(P)FACE into the Apple core and exploit to root
summary
Passive IOKit fuzzing hooks kernel APIs on live macOS machines, records call contexts and flags suspicious modules, and produces reproducible kernel crashes and crash dumps. A PFACE passive fuzzing engine uses inline kernel hooks plus a condition tagger and context enlightenment to prioritize interfaces; it finds a kernel heap leak in typical_image and a reliable path to occupy kernel memory. An OSData-based kernel heap occupation technique enables SMEP/SMAP bypass, yields two independent local privilege escalation exploits and roots macOS 10.11.3 twice, and correlates to dozens of CVEs.
AI-written summary · about
chapters (11)
- 0:00Start
- 10:41Architecture Overview
- 12:27Pseudo Code
- 14:47A real Hooker example?
- 15:54Hooker Summary
- 21:18Stack Frame Sample
- 24:24Context Sample
- 30:21Security Mitigations
- 31:11Bugs vs Mitigation
- 35:13Exploit Process 1/2
- 38:37Demo
related talks
49mDrill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
53mFuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS
43mDebug for Bug: Crack and Hack Apple Core by Itself
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
53mResearching New Attack Interfaces On iOS And OSX
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
44mBreaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing