Jump to content
Nytro

Apple iOS < 10.3.1 - Kernel Exploit

Recommended Posts

Posted
Sources:
https://github.com/doadam/ziVA
https://blog.zimperium.com/ziva-video-audio-ios-kernel-exploit/
 
ziVA
 
An iOS kernel exploit designated to work on all 64-bit iOS devices <= 10.3.1
 
More general information
 
https://blog.zimperium.com/zimperium-zlabs-ios-security-advisories/
 
https://blog.zimperium.com/ziva-video-audio-ios-kernel-exploit/
 
Offsets modifications for other iOS devices
 
Like a lot (if not most) of the iOS kernel exploits, this also requires offsets for each iOS device and version. Those will be posted in the close future (when I get more time) but should be acquired from AppleAVEDriver (you can get a hint on the offsets from the comments above them).
 
Sandbox escape
 
Like mentioned, AppleAVEDriver direct access requires sandbox escape (either mediaserverd sandbox context or no sandbox at all). Fortunately, Sandbox escape exploits have been released by P0, which means this can be used to completely compromise a kernel, and a step towards a full jailbreak.
 
Is it a Jailbreak?
 
This is a crucial part in a Jailbreak chain, but this never aimed to become a Jailbreak.
 
Is this going to be a jailbreak?
 
Maybe, if someone wants to work on that
 
Credits
 
Credit for finding the vulnerabilities, chaining them together, writing the exploit go to Adam Donenfeld (@doadam). Special thanks to Zuk Avraham (@ihackbanme), Yaniv Karta (@shokoluv) and the rest of the Zimperium team for the opportunity (and the paycheck).
 
 
Proof of Concept:
https://github.com/doadam/ziVA
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42555.zip

Sursa: https://www.exploit-db.com/exploits/42555/

  • Upvote 1

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...