Exploiting Unpatched iOS Vulnerabilities for Fun and Profit

on YouTube ↗44m

" summary

Reconstructs and rechains vulnerabilities in iOS 7.1.x to run unsigned code as root without a kernel exploit: starts from the evasion7 nine chained vulnerabilities, uses AFCD and an installerd symlink race to inject a developer-signed library into a non-container proxy, abuses a dyld zero-size code-section trick to bypass code signing, exploits a syslogd symlink bug to dump and remount the root partition on a PC, and modifies lockdownd service.plist to spawn root services; jailbreak works but does not patch the kernel so persistence requires re-triggering after reboot.

AI-written summary · about

" chapters (8)

1. 0:00Exploiting Unpatched iOS Vulnerabilities for Fun and Profit
2. 2:20Analysis of patched/unpatched vulnerabilities - What steps need to be re-exploited? • Discovery of new vulnerabilities to replace patched vulnerabilities • Steps for Jailbreaking iOS 7.1.2
3. 9:07Escape the sandbox - Exploitan un-sandboxed process. - Exploit design flaw in sandbox implementation - Override sandbox functions in libsandbox.dlib.
4. 24:13A kernel vulnerability is used to patch the kernel -Disable code signing check
5. 27:56Third party apps have access to /tmp for free - Use app to access /tmp to create symlink on exploit • #5: Sign the code with Developer/Enterprise License -Load developer-signed dylib in exploit #6
6. 30:49New Vulnerability for Permission Downgrading
7. 34:23Forge a dylib to have a constructor, then sign with a developer license -Similar toctors in ELF - Constructor is called when the dylib is loaded
8. 34:56Dump root partition using syslogd exploit then modify it - Download it to PC through AFC

" related talks

• 50mRo(o)tten Apples: Vulnerability Heaven in the iOS SandboxAdam Donenfeld · Black Hat Europe 2017
• 50mTake a Jailbreak -Stunning Guards for iOS Jailbreak-Otsuka Kaoru · CODE BLUE 2017
• 36mState Of IOS Jailbreaking In 2025Lars Fröder · Nullcon Goa 2025
• 29miOS Runtime Manipulation (PWND)Cyril Cermak · DevWorld 2024
• 40mIntroduction into Reverse Engineering and iOS SecurityCyril Cermak · #Pragma Conference 2023
• 54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining RootMarco Grassi, Liang Chen, Qidan He, Yubin Fu · Black Hat USA 2016
• 45mCombat Reverse Engineering and Patching on Non-Jailbroken iOS DevicesAndrey Probochkin · Mobius 2025 Spring
• 36mTesting iOS Apps without Jailbreak in 2018Wojciech Reguła · OWASP AppSec Europe 2018