Skip to content

tihmstar/treadm1ll

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 

treadm1ll

You don't need to be as fast as lightspeed, but a run on a treadm1ll surely doesn't hurt.


Since i'm now busy with other stuff and likely not gonna come back to this here is my unfinished exploit:

  • works up to 11.4.1
  • gets you tfp0
  • incomplete/missing cleanup, will probably panic on exit

Offsets hardcoded for: Darwin Kernel Version 17.4.0: Fri Dec 8 19:35:52 PST 2017; root:xnu-4570.40.9~1/RELEASE_ARM64_S5L8960X
Get your own if you wanna run it on something else ;)

PS: exploit uses userland derefs, so it won't work with PAN
only for phones with headphone jack


A great writeup by Luca Moro (johncool) on the bug can be found here:
https://www.synacktiv.com/posts/exploit/lightspeed-a-race-for-an-iosmacos-sandbox-escape.html

About

You don't need to be as fast as lightspeed, but a run on a treadm1ll surely doesn't hurt.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published