CVE-2022-26766 PoC — Apple TV 4K和Apple TV HD 信任管理问题漏洞

Source

https://github.com/zhuowei/CoreTrustDemo

Associated Vulnerability

Title:Apple TV 4K和Apple TV HD 信任管理问题漏洞 (CVE-2022-26766)
Description:Apple TV 4K和Apple TV HD都是美国苹果（Apple）公司的产品。Apple TV 4K是一款智能机顶盒。用于推出 4K Hdr 图像。Apple TV HD是一款高清电视机顶盒产品。 Apple TV 4K、Apple TV 4K（第 2 代）和 Apple TV HD 存在信任管理问题漏洞，该漏洞源于安全子系统中的证书解析问题。本地应用程序可以利用该漏洞绕过签名验证。

Description

Proof-of-concept for CVE-2022-26766 on macOS 12.3.1

Readme

Demo for Linus Henze's CoreTrust bug (CVE-2022-26766, CoreTrust allows any root certificate)

See https://worthdoingbadly.com/coretrust/ for usage.

File Snapshot


 [4.0K]  /data/pocs/6d6957a22e62d10395157f4e00d7172c5fbc97fc
├── [4.0K]  badcert
│   ├── [2.9K]  certificate_chain.pem
│   ├── [1.1K]  codeca_certificate.csr
│   ├── [1.5K]  codeca_certificate.pem
│   ├── [  41]  codeca_certificate.srl
│   ├── [1.7K]  codeca_key.pem
│   ├── [1.1K]  dev_certificate.csr
│   ├── [4.9K]  dev_certificate.p12
│   ├── [1.5K]  dev_certificate.pem
│   ├── [1.7K]  dev_key.pem
│   ├── [1.9K]  makecerts.sh
│   ├── [1.4K]  root_certificate.pem
│   ├── [  41]  root_certificate.srl
│   └── [1.7K]  root_key.pem
├── [  62]  build2.sh
├── [  56]  build.sh
├── [ 340]  build_spawn_root.sh
├── [ 18K]  CTEvaluate.h
├── [4.0K]  fakeiphonecert
│   ├── [2.9K]  certificate_chain.pem
│   ├── [1.1K]  codeca_certificate.csr
│   ├── [1.5K]  codeca_certificate.pem
│   ├── [1.7K]  codeca_key.pem
│   ├── [1.2K]  dev_certificate.csr
│   ├── [5.0K]  dev_certificate.p12
│   ├── [1.5K]  dev_certificate.pem
│   ├── [1.7K]  dev_key.pem
│   ├── [1.8K]  makecerts.sh
│   ├── [1.4K]  root_certificate.pem
│   └── [1.7K]  root_key.pem
├── [6.2K]  libmis.tbd
├── [2.5K]  littlect.m
├── [1.3K]  littlemis.m
├── [2.9K]  littlemis.txt
├── [ 148]  README.md
├── [ 242]  spawn_root.entitlements
└── [ 960]  spawn_root.m

2 directories, 35 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!