Billy-Ellis/jitsploitation

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a complete, browser-based exploit for CVE-2020-9802 targeting WebKit on iOS 12.5.7 (iPod7,1). It triggers a JIT compiler bug to achieve arbitrary read/write, bypasses ASLR, and hijacks a vtable to launch the calculator app via a ROP chain.

Backdoor review

No backdoor observed in reviewed code

The artifact is a proof-of-concept exploit for CVE-2020-9802, a WebKit JIT bug. It uses the vulnerability to achieve arbitrary read/write and then hijacks a vtable to launch the iOS Calculator app via a ROP/JOP chain. All behavior is consistent with a normal browser exploit demonstration: triggering the bug, building memory primitives, bypassing ASLR, and executing a hardcoded payload (launching Calculator). No concealed backdoor, credential theft, persistence, or unrelated remote access was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesJavaScriptHTML
Target softwareWebKitJavaScriptCoreiOS 12.5.7
Attack typesarbitrary code executionJIT compiler bugvtable hijackingROP chain
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2020-9802 to corrupt memory, gain arbitrary read/write, bypass ASLR, hijack control flow, and execute a payload (launching the calculator). It is a full end-to-end exploit, not merely a scanner or writeup.

exploit.html:1-442README.md:2

Requirements

  • Victim must visit a malicious web page and click the 'do exploit' button.exploit.html:431
  • Target device must be iPod7,1 running iOS 12.5.7 with hard-coded offsets and no PAC.exploit.html:11-12
  • WebContent process must have the com.apple.springboard.launchapplications entitlement (author notes they cheated by adding it).exploit.html:395-397

Observed behavior

  • Triggers CVE-2020-9802 via the hax() function to corrupt a JSArray length, enabling out-of-bounds read/write.exploit.html:188-205
  • Establishes addrof and fakeobj primitives to leak object addresses and create fake JavaScript objects.exploit.html:237-245
  • Constructs a fake JSArray with a controlled butterfly pointer to gain arbitrary read/write via read64 and write64 functions.exploit.html:264-342
  • Leaks the address of Math.exp to calculate the ASLR slide and resolve the base address of JavaScriptCore.exploit.html:346-360
  • Overwrites the vtable of a WebCore::HTMLDivElement object with a ROP gadget to redirect execution and launch the calculator app.exploit.html:366-424
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Trigger
CVE-2020-9802 JIT bug trigger in function hax()The core vulnerability is triggered to corrupt array length and achieve out-of-bounds read/write.exploit.html:188-205
Arbitrary Read Write
addrof/fakeobj primitives and read64/write64 functionsStandard exploit primitives to read and write arbitrary memory addresses.exploit.html:237-245exploit.html:311-342
Code Execution
Vtable hijack on WebCore::HTMLDivElement to execute ROP/JOP chainThe exploit overwrites a vtable pointer and uses gadgets to call SBSLaunchApplicationWithIdentifier to launch the Calculator app.exploit.html:363-424
Payload
Launch iOS Calculator app via SBSLaunchApplicationWithIdentifierThe final payload is a hardcoded call to launch the Calculator, a common benign demonstration target.exploit.html:391-412
Review boundaries

What the analysis did not establish

  • The exploit is hard-coded for a specific device and iOS version (iPod7,1 iOS 12.5.7) and will not work on other targets without modification.
  • The author states they manually added the com.apple.springboard.launchapplications entitlement to the WebContent process, which is not present by default.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its reliability or effectiveness is not verified.
  • Only the two text files (README.md and exploit.html) were provided; no binary or compiled artifacts were included.
  • The exploit uses hardcoded offsets for a specific device/iOS version; behavior on other targets is not assessed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1