w00dl3cs / exploit_playground

Exploit Playground

Disclaimer

All the source code on this repository is provided for educational and informational purpose only, and should not be construed as legal advice or as an offer to perform legal services on any subject matter.

The information is not guaranteed to be correct, complete or current.

The author (Alexandro Luongo) makes no warranty (expressed or implied) about the accuracy or reliability of the information at this repository or at any other website to which it is linked.

Exploits

JavaScriptCore

Exploit	Details	Tested versions
instanceof	JIT bug to trigger a controlled type confusion Arbitrary Memory Read/Write using boxed/unboxed arrays Remote Code Execution (macOS)	iOS 11.3.1
regexp	JIT bug to trigger a controlled type confusion Arbitrary Memory Read/Write using WebAssembly Remote Code Execution (macOS) using WebAssembly	iOS 12.1.1 macOS 10.14
dateprototype	JIT bug to trigger a controlled type confusion	iOS 13b3

exploit_playground's Issues

throw "Could not materialize object using 'fakeobj' primitive!";

regexp_exploit.js does not seem to work

Throws the following error:
[-] Exception caught: Error: Memory import imports:mem provided an ‘initial’ that is smaller than the module’s declared ‘initial’ import memory size (evaluating ‘new WebAssembly.Instance(webAssemblyModule, importObject)’)
when reaching getMemoryAccessTo