0vercl0k/blazefox

This repository has been archived on 27/Dec/2023
Stars
148
Rank 249,983 (Top 5 %)
Language
C++
License
MIT License
Created almost 6 years ago
Updated almost 5 years ago

0vercl0k/blazefox

0vercl0k

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Blazefox exploits for Windows 10 RS5 64-bit.

Blazefox exploits for Windows 10 RS5 64-bit

This the repository associated with the article Introduction to SpiderMonkey exploitation.

Overview

Blazefox is an exploitation challenge written by itszn for Blaze CTF 2018. The author added a blaze method to JavaScript Arrays that sets the size of the backing buffer to 420. This gives the attacker an out-of-bounds memory primitive.

Organization

Three exploits are documented and available in exploits,
A WindDbg JavaScript extension that allows to dump js::Value and JSObject objects in sm,
Various scripts built during the research in scripts,
An x64 debug build of the JavaScript shell (along private symbol information) in js-asserts, and an x64 release build in js-release,
The sources matching js-release private symbol information in src/js,
Last but not least, 7z archives of the Firefox binaries (along with xul.dll private symbol information) I compiled for Windows 64-bit in ff-bin.7z.

rp

rp++ is a fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries.

wtf

wtf is a distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows and Linux user-mode (experimental!).

CVE-2021-31166

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

CVE-2019-11708

Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.

stuffz

Basically a script thrift shop

windbg-scripts

A bunch of JavaScript extensions for WinDbg.

CVE-2022-21971

PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"

Rich Text Format

clairvoyance

Visualize the virtual address space of a Windows process on a Hilbert curve.

z3-playground

A repository to store Z3-python scripts you can use as examples, reminders, whatever.

CVE-2021-24086

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

CVE-2019-9810

Exploit for CVE-2019-9810 Firefox on Windows 64-bit.

CVE-2021-28476

PoC for CVE-2021-28476 a guest-to-host "Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys.

udmp-parser

A Cross-Platform C++ parser library for Windows user minidumps with Python 3 bindings.

kdmp-parser

A Windows kernel dump C++ parser library with Python 3 bindings.

symbolizer

A fast execution trace symbolizer for Windows.

zenith

Zenith exploits a memory corruption vulnerability in the NetUSB driver to get remote-code execution on the TP-Link Archer C7 V5 router for Pwn2Own Austin 2021.

sic

Enumerate user mode shared memory mappings on Windows.

ollydbg2-python

Scripting OllyDBG2 using Python is now possible!

snapshot

WinDbg extension written in Rust to dump the CPU / memory state of a running VM

rp-bf.rs

rp-bf: A library to bruteforce ROP gadgets by emulating a Windows user-mode crash-dump

fuzzing-ida75

Repository of the findings found by wtf when fuzzing IDA75.

paracosme

Paracosme is a zero-click remote memory corruption exploit that compromises ICONICS Genesis64 which was demonstrated successfully on stage during the Pwn2Own Miami 2022 competition.

symbolizer-rs

A fast execution trace symbolizer for Windows that runs on all major platforms and doesn't depend on any Microsoft libraries.

CVE-2022-28281

PoC for CVE-2022-28281 a Mozilla Firefox Out of bounds write.

lockmem

This utility allows you to lock every available memory regions of an arbitrary process into its working set.

pywinhv

Python bindings for the Microsoft Hypervisor Platform APIs.

CVE-2022-21974

PoC for CVE-2022-21974 "Roaming Security Rights Management Services Remote Code Execution Vulnerability"

Rich Text Format

pwn2own2023-miami

Writeups, PoCs of the bugs I found while preparing for the Pwn2Own Miami 2023 contest targeting UaGateway from the OPC UA Server category.

CVE-2021-32537

PoC for CVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel.

j0llyDmpr

j0llydmper is a windows service that allows you to dump furtively and automaticaly some contents of USB disks just plugged in your computer. In order to dump potentialy interesting files, you can use a rule on the file name or/and on the file size.

udmp-parser-rs

A Rust crate for parsing Windows user minidumps.

inject

Yet another Windows DLL injector.

kdmp-parser-rs

A KISS Rust crate to parse Windows kernel crash-dumps created by Windows & its debugger.

KEPaboo

Neutralize KEPServerEX anti-debugging techniques

longue-vue

Longue vue is an exploit chain that can compromise over the internet NETGEAR DGND3700v2 devices.

TV-Show-Downloader

Maybe you're a guy a bit like me -- who watch a lot of series -- so I guess you already know that downloading the latest episodes of all your favorites TV Shows is absolutely PAINFUL. I mean it, really. Thus, TVShow Downloader is a set of basic scripts (crontab + python script + bash script) designed to simplify my whole existence on this earth: I haven't to think about downloading my serie anymore \o/.

teesee-calc

Visualize and compare total compensation (TC) packages over time.

dbgeng-rs

Rust binding for the dbgeng COM interfaces.

articles

Mirror of the different PDF articles I wrote

0vercl0k

gflags-rs

Utility that lets you interact with Microsoft Windows Global Flags and particularly PageHeap, made to learn Rust

addr-symbolizer-rs

A KISS Rust crate to symbolize function addresses using Windows PDB files

rp2s

result

Simple, tiny and readable implementation of a Rust like std::result type for C++.