Browser Exploitation

The start of a new series. We will try to learn some basics about Browser Exploitation.

We are going to try out Linus's exploit and setup a vulnerable WebKit version including debug symbols.

Let's have a look at how JavaScriptCore implements JavaScript Objects and values like integers and floats. We can use lldb to look into the memory.

Looking at the WebKit JIT compiler - the part that converts JavaScript bytecode to machine code.

We finally look at the actual exploit code! We start with the addrof() primitive, which can leak the address of a JavaScript object in memory.

In this video we turn the bug used in addrof() to corrupt the memory of internal JavaScriptCore Objects which can help us to compromise the engine.

We go over the boxed vs. unboxed values, how to convert addresses to doubles and why our bug is a memory corruption.

Setting the foundation for an arbitrary read/write (and re-implementing addrof and fakeobj).

We achieve arbitrary read/write in the JavaScriptCore of WebKit.