Subverting Apple Graphics: Practical Approaches to Remotely Gaining Root

on YouTube ↗54m

" summary

Demonstrates full exploit chains that turn sandboxed browser code into root on El Capitan by abusing WindowServer MIG IPC and IOAccelerator userclients, reporting CVE-2014-1314, CVE-2016-1804 and the kernel CVE used at Pwn2Own 2016. Uses CF serialized Unicode strings to trigger a timed double-free in WindowServer, a controlled heap spray via a new catalog send_data technique to groom the kalloc.48 zone, a float-constrained arbitrary write, KASLR infoleak via igx video context and KUNC_execute to spawn a root process; two live demos succeed. WindowServer MIG IPC catalog send_data heap spray

AI-written summary · about

" chapters (41)

1. 0:00Introduction
2. 1:02Title
3. 2:05About us
4. 2:50Agenda
5. 3:27Apple Graphics
6. 5:17Land Attack
7. 6:23Mark Header Bits
8. 7:12Windows Server
9. 8:27Session Management
10. 8:55Bypass Sandbox
11. 9:56Window API
12. 11:02Why Windows
13. 13:05Safari sandbox
14. 13:35There is a message
15. 14:25Windows privilege escalation
16. 14:49Windows server privilege escalation
17. 15:06Set Global Force Configure API
18. 16:36Legacy Free Program
19. 19:11CF Message
20. 19:52Process
21. 21:18Heap Spray
22. 21:51Spray Criteria
23. 22:49Asar
24. 23:23Privilege Escalation
25. 24:11Demo
26. 27:14Service Family
27. 28:24External Master
28. 30:44Rectangle
29. 33:47Pleat
30. 34:37Normalize
31. 35:57Disassembly
32. 37:45Floating Instruction
33. 38:57Two Rectangles
34. 41:45Vector Structure
35. 48:16Exploitation
36. 49:04Kernel SRR
37. 50:23Info League
38. 51:02Context Finish
39. 51:29Method Disassembly
40. 51:44Time constraint
41. 53:25Thank you

" related talks

• 50mRo(o)tten Apples: Vulnerability Heaven in the iOS SandboxAdam Donenfeld · Black Hat Europe 2017
• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014
• 57mExploring Yosemite: Abusing Mac OS X 10.10Sung-ting Tsai, Ming-chieh Pan · Black Hat Europe 2014
• 36mmacOS Vulnerabilities Hiding in Plain SightCsaba Fitzel · Black Hat Asia 2022
• 42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity ProtectioKoh M. Nakagawa · CODE BLUE 2023
• 43mFrom u0 to Millionaire - Attacking Interprocess Communication...Wojciech Reguła · Oh My H@ck 2020
• 44mExploiting Unpatched iOS Vulnerabilities for Fun and ProfitByoungyoung Lee, Yeongjin Jang, Tielei Wang, Billy Lau · Black Hat USA 2014
• 36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File AttributesZuozhi Fan · Black Hat Asia 2021