CVE-2017-7047

This exploit leverages a logic error in libxpc (CVE-2017-7047) to send xpc_data objects backed by shared memory, allowing the sender to modify the memory while the receiver processes it. It targets NSXPC services, such as airportd, to achieve controlled memory corruption via a race condition.

This repository contains a proof-of-concept exploit for CVE-2017-7047, targeting a logic error in libxpc on iOS devices prior to 10.3.3. The exploit leverages a race condition to send malicious xpc_data objects backed by shared memory, ultimately achieving root privileges and task_for_pid capabilities.

This is a proof-of-concept exploit for CVE-2017-7047, targeting a logic error in libxpc on iOS. It leverages a heap overflow primitive to achieve remote code execution and deploy a custom lldb debugserver stub for debugging arbitrary processes.