WebKit Memory Corruption in Apple Products

This repository contains a single Metasploit module: 'webkit_createthis.rb', which targets a type confusion vulnerability in the JavaScript Proxy object implementation in WebKit (CVE-2018-4233) on Apple iOS devices. The exploit is delivered via a malicious web page, leveraging a JIT bug to achieve arbitrary read/write in the Safari process. It then uses a ROP chain to execute shellcode, which loads a second-stage Mach-O binary exploiting CVE-2017-13861 (async_wake) to escalate privileges to kernel level (TFP0). The exploit ultimately disables sandboxing and code signing restrictions, allowing a self-signed meterpreter payload to be loaded and executed, providing the attacker with a reverse shell. The module is highly weaponized, supporting customizable payloads and requiring the attacker to specify LHOST and LPORT for the reverse connection. The main attack vector is browser-based, requiring the victim to visit a malicious web page. The module is intended for advanced exploitation and post-exploitation on vulnerable iOS devices.

This repository contains a single Metasploit module targeting a type confusion vulnerability in the JavaScript Proxy object implementation in WebKit (Safari) on macOS (CVE-2018-4233), with a second stage exploiting a logic error in libxpc (CVE-2018-4404). The exploit is delivered via a malicious web page, leveraging the browser as the attack vector. The module serves a crafted HTML/JavaScript payload to the victim's Safari browser, which, if vulnerable, results in arbitrary code execution. The exploit supports customizable payloads (defaulting to a Python Meterpreter reverse shell) and is operational, requiring the victim to visit the attacker's web server. The code references two binary files (stage1.bin and stage2.dylib) as part of the exploitation chain. The module is written in Ruby (for Metasploit) and includes embedded JavaScript for the browser exploit. The targeted products are specific versions of Safari on macOS 10.12.6 to 10.13.3.

This repository is a full browser exploit for CVE-2018-4233, a JIT compiler bug in WebKit (Safari 11.0.3, macOS 10.13.3). The exploit is delivered via a malicious HTML page (pwn.html) that loads a series of JavaScript files implementing the attack. The main exploit logic is in pwn.js, which constructs addrof/fakeobj primitives to achieve arbitrary memory read/write, locates JIT memory, and injects shellcode (stage1.js). The shellcode writes a .dylib (stage2.js, generated from stage2.dylib) to disk and loads it into the renderer process to perform a sandbox escape. The current stage2.dylib is a dummy payload, but the infrastructure is in place for a real sandbox escape. The exploit uses WebSocket endpoints for logging and shell interaction. The repository includes build scripts for the shellcode and .dylib payloads, and is structured for modularity and extensibility. This is a sophisticated, multi-stage browser exploit targeting a specific Safari/WebKit vulnerability.