This module exploits a type confusion bug in the Javascript Proxy object in
WebKit. The DFG JIT does not take into account that, through the use of a Proxy,
it is possible to run arbitrary JS code during the execution of a CreateThis
operation. This makes it possible to change the structure of e.g. an argument
without causing a bailout, leading to a type confusion (CVE-2018-4233).
The JIT region is then replaced with shellcode which loads the second stage.
The second stage exploits a logic error in libxpc, which uses command execution
via the launchd's "spawn_via_launchd" API (CVE-2018-4404).
msf > use exploit/osx/browser/safari_proxy_object_type_confusion
msf exploit(safari_proxy_object_type_confusion) > show targets
...targets...
msf exploit(safari_proxy_object_type_confusion) > set TARGET < target-id >
msf exploit(safari_proxy_object_type_confusion) > show options
...show and set options...
msf exploit(safari_proxy_object_type_confusion) > exploit