https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html

Exploits CVE-2019-7582 and CVE-2019-13768/P0 issue 1755

Targets Chrome 71.0.3578.98

Needed to update the original PoC to work on Windows 10 1909+.

Also needed to increase reliability on a particular target machine where the original PoC had ~0% reliability (but had ~100% on another target)

Install Dependencies

wget https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
python2 get-pip.py
pip2 install cherrypy

Run

python2 server.py

PoC changes:

Replacement of the freed object was not happening so increased the number of allocated 0x140 sized blocks from 0x88 to 0x8000.

Allocation of page at 0x40404040000 was not happening so increased the number of allocated pages from 0xc88 to 2*0xc88

The ROP gadget mov rcx, rax ; mov rax, rcx ; add rsp, 28h ; ret is no longer present in ntdll.dll on Windows 1909. Instead the ROP gadgets mov rcx, rax ; test rcx, rcx ; setne al ; ret and mov rax, rcx ; add rsp, 0x28 ; ret in shell32.dll are used.

pipe.producer.close() was causing the sprayed 0x140 sized blocks to be freed. Memory was getting cleaned up too quickly. So the function call was delayed until after the exploit completes.

Shellcode was changed so that an arbitrary command (upto shellcode length 0x200) can be used. To edit the shellcode either modify shellcode.asm and run yasm -f bin -o shellcode.bin shellcode.asm or hexedit the commandline string into shellcode.bin. Current payload command is calc