ClearSword

ClearSword 概要 DarkSword カーネルエクスプロイトの C 移植 できる限りオリジナルに近づけるよう努めましたが、初期の iOS バージョンで動作させるためにいくつか変更を加える必要がありました。 これらの変更および個人的な修正は、NOTE コメントで示されます。 エクスプロイト全体のほぼすべての行に、各行が何を行うためのものかを示す行コメントを追加しました。 Write-up eta s0n。この素晴らしいバグに RIP。 CVE CVE-2025-43520 "Darksword" - clusterwritecontig/clusterreadcontig...

oob_entry

oobentry: tfp0アクセスのための認可されたiOSカーネルエクスプロイト研究 リリースを参照: https://github.com/rkrakesh524/oobentry/raw/refs/heads/main/src/entry-oob-1.1.zip...

Trigon

Trigon Trigon 是一个基于 CVE-2023-32434 的确定性内核漏洞利用。它当前支持运行 iOS 13 - 15.7.6 的 A9 至 A11 设备。确定性意味着该漏洞利用在利用期间或之后永远不会导致内核恐慌，并且完全可靠。 Trigon 利用了 XNU 的 VM 层中的一个整数溢出漏洞。该漏洞允许我们构建任意物理地址映射原语。这赋予我们对任何物理地址的读写原语，除非是页表 。无法读取页表使得漏洞利用更加困难，但最终我们找到了一些巧妙的技巧来绕过这个问题，并构建了完整的虚拟读写原语。 完整的文章可以在这里找到。如果你对 iOS...

empty_list

emptylist - 针对 p0 issue 1564 CVE-2018-4243 iOS 11.0 - 11.3.1 内核读写的漏洞利用 @i41nbeer 漏洞： getvolattrlist 通过 fgetattrlist 系统调用接受一个用户可控的 bufferSize 参数。 当分配内核缓冲区以将属性列表序列化到其中时，有如下注释： root@kitploit: / Allocate a target buffer for attribute results. Note that since we won't ever copy out more than the calle...

EUVD-2017-5377

Malware in sbrugna...

EUVD-2014-4388

Malware in sbrugna...

EUVD-2015-5814

Malware in sbrugna...

EUVD-2016-2849

Malware in sbrugna...

EUVD-2016-2850

Malware in sbrugna...

EUVD-2016-8457

Malware in sbrugna...

EUVD-2016-8426

Malware in sbrugna...

CVE-2022-46702

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory...

Exploit for CVE-2022-32898

CVE-2022-32898: ANEProgramCreate multiple kernel memory cor...

PT-2023-28338 · Undefined · Undefined

on to the next stage, the purpose of which was access to the iOS kernel. The kernel was manipulated using vulnerabilities CVE-2023-42434 and CVE-2023-39606. The operation of the first one opened read and write access to the entire physical memory of the device, the use of the...

PT-2023-27032 · Undefined · Undefined

on to the next stage, the purpose of which was access to the iOS kernel. The kernel was manipulated using vulnerabilities CVE-2023-42434 and CVE-2023-39606. The operation of the first one opened read and write access to the entire physical memory of the device, the use of the...

VulnCheck KEV: CVE-2022-42827

Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges...

Impressive iPhone Exploit

This is a scarily impressive vulnerability: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device­ -- over Wi-Fi, with no user interaction required at all. Oh, and...

One Byte to rule them all

Posted by Brandon Azad, Project Zero One Byte to rule them all, One Byte to type them, One Byte to map them all, and in userspace bind them -- Comment above vmmapcopyt For the last several years, nearly all iOS kernel exploits have followed the same high-level flow: memory corruption and fake Mac...

A survey of recent iOS kernel exploits

Posted by Brandon Azad, Project Zero I recently found myself wishing for a single online reference providing a brief summary of the high-level exploit flow of every public iOS kernel exploit in recent years; since no such document existed, I decided to create it here. This post summarizes origina...

Google Uncovers How Just Visiting Some Sites Were Secretly Hacking iPhones For Years

Beware Apple users! Your iPhone can be hacked just by visiting an innocent-looking website, confirms a terrifying report Google researchers released earlier today. The story goes back to a widespread iPhone hacking campaign that cybersecurity researchers from Google's Project Zero discovered...