Overview
This course covers the basic knowledge of the ANGLE project and demonstrates how to utilize ANGLE in WebGL/WebGL2 within web browsers. It delves into analyzing vulnerabilities within ANGLE, including CVEs such as CVE-2021-30626 and CVE-2022-26717, and explores exploitable vulnerabilities leading to obtaining RCE in macOS. The course teaches about WebGL/ WebGL2 components, ANGLE architecture, and specific vulnerabilities in browsers like Chrome and Safari. The intended audience for this course includes individuals interested in browser bug hunting, exploitation, and web security. The teaching method involves a presentation format with detailed analysis and explanations of vulnerabilities and exploitation steps.
Syllabus
Intro
Background of ANGLE
ANGLE Architecture Overview
WebGL Implementation
Chrome texStorage3D Out of Bound Read
Safari MultiDrawArrays Heap overflow
Safari Transform Feedback Use After Free
Allocate Buffer Object
Exploitation Steps
JSC's Butterfly Overview
Step 1: Heap Spray
Trigger the Bug
Search Corrupted JSArray
Get JSCell and Structure ID
Get addrof/fakeobj primitives
Taught by
Hack In The Box Security Conference