Daniel Cooper
Daniel Cooper is a Security Consultant at Tanto Security. He is interested in security research in areas such as web security, binary exploitation, and more recently, Microsoft Windows. He also enjoys playing in the occasional CTF.
Session
Consider a website. One that allows you to export PDF documents. Have you ever stopped to wonder how this works under the hood?
Commercial libraries exist to do the PDF generation heavy lifting, but as they can be quite costly, I wasn’t surprised to see developers reaching for Chrome’s “Print to PDF” functionality. What did surprise me was web applications not having up to date Chrome builds in their NPM dependencies, developers reaching for --no-sandbox rather than fiddling with Docker and Kubernetes security knobs, and web apps that allowed me to provide custom (and malicious) HTML and JavaScript for conversion to PDF.
All of this inspired me to look into Chrome’s JavaScript engine, V8, to exploit these PDF generators. Chrome’s issue tracker documents many patched vulnerabilities that work on old Chrome versions, which is perfect for my use case. The main challenge was that the exploits and techniques vary depending on the target Chrome version, so I wondered, why not make a tool with enough exploits to cover all of them?
In this talk I outline my journey for developing the tool, the design decisions I made, the problems that I overcame, and the lessons I learned along the way. The result is a single web page that can exploit 24 common Chrome versions (and counting) for remote code execution using V8 memory corruption.