rootsh

rootsh rootsh is a local privilege escalation targeting OS X Yosemite 10.10.5 build 14F27. It exploits CVE-2016-1758 and CVE-2016-1828, two vulnerabilities in XNU that were patched in OS X El Capitan 10.11.4 and 10.11.5. rootsh will not work on platforms with SMAP enabled. CVE-2016-1758...

CVE-2018-4407

CVE-2018-4407 CVE-2018-4407 is a buffer overflow vulnerability in the XNU kernel's ICMP error code. It causes IOS devices to crash both laptops and mobiles upon receival of one yes 1! single bad packet. The bug was originally disclosured by Kevin Backhouse on his lgtm blogpost on October 30th 201...

vpwn

vpwn by qwertyoruiop generic xnu heap overflow exploitation. demo output: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin qwertyoruiops-iMac.local 14.3...

MacDirtyCowDemo

Get root on macOS 13.0.1 with CVE-2022-46689 macOS equivalent of the Dirty Cow bug, using the testcase extracted from Apple's XNU source. https://worthdoingbadly.com/macdirtycow/ Usage On a macOS 13.0.1 / 12.6.1 or below machine, run: root@kitploit: clang -o switcharoo vmunalignedcopyswitchrace.c...

Trigon

Trigon Trigon is a deterministic kernel exploit based on CVE-2023-32434. It currently supports A9 - A11 devices running iOS 13 - 15.7.6 . Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable. Trigon exploits an integer overflow in th...

CVE-2018-4407

CVE-2018-4407 Massive IOS/MAC Attack Exploit CVE-2018-4407 is a Simple and Very Fast BOF attack Against IOS/MAC that can lead to DOS. The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones,...

CVE-2024-27815

CVE-2024-27815 XNU kernel buffer overflow. Introduced in xnu-10002.1.13, fixed in xnu-10063.121.3. Writeup: https://jprx.io/cve-2024-27815 root@kitploit: gcc TURPENTINE.c -o TURPENTINE ./TURPENTINE Hash root@kitploit: $ sha256sum TURPENTINE.c...

xnu

What is XNU? XNU kernel is part of the Darwin operating system for use in macOS and iOS operating systems. XNU is an acronym for X is Not Unix. XNU is a hybrid kernel combining the Mach kernel developed at Carnegie Mellon University with components from FreeBSD and a C++ API for writing drivers...

CVE-2018-4407-IOS

CVE-2018-4407-IOS CVE ? Common Vulnerabilities and Exposures TLDR The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites th...

AppleDOS

AppleDOS CVE-2018-4407 Based on CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407, this tweet, and this video. The bug is heap overflow vulnerability in bad packet handling when OS try to send ICMP message containing segments from bad packet back to the sender. This POC will...

blanket

blanket Blanket is a sandbox escape targeting iOS 11.2.6, although the main vulnerability was only patched in iOS 11.4.1. It exploits a Mach port replacement vulnerability in launchd CVE-2018-4280, as well as several smaller vulnerabilities in other services, to execute code inside the ReportCras...

CVE-2024-54507

SUSCTL: CVE-2024-54507 Introduced in xnu-11215.1.10, fixed in xnu-11215.61.5. Writeup: https://jprx.io/cve-2024-54507...

MacDirtyCow

MacDirtyCow Example of CVE-2022-46689 aka MacDirtyCow. What? MacDirtyCow is a privilege escalation vulnerability in macOS, similar to the Dirty COW vulnerability in Linux. The vulnerability resides in the copy-on-write COW mechanism used by macOS's XNU kernel. The vulnerability allows an attacker...

SockFuzzer

SockFuzzer: XNU Kernel Fuzzing Framework Project Status SockFuzzer, originally designed as a networking-focused fuzzer for the XNU kernel used in macOS and iOS, has evolved into a comprehensive kernel fuzzing framework. While retaining its original name as a nod to its roots, SockFuzzer now cover...

iOS-Kernel-Crash

CVE-2018-4407 Memory Corruption The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites the heap with garbage, which causes ...

slides

Slides Conference| Year| Name| Description ---|---|---|--- Zer0Con| 2023| CodeQL + DTrace = 💧🐞 in XNU| How to find multiple memory disclosures in XNU using CodeQL...

Pishi

Pishi Pishi is a static binary rewriting tool designed to instrument basic blocks in XNU kernel and in arbitrary macOS kernel extensions kexts. for XNU kernel, Pishi allows you to instrument at a function, file, or folder level. For example, you can instrument everything in the /bsd/net/ director...

CVE-2026-65349

CVE-2026-65349 — getattrlist OOB Write in vfsattrpackinternal Component: XNU VFS — vfsattrpackinternal getattrlist syscall Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds write to caller buffer Impact: Kernel heap corruption; from kernel conte...

pwn2own2018

Pwn2Own 2018: Safari + macOS RCE en Safari, escape de sandbox y LPE a kernel para macOS 10.13.3. Uso Instala nasm y tornado: root@kitploit: brew install nasm pip3 install tornado Revisa config.py si quieres cambiar el host o los puertos. Después inicia el servidor con ./server.py y navega a la UR...

CVE-2026-20698-PF_ROUTE-Heap-Overflow

CVE-2026-20698 — XNU Kernel Heap Overflow via PFROUTE RTAGENMASK Overview Heap buffer overflow in XNU's routing socket PFROUTE when processing RTAGENMASK in routemsg. Triggers kernel panic from an unprivileged process with no entitlements. CVE : CVE-2026-20698 credited to DARKNAVY Affected : iOS...