blanket

blanket Blanket is a sandbox escape targeting iOS 11.2.6, although the main vulnerability was only patched in iOS 11.4.1. It exploits a Mach port replacement vulnerability in launchd CVE-2018-4280, as well as several smaller vulnerabilities in other services, to execute code inside the ReportCras...

pwn2own2018

Pwn2Own 2018: Safari + macOS Safari RCE, sandbox escape, and LPE to kernel for macOS 10.13.3. Usage Install nasm and tornado: brew install nasm pip3 install tornado Check config.py if you want to change the host or ports. Afterwards start the server with ./server.py and navigate to the shown URL...

Trigon

Trigon Trigon is a deterministic kernel exploit and PPL bypass based on CVE-2023-32434. It supports A9 - A16 devices running iOS 13 - 16.5.1. Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable. Trigon exploits an integer overflow i...

MacDirtyCowDemo

Get root on macOS 13.0.1 with CVE-2022-46689 macOS equivalent of the Dirty Cow bug, using the testcase extracted from Apple's XNU source. https://worthdoingbadly.com/macdirtycow/ Usage On a macOS 13.0.1 / 12.6.1 or below machine, run: clang -o switcharoo vmunalignedcopyswitchrace.c sed -e...

IPC-Memory-Mac-OSX-Exploit

IPC-Memory-Mac-OSX-Exploit IPC Local Security Bypass Inter Process Communication through shared memory is a concept where two or more process can access the common memory. And communication is done via this shared memory where changes made by one process can be viewed by another process. The kern...

slides

Slides Conference| Year| Name| Description ---|---|---|--- Zer0Con| 2023| CodeQL + DTrace = 💧🐞 in XNU| How to find multiple memory disclosures in XNU using CodeQL...

iOS-Kernel-Crash

CVE-2018-4407 Memory Corruption The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites the heap with garbage, which causes ...

CVE-2024-27815

CVE-2024-27815 XNU kernel buffer overflow. Introduced in xnu-10002.1.13, fixed in xnu-10063.121.3. Writeup: https://jprx.io/cve-2024-27815 gcc TURPENTINE.c -o TURPENTINE ./TURPENTINE Hash $ sha256sum TURPENTINE.c f7160a6ad7d52f32d64b86cf3006c98a217954d80c3fc71a8f27595e227d0fa0 TURPENTINE.c Hash...

CVE-2018-4407

CVE-2018-4407 Massive IOS/MAC Attack Exploit CVE-2018-4407 is a Simple and Very Fast BOF attack Against IOS/MAC that can lead to DOS. The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones,...

AppleDOS

AppleDOS CVE-2018-4407 Based on CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407, this tweet, and this video. The bug is heap overflow vulnerability in bad packet handling when OS try to send ICMP message containing segments from bad packet back to the sender. This POC will...

rootsh

rootsh rootsh is a local privilege escalation targeting OS X Yosemite 10.10.5 build 14F27. It exploits CVE-2016-1758 and CVE-2016-1828, two vulnerabilities in XNU that were patched in OS X El Capitan 10.11.4 and 10.11.5. rootsh will not work on platforms with SMAP enabled. CVE-2016-1758...

CVE-2024-54507

SUSCTL: CVE-2024-54507 Introduced in xnu-11215.1.10, fixed in xnu-11215.61.5. Writeup: https://jprx.io/cve-2024-54507...

Pishi

Pishi Pishi is a static binary rewriting tool designed to instrument basic blocks in XNU kernel and in arbitrary macOS kernel extensions kexts. for XNU kernel, Pishi allows you to instrument at a function, file, or folder level. For example, you can instrument everything in the /bsd/net/ director...

xnu

What is XNU? XNU kernel is part of the Darwin operating system for use in macOS and iOS operating systems. XNU is an acronym for X is Not Unix. XNU is a hybrid kernel combining the Mach kernel developed at Carnegie Mellon University with components from FreeBSD and a C++ API for writing drivers...

CVE-2018-4407-IOS

CVE-2018-4407-IOS CVE ? Common Vulnerabilities and Exposures TLDR The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites th...

vpwn

vpwn by qwertyoruiop generic xnu heap overflow exploitation. demo output: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin qwertyoruiops-iMac.local 14.3...

SockFuzzer

SockFuzzer: XNU Kernel Fuzzing Framework Project Status SockFuzzer, originally designed as a networking-focused fuzzer for the XNU kernel used in macOS and iOS, has evolved into a comprehensive kernel fuzzing framework. While retaining its original name as a nod to its roots, SockFuzzer now cover...

CVE-2023-32413

macOS LPE CVE-2023-32413 / ZDI-23-845 / Pwn2Own Vancouver 2023 exploit This is the exploit code that has been played at Pwn2Own Vancouver 2023 https://youtu.be/c0cS4R0ja-I?t=180. This code exploits CVE-2023-32413 to gain root rights on any vulnerable macOS. The vulnerability is a logic TOCTOU tha...

CVE-2026-65330

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU VFS — defaultsetxattrdoubleagent tmpfs VNOP Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Fixed PAC diversifier in xattr handler pointer signing Impact: PC control from kernel context; full privile...

MacDirtyCow

MacDirtyCow Example of CVE-2022-46689 aka MacDirtyCow. What? MacDirtyCow is a privilege escalation vulnerability in macOS, similar to the Dirty COW vulnerability in Linux. The vulnerability resides in the copy-on-write COW mechanism used by macOS's XNU kernel. The vulnerability allows an attacker...