CVE-2019-6225

OsirisJailbreak12 iOS 120 -> 1212 Incomplete Jailbreak with CVE-2019-6225 An incomplete iOS 12 Jailbreak For now it only runs the exploit, gets tfp0, gets ROOT, escapes the SandBox, writes a test file to prove the sandbox was escaped then resprings Feel free to build on top of it as long as you respect the GPLv3 license Older (4K) devices are not supported for now

iOS 12.0 -> 12.1.2 Incomplete Osiris Jailbreak with CVE-2019-6225 by GeoSn0w (FCE365)

OsirisJailbreak12 iOS 120 -> 1212 Incomplete Jailbreak with CVE-2019-6225 An incomplete iOS 12 Jailbreak For now it only runs the exploit, gets tfp0, gets ROOT, escapes the SandBox, writes a test file to prove the sandbox was escaped then resprings Feel free to build on top of it as long as you respect the GPLv3 license 4K devices are not supported for now A12 and

voucher_swap - Exploit for P0 issue 1731 on iOS 1212 Brandon Azad ---- Issue 1731: CVE-2019-6225 -------------------------------------------------------------------- iOS/macOS: task_swap_mach_voucher() does not respect MIG semantics leading to use-after-free Consider the MIG routine task_swap_mach_voucher(): routine task_swap_mach_voucher( task : task_t; new_voucher : ipc_vo

iOS/macOS: task_swap_mach_voucher() does not respect MIG semantics leading to use-after-free

voucher_swap - Exploit for P0 issue 1731 on iOS 1212 Brandon Azad ---- Issue 1731: CVE-2019-6225 -------------------------------------------------------------------- iOS/macOS: task_swap_mach_voucher() does not respect MIG semantics leading to use-after-free Consider the MIG routine task_swap_mach_voucher(): routine task_swap_mach_voucher( task : task_t; new_voucher : ip

CVE-2019-6225 Local Privilege Escalation for macOS ≤ 10142 via CVE-2019-6225 Not yet tested on other machines, some hardcoded values might be incorrect Does NOT work on machines with SMAP It will crash your machine on the second run, no matter how the first run was Most of the code are based on PsychoTea/machswap Special thanks: @_bazad, @S0rryMyBad for the bug @S1guza

Obtains the kernel task port and establishes a kernel function calling primitive on the iPhone XS, iPhone XR, and iPhone 8 running iOS 12.1.2

voucher_swap - Exploit for P0 issue 1731 on iOS 1212 Brandon Azad ---- Issue 1731: CVE-2019-6225 -------------------------------------------------------------------- iOS/macOS: task_swap_mach_voucher() does not respect MIG semantics leading to use-after-free Consider the MIG routine task_swap_mach_voucher(): routine task_swap_mach_voucher( task : task_t; new_voucher : ip

Chaos Exploit for iOS 12.0 - 12.1.2 PoC & Writeup

Chaos kernel bug for iOS 120 through 1212 PoC & Writeup (CVE-2019-6225) Read everything please This only works with 64-bit devices running 120 - 1212 Writeup by @haxoorr (me) I made a clean writeup because the original PoC was posted as an image Fixed in iOS 1213 (16D39) If you're interested in bootstrapping iOS kernel security research (including

OsirisJailbreak12 iOS 120 -> 1212 Incomplete Jailbreak with CVE-2019-6225 An incomplete iOS 12 Jailbreak For now it only runs the exploit, gets tfp0, gets ROOT, escapes the SandBox, writes a test file to prove the sandbox was escaped then resprings Feel free to build on top of it as long as you respect the GPLv3 license 4K devices are not supported for now A12 and

An iOS kernel exploit for iOS 11 through 12.1.2. Non-SMAP (<=A9) devices only.

machswap An iOS kernel exploit for iOS 11 - 1212 Based on the task_swap_mach_voucher bug (CVE-2019-6225), joint-discovered/released by @S0rryMyBad and @bazad Somewhat loosely based on @s1guza's v0rtex exploit Non-SMAP (&lt;=A9) devices only Many thanks to @s1guza, @littlelailo, and @qwertyoruiopz Writeup: sparkeszone/blog/ios/2019/04/30/machswap-ios-12-

An iOS kernel exploit for iOS 11 through 12.1.2. Works on A7 - A11 devices.

machswap2 An iOS kernel exploit for iOS 11 - 1212 Based on the task_swap_mach_voucher bug (CVE-2019-6225), joint-discovered/released by @S0rryMyBad and @bazad Somewhat loosely based on @s1guza's v0rtex exploit, and @tihmstar's v3ntex exploit Works on A7 - A11 devices (no A12 as I have no A12 device) Many thanks to @s1guza, @littlelailo, and @qwertyoruiopz Twitt