Skip to content

Commit bbc1007

Browse files
sroettgersroettger
committed
[2020-quals] add missing attachments
1 parent 173c61e commit bbc1007

File tree

4 files changed

+286
-0
lines changed

4 files changed

+286
-0
lines changed

‎2020/quals/sandbox-teleport/attachments/chal.patch

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
commit c1f358459e33cb2f80d63df93950153612265330
2+
Author: Stephen Roettger <[email protected]>
3+
Date: Tue Apr 21 18:12:00 2020 +0200
4+
5+
chrome challenge
6+
7+
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
8+
index 60236ef92a42..8bc8fbddc347 100644
9+
--- a/content/browser/BUILD.gn
10+
+++ b/content/browser/BUILD.gn
11+
@@ -1341,6 +1341,8 @@ jumbo_source_set("browser") {
12+
"push_messaging/push_messaging_manager.h",
13+
"push_messaging/push_messaging_router.cc",
14+
"push_messaging/push_messaging_router.h",
15+
+ "pwn.cc",
16+
+ "pwn.h",
17+
"quota/quota_context.cc",
18+
"quota/quota_context.h",
19+
"quota/quota_manager_host.cc",
20+
diff --git a/content/browser/pwn.cc b/content/browser/pwn.cc
21+
new file mode 100644
22+
index 000000000000..ff2fb044c740
23+
--- /dev/null
24+
+++ b/content/browser/pwn.cc
25+
@@ -0,0 +1,26 @@
26+
+#include "content/browser/pwn.h"
27+
+
28+
+#include "content/common/pwn.mojom.h"
29+
+#include "mojo/public/cpp/bindings/pending_receiver.h"
30+
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
31+
+
32+
+namespace content {
33+
+
34+
+Pwn::Pwn() = default;
35+
+
36+
+Pwn::~Pwn() = default;
37+
+
38+
+// static
39+
+void Pwn::Create(mojo::PendingReceiver<mojom::Pwn> receiver) {
40+
+ mojo::MakeSelfOwnedReceiver(std::make_unique<Pwn>(), std::move(receiver));
41+
+}
42+
+
43+
+void Pwn::This(ThisCallback callback) {
44+
+ std::move(callback).Run((uint64_t) this);
45+
+}
46+
+
47+
+void Pwn::PtrAt(uint64_t addr, PtrAtCallback callback) {
48+
+ std::move(callback).Run(*(uint64_t*) addr);
49+
+}
50+
+
51+
+} // namespace content
52+
diff --git a/content/browser/pwn.h b/content/browser/pwn.h
53+
new file mode 100644
54+
index 000000000000..3d9c6600054a
55+
--- /dev/null
56+
+++ b/content/browser/pwn.h
57+
@@ -0,0 +1,26 @@
58+
+#ifndef CONTENT_BROWSER_PWN_H_
59+
+#define CONTENT_BROWSER_PWN_H_
60+
+
61+
+#include "content/common/pwn.mojom.h"
62+
+#include "mojo/public/cpp/bindings/pending_receiver.h"
63+
+
64+
+namespace content {
65+
+
66+
+class Pwn : public mojom::Pwn {
67+
+ public:
68+
+ Pwn();
69+
+ ~Pwn() override;
70+
+
71+
+ static void Create(mojo::PendingReceiver<mojom::Pwn> receiver);
72+
+
73+
+ private:
74+
+ void This(ThisCallback callback) override;
75+
+ void PtrAt(uint64_t addr, PtrAtCallback callback) override;
76+
+
77+
+ DISALLOW_COPY_AND_ASSIGN(Pwn);
78+
+};
79+
+
80+
+} // namespace content
81+
+
82+
+#endif // CONTENT_BROWSER_PWN_H_
83+
+
84+
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
85+
index 40ef859ab146..3e023cbfde3b 100644
86+
--- a/content/browser/renderer_host/render_process_host_impl.cc
87+
+++ b/content/browser/renderer_host/render_process_host_impl.cc
88+
@@ -116,6 +116,7 @@
89+
#include "content/browser/permissions/permission_service_context.h"
90+
#include "content/browser/permissions/permission_service_impl.h"
91+
#include "content/browser/push_messaging/push_messaging_manager.h"
92+
+#include "content/browser/pwn.h"
93+
#include "content/browser/quota/quota_context.h"
94+
#include "content/browser/renderer_host/agent_metrics_collector.h"
95+
#include "content/browser/renderer_host/code_cache_host_impl.h"
96+
@@ -2461,6 +2462,8 @@ void RenderProcessHostImpl::RegisterMojoInterfaces() {
97+
base::BindRepeating(&RenderProcessHostImpl::BindAecDumpManager,
98+
weak_factory_.GetWeakPtr()));
99+
100+
+ registry->AddInterface(base::BindRepeating(&Pwn::Create));
101+
+
102+
// ---- Please do not register interfaces below this line ------
103+
//
104+
// This call should be done after registering all interfaces above, so that
105+
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
106+
index d04b5570b580..7d7687aae18a 100644
107+
--- a/content/common/BUILD.gn
108+
+++ b/content/common/BUILD.gn
109+
@@ -460,6 +460,7 @@ mojom("mojo_bindings") {
110+
"navigation_params.mojom",
111+
"page_state.mojom",
112+
"prefetched_signed_exchange_info.mojom",
113+
+ "pwn.mojom",
114+
"render_accessibility.mojom",
115+
"render_frame_metadata.mojom",
116+
"render_message_filter.mojom",
117+
diff --git a/content/common/pwn.mojom b/content/common/pwn.mojom
118+
new file mode 100644
119+
index 000000000000..a8b41f709514
120+
--- /dev/null
121+
+++ b/content/common/pwn.mojom
122+
@@ -0,0 +1,6 @@
123+
+module content.mojom;
124+
+
125+
+interface Pwn {
126+
+ This() => (uint64 val);
127+
+ PtrAt(uint64 addr) => (uint64 val);
128+
+};
129+
diff --git a/third_party/blink/renderer/core/mojo/mojo.cc b/third_party/blink/renderer/core/mojo/mojo.cc
130+
index 28de5f1938de..f8e5213faaa3 100644
131+
--- a/third_party/blink/renderer/core/mojo/mojo.cc
132+
+++ b/third_party/blink/renderer/core/mojo/mojo.cc
133+
@@ -113,4 +113,19 @@ void Mojo::bindInterface(ScriptState* script_state,
134+
.GetInterface(name, std::move(handle));
135+
}
136+
137+
+#include <sys/mman.h>
138+
+void Mojo::rce(DOMArrayBuffer* shellcode) {
139+
+ size_t sz = shellcode->ByteLengthAsSizeT();
140+
+ sz += 4096;
141+
+ sz &= ~(4096llu-1);
142+
+ void *mm = mmap(0, sz, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
143+
+ if (mm == MAP_FAILED) {
144+
+ LOG(ERROR) << "mmap failed: " << strerror(errno);
145+
+ return;
146+
+ }
147+
+ memcpy(mm, shellcode->Data(), shellcode->ByteLengthAsSizeT());
148+
+ void (*fn)(void) = (void (*)(void)) mm;
149+
+ fn();
150+
+}
151+
+
152+
} // namespace blink
153+
diff --git a/third_party/blink/renderer/core/mojo/mojo.h b/third_party/blink/renderer/core/mojo/mojo.h
154+
index a81831c93b0b..d799c4c78668 100644
155+
--- a/third_party/blink/renderer/core/mojo/mojo.h
156+
+++ b/third_party/blink/renderer/core/mojo/mojo.h
157+
@@ -6,6 +6,7 @@
158+
#define THIRD_PARTY_BLINK_RENDERER_CORE_MOJO_MOJO_H_
159+
160+
#include "mojo/public/cpp/system/core.h"
161+
+#include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h"
162+
#include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
163+
#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
164+
165+
@@ -55,6 +56,8 @@ class Mojo final : public ScriptWrappable {
166+
const String& interface_name,
167+
MojoHandle*,
168+
const String& scope);
169+
+
170+
+ static void rce(DOMArrayBuffer *shellcode);
171+
};
172+
173+
} // namespace blink
174+
diff --git a/third_party/blink/renderer/core/mojo/mojo.idl b/third_party/blink/renderer/core/mojo/mojo.idl
175+
index d407172039f4..eb8d80d433e7 100644
176+
--- a/third_party/blink/renderer/core/mojo/mojo.idl
177+
+++ b/third_party/blink/renderer/core/mojo/mojo.idl
178+
@@ -47,4 +47,6 @@ enum MojoScope {
179+
static MojoCreateSharedBufferResult createSharedBuffer(unsigned long numBytes);
180+
181+
[CallWith=ScriptState] static void bindInterface(DOMString interfaceName, MojoHandle request_handle, optional MojoScope scope = "context");
182+
+
183+
+ static void rce(ArrayBuffer shellcode);
184+
};

‎2020/quals/sandbox-teleport/attachments/chrome_version.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
tags/84.0.4147.94

‎2020/quals/sandbox-teleport/attachments/mojo_bindings.diff

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Already applied to the supplied bindings to hack in uint64 support
2+
diff --git a/bindings/mojo_bindings.js b/bindings/mojo_bindings.js
3+
index 483fbc3..6a869e2 100644
4+
--- a/bindings/mojo_bindings.js
5+
+++ b/bindings/mojo_bindings.js
6+
@@ -867,7 +867,7 @@ if (typeof mojo.config.autoLoadMojomDeps === 'undefined') {
7+
hi = this.dataView.getUint32(offset, kHostIsLittleEndian);
8+
lo = this.dataView.getUint32(offset + 4, kHostIsLittleEndian);
9+
}
10+
- return lo + hi * kHighWordMultiplier;
11+
+ return BigInt(lo) + BigInt(hi) * BigInt(kHighWordMultiplier);
12+
}
13+
14+
Buffer.prototype.getInt8 = function(offset) {
15+
@@ -908,13 +908,15 @@ if (typeof mojo.config.autoLoadMojomDeps === 'undefined') {
16+
this.dataView.setUint32(offset, value, kHostIsLittleEndian);
17+
}
18+
Buffer.prototype.setUint64 = function(offset, value) {
19+
- var hi = (value / kHighWordMultiplier) | 0;
20+
+ value = BigInt(value);
21+
+ var hi = Number((value / BigInt(kHighWordMultiplier))) | 0;
22+
+ var lo = Number(value & (BigInt(kHighWordMultiplier-1)));
23+
if (kHostIsLittleEndian) {
24+
- this.dataView.setInt32(offset, value, kHostIsLittleEndian);
25+
+ this.dataView.setInt32(offset, lo, kHostIsLittleEndian);
26+
this.dataView.setInt32(offset + 4, hi, kHostIsLittleEndian);
27+
} else {
28+
this.dataView.setInt32(offset, hi, kHostIsLittleEndian);
29+
- this.dataView.setInt32(offset + 4, value, kHostIsLittleEndian);
30+
+ this.dataView.setInt32(offset + 4, lo, kHostIsLittleEndian);
31+
}
32+
}
33+
34+
@@ -2634,7 +2636,7 @@ if (typeof mojo.config.autoLoadMojomDeps === 'undefined') {
35+
} else if (message.isResponse()) {
36+
var reader = new internal.MessageReader(message);
37+
var requestID = reader.requestID;
38+
- var completer = this.completers_.get(requestID);
39+
+ var completer = this.completers_.get(Number(requestID));
40+
if (completer) {
41+
this.completers_.delete(requestID);
42+
completer.resolve(message);
43+
@@ -6159,4 +6161,4 @@ if (typeof mojo.config.autoLoadMojomDeps === 'undefined') {
44+
exports.PauseUntilFlushCompletes = PauseUntilFlushCompletes;
45+
exports.FlushAsync = FlushAsync;
46+
exports.RunOrClosePipeInput = RunOrClosePipeInput;
47+
-})();
48+
\ No newline at end of file
49+
+})();

‎2020/quals/sandbox-teleport/attachments/service.py

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#Copyright 2020 Google LLC
2+
#
3+
#Licensed under the Apache License, Version 2.0 (the "License");
4+
#you may not use this file except in compliance with the License.
5+
#You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#!/usr/bin/env python2.7
15+
import subprocess
16+
import sys
17+
import time
18+
from threading import Timer
19+
20+
def main():
21+
server = sys.stdin.readline()
22+
server = server.strip()
23+
24+
server_len = 0
25+
while server_len < min(128,len(server)) and (server[server_len] == '/' or server[server_len] == '.' or server[server_len] == ':' or server[server_len].isalnum()):
26+
server_len += 1
27+
server = server[:server_len]
28+
29+
if not server.startswith("http://") and not server.startswith("https://"):
30+
print("incorrect url")
31+
exit(0)
32+
33+
print("connecting to {}".format(server))
34+
35+
argv = [
36+
"./chrome/chrome",
37+
"--user-data-dir=/tmp/chrometmp",
38+
"--enable-blink-features=MojoJS",
39+
"--disable-gpu",
40+
server
41+
]
42+
env = {
43+
'DISPLAY': ':100'
44+
}
45+
46+
proc = subprocess.Popen(argv, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
47+
time.sleep(10)
48+
print("timeout")
49+
proc.kill()
50+
51+
if __name__ == '__main__':
52+
main()

0 commit comments

Comments
 (0)