modernpwner / cicuta_virosa Goto Github PK

View Code? Open in Web Editor NEW

437.0 72.0 77.0 32 KB

License: GNU General Public License v3.0

C 100.00%

cicuta_virosa's Introduction

cicuta_virosa

iOS\iPadOS 14.3 kernel LPE for all devices by @ModernPwner. Please follow us on twitter :)

Current state

Exploit works :)
Need a lot of cleanup + more stable primitives that not relaying on memory reallocation. Use it on your own risk
Exploit will take more then 2 minutes because we can't understand how to properly bypass one stupid sanity check in kernel on "Stage 3: Convert uaf into pktopts uaf" (we'll fix it soon)
Reliability is amazing on our A13 and A10 devices

The vuln

CVE-2021-1782: A race condition in user_data_get_value() leading to ivac entry uaf. This issue has been actively exploited in the wild with the WebKit exploit. We might release this RCE chain in the future.

Writeup

Soon.

How to build it

We don't like to commit Xcode project file. Create your own XCode project, add files and call "cicuta_virosa" function.

Credits

Some utils (exploit_utilities.c): @Jakeashacks
Vuln: Apple

License

If you want to use it in your project under GPL not-compatible license - please DM us to get permissions.
We give permissions to @CStar_OW to use and modify the exploit for Odyssey - the best jailbreak :).
But we hope that all modifications will be open sourced.

PAC bypass

For the moment we have a brand new technique to bypass PAC but we decided to not include such critical stuff here.
Maybe we'll post a PAC bypass along with the iOS 14.5 exploit. This is in progress, we may publish 14.5 exploit after Apple patch.

cicuta_virosa's People

Contributors

Stargazers

Watchers

cicuta_virosa's Issues

This isn't an issue but.. TYSM!!!

TYSM!!!! WOO JAILBREAK NEWS!!

iOS 14.5 RELEASED!!

Sooo i don’t completely understand the security patches on this update. Someone elaborate or look it over if someone is familiar with it.

uaha

Jajz

2 out of 3 devices panic if app is stopped in Xcode or force closed

if you try to close the app or stop its process after exploiting is complete the whole system panics and crashes, tested on Xr 14.3 and iPhone 8 14.3, only device that allowed the app to be closed without panic was the iphone 7 14.1 iirc. what is the reason behind this crash?

Is there detailed instructions on how to make this?

I don't use Xcode to put it straight and idk how to build it. Is there any way someone could make detailed instructions or better yet build it for me? Thx in advance!

https://cdn.yalujailbreak.net/wp-content/uploads/2019/11/Screen-Shot-2019-11-10-at-10.08.47-PM.png

-

You still alive???

So this project is dead right? It hasn't received an update In months

Use Request

Me and my team would like to make a jailbreak using this exploit. It will be entirely private until release then public and open source with full credits to your team.

iOS 14.5 no longer signed

iOS 14.5 is no longer signed and we haven't heard any news on your pac bypass are we to assume your pac bypass is no good? Should we forget about a future jailbreak on iOS 14.4 to 14.5

🙃

iOS 14.5.1 (maybe it's same as 14.5)

Have you discovered more secure vulnerabilities for iOS 14.5.1 that you could publish soon in 2021/2022

(NONE)

Dead project for iOS 14.4+

Jailbreak update? Now that iOS 14.5 is no longer signed

Now that iOS 14.5 is no longer signed will we see any news or update anytime soon? As for your PAC bypass will that support iOS 14.5 or lower such as iOS 14.4 and so on

Hello 👋

So this is a shoot in the dark but can you give the same permissions you give to the odyssey team to the unc0ver team can just make it fair between both as I believe in the freedom of choosing what JB tool you want as some people find unc0ver better the odyssey while other find odyssey better I get that it's your exploit and you are the one who makes the rules but I wish that you get my point and consider giving the unc0ver team the same permission as the odyssey team