CVE-2018-4121 PoC — 多款Apple产品WebKit 安全漏洞

Source

https://github.com/jezzus/CVE-2018-4121

Associated Vulnerability

Title:多款Apple产品WebKit 安全漏洞 (CVE-2018-4121)
Description:Apple iOS等都是美国苹果（Apple）公司的产品。Apple iOS是为移动设备所开发的一套操作系统；Safari是一款Web浏览器，是Mac OS X和iOS操作系统附带的默认浏览器。iCloud for Windows是一款基于Windows平台的云服务。WebKit是其中的一个Web浏览器引擎组件。多款Apple产品中的WebKit组件存在安全漏洞。远程攻击者可借助特制的网站利用该漏洞执行任意代码或造成拒绝服务（内存损坏和应用程序崩溃）。以下产品和版本受到影响：Apple iOS 11.3

Readme

# CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit

by MWR Labs (c) 2018 

## Details

* this proof of concept exploit targets Safari 11.0.3 (13604.5.6) on macOS 10.13.3 (17D47) versions only.
* compile the payload of your choice as a dylib with a constructor
* run `python file_to_jsarray.py your.dylib payload.js`
* serve this directory and point Safari to /exploit.html 
* exploit is not fully reliable and uses hardcoded offsets for this macOS/Safari version. 
* exploit takes a while to run due to the size of the heap spray (24.5GB). 
* this issue is addressed in macOS 10.13.4 as CVE-2018-4121 (https://support.apple.com/en-gb/HT208692)

## Credits

* Natalie Silvanovich of Google Project Zero - https://bugs.chromium.org/p/project-zero/issues/detail?id=1522
* Ian Beer of Google Project Zero - https://googleprojectzero.blogspot.co.uk/2014/07/pwn4fun-spring-2014-safari-part-i_24.html 
* Phoenhex - https://phoenhex.re/
* Fermin Serna - https://media.blackhat.com/bh-us-12/Briefings/Serna/BH_US_12_Serna_Leak_Era_Slides.pdf 

## References

* https://labs.mwrinfosecurity.com/assets/BlogFiles/apple-safari-wasm-section-vuln-write-up-2018-04-16.pdf
* https://labs.mwrinfosecurity.com/mwr-vulnerability-disclosure-policy
* https://www.mwrinfosecurity.com/about-us/

File Snapshot


 [4.0K]  /data/pocs/84d7a28794b59ef5140f764a3764c9d40c78fc75
├── [ 304]  alert_payload.m
├── [ 108]  exploit.html
├── [ 24K]  exploit.js
├── [ 445]  file_to_jsarray.py
└── [1.2K]  README.md

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!