LiveOverflow | WebKit RegExp Exploit addrof() walk-through @LiveOverflow | Uploaded 5 years ago | Updated 7 hours ago
Part 4: We finally look at the actual exploit code. We start by understanding the addrof() primitive used to leak the address of a JavaScript object in memory.
test.js: gist.github.com/LiveOverflow/ee5fb772334ec985094f77c91be60492
Crash investigation: webkit.org/blog/6411/javascriptcore-csi-a-crash-site-investigation-story
The Exploit: github.com/LinusHenze/WebKit-RegEx-Exploit
The Fix: github.com/WebKit/webkit/commit/7cf9d2911af9f255e0301ea16604c9fa4af340e2?diff=split#diff-fb5fbac6e9d7542468cfeed930e241c0L66
Saelo's exploit: github.com/saelo/cve-2018-4233/blob/master/pwn.js
Playlist: youtube.com/watch?v=5tEdSoZ3mmE&list=PLhixgUqwRTjwufDsT1ntgOY9yjZgg5H_t
-=[ 🕴️Advertisement ]=-
This video is supported by SSD Secure Disclosure: ssd-disclosure.com
Offensive Security Conference TyphoonCon: typhooncon.com
-=[ ❤️ Support ]=-
→ per Video: patreon.com/join/liveoverflow
→ per Month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
-=[ 🔴 Stuff I use ]=-
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-intuos
→ Camera#1 for streaming:* geni.us/sony-camera
→ Lens for streaming:* geni.us/sony-lense
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-keyboard
→ Old Microphone:* geni.us/mic-at2020usb
US Store Front:* amazon.com/shop/liveoverflow
-=[ 🐕 Social ]=-
→ Twitter: twitter.com/LiveOverflow
→ Website: liveoverflow.com
→ Subreddit: reddit.com/r/LiveOverflow
→ Facebook: facebook.com/LiveOverflow
-=[ 📄 P.S. ]=-
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#browserexploitation
Part 4: We finally look at the actual exploit code. We start by understanding the addrof() primitive used to leak the address of a JavaScript object in memory.
test.js: gist.github.com/LiveOverflow/ee5fb772334ec985094f77c91be60492
Crash investigation: webkit.org/blog/6411/javascriptcore-csi-a-crash-site-investigation-story
The Exploit: github.com/LinusHenze/WebKit-RegEx-Exploit
The Fix: github.com/WebKit/webkit/commit/7cf9d2911af9f255e0301ea16604c9fa4af340e2?diff=split#diff-fb5fbac6e9d7542468cfeed930e241c0L66
Saelo's exploit: github.com/saelo/cve-2018-4233/blob/master/pwn.js
Playlist: youtube.com/watch?v=5tEdSoZ3mmE&list=PLhixgUqwRTjwufDsT1ntgOY9yjZgg5H_t
-=[ 🕴️Advertisement ]=-
This video is supported by SSD Secure Disclosure: ssd-disclosure.com
Offensive Security Conference TyphoonCon: typhooncon.com
-=[ ❤️ Support ]=-
→ per Video: patreon.com/join/liveoverflow
→ per Month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
-=[ 🔴 Stuff I use ]=-
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-intuos
→ Camera#1 for streaming:* geni.us/sony-camera
→ Lens for streaming:* geni.us/sony-lense
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-keyboard
→ Old Microphone:* geni.us/mic-at2020usb
US Store Front:* amazon.com/shop/liveoverflow
-=[ 🐕 Social ]=-
→ Twitter: twitter.com/LiveOverflow
→ Website: liveoverflow.com
→ Subreddit: reddit.com/r/LiveOverflow
→ Facebook: facebook.com/LiveOverflow
-=[ 📄 P.S. ]=-
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#browserexploitation
