Stack-based Buffer Overflow in libTIFF (TIFFFetchShortPair)

This repository contains a single Metasploit module (modules/exploits/apple_ios/browser/safari_libtiff.rb) that exploits a buffer overflow vulnerability in the libtiff library used by MobileSafari on early Apple iPhone firmware (1.00, 1.01, 1.02, 1.1.1). The module acts as an HTTP server, delivering a specially crafted TIFF image to the target device. When a vulnerable iPhone user visits the attacker's server with MobileSafari, the malicious TIFF triggers a buffer overflow, allowing the attacker to execute arbitrary ARM shellcode on the device. The exploit is operational, with a hardcoded payload and specific targeting of early iOS versions. The main attack vector is browser-based (drive-by download via HTTP), and the only fingerprintable endpoint is the attacker's HTTP server. The code is structured as a typical Metasploit exploit module, with methods for handling HTTP requests, generating the malicious TIFF, and managing payload delivery.

This repository contains a single Metasploit module (modules/exploits/apple_ios/email/mobilemail_libtiff.rb) that exploits a buffer overflow vulnerability in the libtiff library used by Apple's iPhone MobileMail application (CVE-2006-3459). The exploit targets iPhones running firmware versions 1.00, 1.01, 1.02, and 1.1.1. The module works by generating a malicious TIFF file containing custom shellcode, which is then attached to an email and sent to the target via SMTP. When the target device processes the email and opens the attachment, the buffer overflow is triggered, allowing arbitrary code execution. The exploit is highly weaponized, leveraging Metasploit's payload system for customizable post-exploitation actions. The code is written in Ruby and is structured as a standard Metasploit exploit module, making it easy to use within the framework. No hardcoded IPs, domains, or URLs are present; the main fingerprintable endpoint is the malicious TIFF file delivered via email.