CVE-2016-7637

This repository contains a functional exploit for CVE-2016-7637, targeting iOS 10.1.1. It includes kernel exploit code, sandbox escape mechanisms, and a root shell payload, demonstrating a local privilege escalation (LPE) vulnerability in the XNU kernel.

This repository contains a functional exploit for CVE-2016-7637, targeting iOS 10.1.1. It includes kernel exploit code, sandbox escape mechanisms, and a root shell payload, demonstrating a local privilege escalation (LPE) vulnerability in the XNU kernel.

This PoC exploits a reference counting bug in macOS's Mach port handling (CVE-2016-7637), allowing a sandboxed process to manipulate another process's port names, potentially leading to privilege escalation or sandbox escape.

This exploit targets a race condition in the `set_dp_control_port` MIG method in macOS/iOS kernels, allowing root-to-kernel privilege escalation. The PoC demonstrates a race condition leading to a use-after-free or reference count manipulation, enabling arbitrary kernel memory manipulation.