Add Chrome poc

Author: m-y-mo

SecurityExploits/Chrome/v8/CVE-2021-37975/README.md

@@ -2,7 +2,7 @@
 
 The analysis of this bug can be found [here](https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_37975). This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild.
 
-The exploit here is tested on `v8` version 9.4.146.16 (commit `452f57b`), which is the version shipped with Chrome 94.0.4606.71, the one before the bug is fixed, on Ubuntu 20.04. Tested on two different desktop devices with different specs.
+The exploit `poc.js` is tested on `v8` version 9.4.146.16 (commit `452f57b`), which is the version shipped with Chrome 94.0.4606.61, the one before the bug was fixed, on Ubuntu 20.04. It is tested on two different desktop devices with different specs.
 
 To test, check out `v8` at commit `452f57b` and compile with the default settings using `tools/dev/gm.py x64.release`. Then open the file `poc.js` with `d8`:
 
@@ -42,6 +42,57 @@ shellArray addr: 0x8048d75
 $ 
 ```
 
-Shell code may need changing on other platforms.
+Shell code and some offsets may need changing on other platforms.
 
-The exploit is not reliable, (probably about 50 percent success rate). The variable `gcSize` may need changing depending on the device, and the variable `mapAddr` also depends on the version of v8 (it is an offset). Changing the variable `sprayParam` may also improve the reliability. The current parameter seems to give reasonable reliability across the two devices tested.
+The exploit is fairly reliable, (> 80% success rate on the two tested devices). The variable `gcSize` may need changing depending on the device, and the variable `mapAddr` also depends on the version of v8 (it is an offset). Changing the variable `sprayParam` may also improve the reliability. The current parameter seems to give reasonable reliability across the two devices tested. The `gcSize` parameter should be ok for desktop devices, but may need changing for devices with low memory (e.g. mobile)
+
+The Chrome poc are the files `chrome_poc_parent.html` and `chrome_poc_child.html`. It is tested with Linux build 94.0.4606.61 (commit `c3f0a75`) on Ubuntu 20.04, with the following parameters:
+
+```
+is_debug = false
+symbol_level = 2
+blink_symbol_level = 2
+dcheck_always_on = false
+is_official_build = true
+chrome_pgo_phase = 0
+```
+
+To build this, I have to comment out part of a script `chrome/browser/resources/tools/optimize_webui.py` to fix the build:
+
+```
+@@ -178,16 +178,16 @@ def _bundle_v3(tmp_out_dir, in_path, out_path, manifest_out_path, args,
+                                             manifest_out_path)
+   assert len(generated_paths) == len(bundled_paths), \
+          'unexpected number of bundles - %s - generated by rollup' % \
+          (len(generated_paths))
+ 
+-  for bundled_file in bundled_paths:
+-    with open(bundled_file, 'r') as f:
+-      output = f.read()
+-      assert "<if expr" not in output, \
+-          'Unexpected <if expr> found in bundled output. Check that all ' + \
+-          'input files using such expressions are preprocessed.'
++#  for bundled_file in bundled_paths:
++#    with open(bundled_file, 'r') as f:
++#      output = f.read()
++#      assert "<if expr" not in output, \
++#          'Unexpected <if expr> found in bundled output. Check that all ' + \
++#          'input files using such expressions are preprocessed.'
+ 
+   return bundled_paths
+ 
+ def _optimize(in_folder, args):
+   in_path = os.path.normpath(os.path.join(_CWD, in_folder)).replace('\\', '/')
+```
+
+This part seems to be doing some sanity checks of some generated config files related to webui, so I don't expect it to affect the exploit.
+
+The Chrome exploit should be 100% reliable by using different origin `iframe` to avoid crashing the parent frame. (Idea similar to the one in "Making a Stealth Exploit by abusing Chrome's Site Isolation" in [this article](https://blog.exodusintel.com/2019/01/22/exploiting-the-magellan-bug-on-64-bit-chrome-desktop/?fbclid=IwAR0WiWjsUnun8AuipENIUCMwTvWl35I7rAgsTflQTecmazElNoCAYvm0BsA) of Ki Chan Ahn, but on a smaller scale) The parent frame will reset the child frame every 5 seconds and change its origin to make sure it starts fresh, during which it'll print out `resetChild` on the page. It should not take too many attempts to succeed and will pop `xcalc` on Ubuntu. To test it, host these pages at `127.0.0.1`, `127.0.0.2` and `127.0.0.3`:
+
+```
+python3 -m http.server --bind 127.0.0.1
+python3 -m http.server --bind 127.0.0.2
+python3 -m http.server --bind 127.0.0.3
+```
+
+Then open `localhost:8000/chrome_poc_parent.html` on Chrome built with the above instructions and wait. It should pop `xcalc` within a few trials.