ant4g0nist/Vulnerable-Kext：一个仍在开发中的“设计即脆弱”kext，用于 iOS/mac

项目介绍

ant4g0nist/Vulnerable-Kext 是一个托管在 GitHub 上的开源项目，主要使用 C 编写，采用 MIT License 许可证，目前获得 239 个 Star、34 次 Fork。

仓库全名: ant4g0nist/Vulnerable-Kext

README 摘要

Vulnerable Kext A WIP (work-in progress) "Vulnerable by Design" kext for iOS/macOS to play/learn with OS kernel exploitation Usage Documentation can be found at https://fuzzing.science/vulnerable-kext Basic setup requirements iOS device that can be jailbroken with checkra1n Currently the make files are made to be used on a Mac. So, a macOS device or a VM. Running the following command causes checkra1n to listen for…

完整内容见 GitHub 原始 README 或本页。

常见问题

Vulnerable-Kext 用什么语言开发？

主要使用 C 编写，采用 MIT License 许可证，目前有 239 个 Star。

Vulnerable-Kext 可以免费商用吗？

如何获取 Vulnerable-Kext 的源码？

可以直接克隆仓库：git clone https://github.com/ant4g0nist/Vulnerable-Kext.git，默认分支为 main；安装与运行步骤见仓库 README。

Vulnerable-Kext 最近还在维护吗？

仓库最近一次更新为 2020年12月29日，当前没有未关闭的 Issue；Star 数为 239，可作为社区活跃度的参考。

关于

GitHub 原始描述（英文）

A WIP "Vulnerable by Design" kext for iOS/macOS to play & learn *OS kernel exploitation

driver exploit-development exploitation ios kernel macos memory-corruption vulnerabilities xnu

MIT License
239 Stars
34 Forks
1 Watching

描述取自 GitHub 官方 API，保持仓库作者书写的原文。

简要分析

热度分

308

价值分

153

活跃状态

归档

GitHub

Vulnerable Kext

A WIP (work-in progress) “Vulnerable by Design” kext for iOS/macOS to play/learn with *OS kernel exploitation

Usage

Documentation can be found at https://fuzzing.science/vulnerable-kext
Basic setup requirements
- iOS device that can be jailbroken with checkra1n
- Currently the make files are made to be used on a Mac. So, a macOS device or a VM.
Running the following command causes checkra1n to listen for attached iOS devices in DFU mode and boot pongoOS:

/Applications/checkra1n.app/Contents/MacOS/checkra1n -c -p

Run run.sh to build kext_loader, pongo_module, and the vulnerable kext and to start kext_loader kext_loader waits for a device that’s booted pongo shell!

./run.sh

For more details about ktrw, check ktrw

Disclaimer

Vulnerable-Kext is an intentionally vulnerable kext for iOS/macOS, meant for educational purpose only.

TODO

Add IOKit stuff
Add vulnerabilities from reported XNU/IOKit bugs? 🤔
Maybe improve stability of loading kexts
Fix the bugs in the vulnerabilities I implemented 🧐
Add Writeups for exploitation

credits

@_bazad for the super awesome ktrw
checkra1n team for the jailbreak
Used the kext template from twic

暂无评论

Vulnerable-Kext