Abstract

We will delve into the comprehensive process and challenges faced during the development of the exploit chain. This includes discussing the V8 sandbox bypass, with a special emphasis on hijacking the latest Chrome V8 rip, focusing beyond just the lower 4 bytes. Additionally, we'll cover the reliable technique for jumping to LONG shellcode without relying on ROP, and the distinctions between untrusted processes and Chrome's rendering process.

In the context of Chrome's sandbox, we've utilized CVE-2023-21674. Our discussion will reveal in-depth details of the ALPC kernel exploit, and the construction process for its proof of concept (PoC). We will also touch upon the transition from use-after-free (UAF) vulnerabilities to arbitrary read/write primitives, and the method of object memory replace from the Chrome render process to the kernel heap, and methods to bypass numerous API restrictions.

Lastly, we'll highlight crucial considerations and key points when developing real-world exploits.