Write Once, Pwn Anywhere
summary
Claims two new DEP bypasses and two ASLR bypasses that avoid ROP, JIT, plugins or non-ASLR modules and work across OS/CPU. Demonstrates JScript5 BSTR resurrection (use encoded/COM tag to force JScript5 for an info leak), two JScript9 tricks: JScript9 object-spray arbitrary R/W (small-string/object and array-data length abuse for OOB write/read), a “vital point strike” that flips a one-byte safe-mode flag to load a fake Shell32 via FSO, and an interdimensional execute that uses NtContinue + tiny native stub with JS-resolved API pointers; a proof exploit runs on Windows 7 and 8 without changes.
AI-written summary · about
chapters (13)
- 0:00Intro
- 3:03Corrupt BSTR prefix
- 8:50JScript 9 String object spray mojo
- 12:59Corrupt JScript 9 Array data prefix
- 13:59JScript 9 Array data length mojo
- 19:19Vital Points in the human body
- 21:15Safe Mode switch in JScript object
- 24:40"LoadLibrary" via JavaScript
- 31:23function GetProcAddress()
- 35:56Object operation call
- 43:13Native dimention
- 43:40Script dimention
- 44:11Interdimensional Execution
related talks
33mOver the Edge: Silently Owning Windows 10's Secure Browser
51mSneaking Past Device Guard
33mWebKit Everywhere: Secure or Not?
55mHow hacking works
51mExploiting Hardware Glitches And Side Channels In Perfect Software
22mThinking Outside the JIT Compiler
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
35mThe Hat Trick: Exploit Chrome Twice from Runtime to JIT