── [4.0K] mojom
│ ├── [4.0K] blob
│ │ ├── [ 45K] blob.mojom.js
│ │ ├── [ 44K] blob_registry.mojom.js
│ │ ├── [ 46K] blob_url_store.mojom.js
│ │ ├── [ 46K] data_element.mojom.js
│ │ └── [4.6K] serialized_blob.mojom.js
│ └── [4.0K] filesystem
│ ├── [215K] file_system.mojom.js
│ └── [ 27K] file_writer.mojom.js
├── [2.0K] trigger.js
├── [3.2K] trigger_replace.js
└── [4.0K] url
└── [4.0K] mojom
├── [4.6K] origin.mojom.js
└── [2.6K] url.mojom.js
23 directories, 37 files