CVE-2023-28206 PoC — Apple macOS Ventura 缓冲区错误漏洞

Source

https://github.com/acceleratortroll/acceleratortroll

Associated Vulnerability

Title:Apple macOS Ventura 缓冲区错误漏洞 (CVE-2023-28206)
Description:Apple macOS Ventura是美国Apple公司的一个桌面操作系统。 Apple macOS Ventura 13.3.1版本存在缓冲区错误漏洞，该漏洞源于对输入验证不正确导致越界写入。攻击者利用该漏洞使用内核权限执行任意代码。

Description

Abusing CVE-2023-28206 to make something useful

Readme

# AcceleratorTroll™ <img src="acceleratortroll/Assets.xcassets/AppIcon.appiconset/acceleratortroll.png" width="140px" style="float: right;">
Abusing CVE-2023-28206 to make something useful. 

## Roadmap
Right now, we are still trying to understand how the vulnerability works and how to exploit it for anything other than panics.

 - Prove that the vulnerability can be used to obtain kernel privileges.
 - Obtain a krw exploit.
 - Run an SSH Server.
 - Allow for running unsigned code or fakesigned code.
 - Control UICache to install apps.


## Credits

Contributors:
 - App made by [Jan](https://github.com/JanCraft)
 - Logo made by [iframe:3](https://github.com/vmhl87)
 - MeoRW made by [May.](https://github.com/TheFunnyMan16)

Credits:
 - PoC by [Linus Henze](https://github.com/LinusHenze)
 - WeightBufs by [Mohamed Ghannam](https://github.com/0x36)

File Snapshot


 [4.0K]  /data/pocs/9cf6a8a92b09f4f558895a3710dfe527c6cdc171
├── [4.0K]  acceleratortroll
│   ├── [ 227]  acceleratortrollApp.swift
│   ├── [ 342]  acceleratortroll-Bridging-Header.h
│   ├── [ 259]  acceleratortroll.entitlements
│   ├── [1.5K]  ArsenalView.swift
│   ├── [4.0K]  Assets.xcassets
│   │   ├── [4.0K]  acceleratortroll.imageset
│   │   │   ├── [276K]  acceleratortroll.png
│   │   │   └── [ 314]  Contents.json
│   │   ├── [4.0K]  AccentColor.colorset
│   │   │   └── [ 226]  Contents.json
│   │   ├── [4.0K]  AppIcon.appiconset
│   │   │   ├── [276K]  acceleratortroll.png
│   │   │   └── [ 220]  Contents.json
│   │   └── [  63]  Contents.json
│   ├── [1.5K]  HomeView.swift
│   ├── [ 181]  Info.plist
│   ├── [ 616]  InfoView.swift
│   ├── [ 915]  MainView.swift
│   ├── [4.0K]  meorw
│   │   ├── [2.3K]  ANEDirectIn.c
│   │   ├── [1.1K]  ANEDirectIn.h
│   │   ├── [7.9K]  aneProgram.h
│   │   ├── [4.0K]  AppleNeuralEngine
│   │   │   ├── [2.0K]  _ANEClient.h
│   │   │   ├── [ 546]  _ANECloneHelper.h
│   │   │   ├── [1.7K]  _ANEDaemonConnection.h
│   │   │   ├── [ 866]  _ANEDaemonProtocol.h
│   │   │   ├── [ 615]  _ANEDataReporter.h
│   │   │   ├── [1.8K]  _ANEDeviceController.h
│   │   │   ├── [ 525]  _ANEDeviceInfo.h
│   │   │   ├── [ 819]  _ANEErrors.h
│   │   │   ├── [ 530]  _ANEHashEncoding.h
│   │   │   ├── [ 884]  _ANEIOSurfaceObject.h
│   │   │   ├── [ 456]  _ANELog.h
│   │   │   ├── [3.8K]  _ANEModel.h
│   │   │   ├── [1.4K]  _ANEPerformanceStats.h
│   │   │   ├── [2.6K]  _ANEProgramForEvaluation.h
│   │   │   ├── [ 765]  _ANEQoSMapper.h
│   │   │   ├── [2.6K]  _ANERequest.h
│   │   │   ├── [1.2K]  _ANEStrings.h
│   │   │   ├── [ 731]  AppleNeuralEngine.h
│   │   │   ├── [ 557]  AppleNeuralEngine-Structs.h
│   │   │   ├── [ 423]  NSCopying.h
│   │   │   └── [ 435]  NSSecureCoding.h
│   │   ├── [ 226]  build_macos.sh
│   │   ├── [ 73K]  exploit
│   │   ├── [2.7K]  exploit.h
│   │   ├── [ 54K]  exploit.m
│   │   ├── [6.5K]  IOGPU.c
│   │   ├── [3.7K]  IOGPU.h
│   │   ├── [4.3K]  iokit.h
│   │   ├── [9.3K]  IOSurface.c
│   │   ├── [2.1K]  IOSurface.h
│   │   ├── [ 64K]  model_tmp.hwx
│   │   └── [3.4K]  utils.c
│   ├── [ 33K]  mymodel.mlmodel
│   ├── [4.1K]  PoC.m
│   ├── [4.0K]  Preview Content
│   │   └── [4.0K]  Preview Assets.xcassets
│   │       └── [  63]  Contents.json
│   ├── [ 590]  RebootModal.swift
│   ├── [3.6K]  respring.m
│   └── [ 256]  util.m
├── [4.0K]  acceleratortroll.xcodeproj
│   ├── [ 35K]  project.pbxproj
│   ├── [4.0K]  project.xcworkspace
│   │   ├── [ 135]  contents.xcworkspacedata
│   │   └── [4.0K]  xcshareddata
│   │       └── [ 238]  IDEWorkspaceChecks.plist
│   ├── [4.0K]  xcshareddata
│   │   └── [4.0K]  xcschemes
│   │       ├── [2.9K]  acceleratortroll-debug.xcscheme
│   │       └── [2.9K]  acceleratortroll.xcscheme
│   └── [4.0K]  xcuserdata
│       └── [4.0K]  jancr.xcuserdatad
│           └── [4.0K]  xcschemes
│               └── [ 624]  xcschememanagement.plist
├── [1.0K]  LICENSE
└── [ 859]  README.md

17 directories, 63 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!