CVE-2020-9802

Classification basis

The code actively exploits CVE-2020-9802 to corrupt memory, gain arbitrary read/write, bypass ASLR, hijack control flow, and execute a payload (launching the calculator). It is a full end-to-end exploit, not merely a scanner or writeup.

Requirements

• Victim must visit a malicious web page and click the 'do exploit' button.exploit.html:431
• Target device must be iPod7,1 running iOS 12.5.7 with hard-coded offsets and no PAC.exploit.html:11-12
• WebContent process must have the com.apple.springboard.launchapplications entitlement (author notes they cheated by adding it).exploit.html:395-397

Observed behavior

• Triggers CVE-2020-9802 via the hax() function to corrupt a JSArray length, enabling out-of-bounds read/write.exploit.html:188-205
• Establishes addrof and fakeobj primitives to leak object addresses and create fake JavaScript objects.exploit.html:237-245
• Constructs a fake JSArray with a controlled butterfly pointer to gain arbitrary read/write via read64 and write64 functions.exploit.html:264-342
• Leaks the address of Math.exp to calculate the ASLR slide and resolve the base address of JavaScriptCore.exploit.html:346-360
• Overwrites the vtable of a WebCore::HTMLDivElement object with a ROP gadget to redirect execution and launch the calculator app.exploit.html:366-424

Observables

Exploit Trigger

Payload withheldThe core vulnerability is triggered to corrupt array length and achieve out-of-bounds read/write.exploit.html:188-205

Arbitrary Read Write

Payload withheldStandard exploit primitives to read and write arbitrary memory addresses.exploit.html:237-245exploit.html:311-342

Code Execution

Payload withheldThe exploit overwrites a vtable pointer and uses gadgets to call SBSLaunchApplicationWithIdentifier to launch the Calculator app.exploit.html:363-424

Payload

Payload withheldThe final payload is a hardcoded call to launch the Calculator, a common benign demonstration target.exploit.html:391-412