Inside iOS 27's Reworked Stub Islands
How iOS 27 trims the dyld shared cache and updates stub island trampolines
CodeColorist
Security Research mainly on macOS / iOS
Latest posts
Abusing tclsh to Load (Remote) Shellcode on macOS
Yet another LOOBins
Mistuned Part 3: PAC Bypass
Bypass hardware assisted mitigation using Objective-C runtime.
Mistuned Part 2: Butterfly Effect
A simple access control issue makes a huge difference, leading to infoleak and use after free.
Mistuned Part 1: Client-side XSS to Calculator and More
Remotely pwn iOS and pop up arbitrary app with 0 memory corruption.
Quick Analysis for the SSID Format String Bug
A rogue Wi-Fi hotspot can crash your phone.
See No Eval: Runtime Dynamic Code Execution in Objective-C
There is a turing-complete querying language embeded in Objective-C hidden in plain sight.
X Site eScape (Part II): Look Up a Shell in the Dictionary
A funny bug chain turing inter-process XSS to native code execution for sandbox escape.
X Site eScape (Part III): CVE-2020-9860, A Copycat
Copycat.
X Site eScape (Part I): Exploitation of An Old CoreFoundation Sandbox Bug
Triggering inter-process XSS for fun and profit.
Revisiting An Old MediaRemote Bug (CVE-2018-4340)
Useless bugs are just being given up too early.
Two macOS Persistence Tricks Abusing Plugins
Similar to DLL sideloading, legit plugins on macOS could be abused to load executable code on startup.
Rootpipe Reborn (Part II): CVE-2019-8565 Feedback Assistant Race Condition
Relying on pid to validate IPC peer is unsafe.
Rootpipe Reborn (Part I): TimeMachine Command Injection
Applying web security tricks to macOS LPE bugs.
One-liner Safari Sandbox Escape Exploit
TOCTOU bug in CoreFoundation and state change of sandbox lockdown on macOS Safari, leading to easy sandbox escape.
CVE-2018-4991: Adobe Creative Cloud Desktop Local Privilege Escalation via Signature Bypass
The private API design of XPC could make it hard for 3rd-party developers to write security code.
CVE-2018-8412: MS Office 2016 for Mac Privilege Escalation via a Legacy Package
Code signature bypass and insecure sideloading result in privilege escalation in Microsoft Office 2016 for Mac
Something About #realworldctf doc2own
Get some real life 0day by playing CTF challenges.
Bypass macOS Rootless by Sandboxing
Attacking the operating system by using its own security mechanism.
Visual Studio Code silently Fixed a Remote Code Execution Vulnerability
Better not leave inspectable Electron instances on production.
Bypass PHP Safe Mode by Abusing SQLite3's FTS Tokenizer
Abuse SQLite's legit feature to turn arbitrary SQL queries into arbitrary code execution and pwn php