Previous Bypass is now fixed in version 1.4.7 - XSS with AngularJS 0x2

Key Takeaways

in the last video we have looked at a very simple JavaScript sandbox Escape by abusing The Constructor property of the scope object to get an instance of the function Constructor which we then use to generate a function with alert and execute it in this video we will have a look at a different sandbox bypass for the version 1.4.7 a lot of internal stuff has changed between the old version 1.0.8 uh and this one but people will figure it out again credit for this bypass goes entirely to all those amazing researchers who looked at angularjs in the past and the bypass I'm showing here was found by GTH haes so let's move on to this new angularjs version and try to use our old bypass and let's see what happens hm no alert let's have a look at the console error referencing function uh notice the capital written function that refers to the function Constructor you know that we used to call Alert in angularjs expression is disallowed okay crazy angular refuses to work with the function Constructor that we got by following the Constructor from the scope in the St Trace we can also find the function where this error is coming from it is coming from ensure safe object click on it to see the function this is it and here's quite a clever check if the object coming in as a parameter obj is the function Constructor I've briefly mentioned that the highest Constructor in JavaScript is the function Constructor this means that if you try to get the Constructor of the function Constructor you will end up with the function Constructor again so when obj is already a function Constructor The Constructor of that will be again the function Constructor so this if will evaluate to true and throw this error and as you can see I've also modified this angularjs code and added debugger statements as breakpoints in multiple places this will stop the execution when you have the developer console open now I will take the sandbox bypass from gareus and we will step through the JavaScript code to see how it works and why it works but that might get a bit freaky so we will start by looking at this expression and try to get a first understanding on what it tries to achieve and in the following video we will then see how this actually works inside of angularjs first of all I will modify this a bit and instead of array. join I will use string. concat I think that's a bit less confusing I will also modify the actual payload a little bit to make it more clear and also add a break point into it before we call alert so as you can see this expression has actually two parts the first part with some weird prototype stuff and an assignment and separated um like JavaScript with a semicolon is another expression with an dollar evil I hope you remember the first video where I explained that dollar eval is just evaluating an angularjs expression it's equivalent to double curly braces so this whole thing is basically an angularjs expression with another expression evaluated inside let's have a look at the first part so it somehow does something with chared chared is a standard string function it Returns the character at the index given as parameter so chared zero Returns the character a and Char at one the S but what about that Constructor prototype stuff so the Expressions start with a string and reference the Constructor of that which obviously gives us access to the string Constructor no that this is not a dangerous object like the fun function Constructor I mean what harm can a string Constructor do that only allows us to create new strings from that string Constructor it now references prototype and prototype is fancy JavaScript every string we use is a descendant from the string object and prototype can be used to reference the actual function or method that is inherited to all string objects so we are now referencing the chared function that all all other strings inherit and now the exploit wants to assign something different to that method what the it wants to assign the conad function so let's see what conad does string b. conad is also a string function or method it concatenates another string so for example I pend the string CCC Tob which returns bccc so now let's overwrite the Prototype chared with concat and now the string ASD do chared suddenly Returns the concat function instead of char it what the hell and when we now perform the Char Ed like we did at the beginning we don't get the first character uh we append zero to the string so that first part of the expression attempts to completely destroy how string chared function works if that is successful you can imagine very very weird things happen if something is relying on chared and if we look at where our first breakpoint hit angularjs uses chared to do something so what will happen find out on the next episode of this series to step through the actual angularjs exploit and see how it screws the internal state of [Music] angularjs