CVE-2023-28206 PoC — Apple macOS Ventura 缓冲区错误漏洞

Source

https://github.com/acceleratortroll/acceleratortroll

Associated Vulnerability

Title:Apple macOS Ventura 缓冲区错误漏洞 (CVE-2023-28206)
Description:An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Description

Abusing CVE-2023-28206 to make something useful

Readme

# AcceleratorTroll™ <img src="acceleratortroll/Assets.xcassets/AppIcon.appiconset/acceleratortroll.png" width="140px" style="float: right;">
Abusing CVE-2023-28206 to make something useful. 

## Roadmap
Right now, we are still trying to understand how the vulnerability works and how to exploit it for anything other than panics.

 - Prove that the vulnerability can be used to obtain kernel privileges.
 - Obtain a krw exploit.
 - Run an SSH Server.
 - Allow for running unsigned code or fakesigned code.
 - Control UICache to install apps.


## Credits

Contributors:
 - App made by [Jan](https://github.com/JanCraft)
 - Logo made by [iframe:3](https://github.com/vmhl87)
 - MeoRW made by [May.](https://github.com/TheFunnyMan16)

Credits:
 - PoC by [Linus Henze](https://github.com/LinusHenze)
 - WeightBufs by [Mohamed Ghannam](https://github.com/0x36)

File Snapshot


 [4.0K]  /data/pocs/9cf6a8a92b09f4f558895a3710dfe527c6cdc171
├── [4.0K]  acceleratortroll
│   ├── [ 227]  acceleratortrollApp.swift
│   ├── [ 342]  acceleratortroll-Bridging-Header.h
│   ├── [ 259]  acceleratortroll.entitlements
│   ├── [1.5K]  ArsenalView.swift
│   ├── [4.0K]  Assets.xcassets
│   │   ├── [4.0K]  acceleratortroll.imageset
│   │   │   ├── [276K]  acceleratortroll.png
│   │   │   └── [ 314]  Contents.json
│   │   ├── [4.0K]  AccentColor.colorset
│   │   │   └── [ 226]  Contents.json
│   │   ├── [4.0K]  AppIcon.appiconset
│   │   │   ├── [276K]  acceleratortroll.png
│   │   │   └── [ 220]  Contents.json
│   │   └── [  63]  Contents.json
│   ├── [1.5K]  HomeView.swift
│   ├── [ 181]  Info.plist
│   ├── [ 616]  InfoView.swift
│   ├── [ 915]  MainView.swift
│   ├── [4.0K]  meorw
│   │   ├── [2.3K]  ANEDirectIn.c
│   │   ├── [1.1K]  ANEDirectIn.h
│   │   ├── [7.9K]  aneProgram.h
│   │   ├── [4.0K]  AppleNeuralEngine
│   │   │   ├── [2.0K]  _ANEClient.h
│   │   │   ├── [ 546]  _ANECloneHelper.h
│   │   │   ├── [1.7K]  _ANEDaemonConnection.h
│   │   │   ├── [ 866]  _ANEDaemonProtocol.h
│   │   │   ├── [ 615]  _ANEDataReporter.h
│   │   │   ├── [1.8K]  _ANEDeviceController.h
│   │   │   ├── [ 525]  _ANEDeviceInfo.h
│   │   │   ├── [ 819]  _ANEErrors.h
│   │   │   ├── [ 530]  _ANEHashEncoding.h
│   │   │   ├── [ 884]  _ANEIOSurfaceObject.h
│   │   │   ├── [ 456]  _ANELog.h
│   │   │   ├── [3.8K]  _ANEModel.h
│   │   │   ├── [1.4K]  _ANEPerformanceStats.h
│   │   │   ├── [2.6K]  _ANEProgramForEvaluation.h
│   │   │   ├── [ 765]  _ANEQoSMapper.h
│   │   │   ├── [2.6K]  _ANERequest.h
│   │   │   ├── [1.2K]  _ANEStrings.h
│   │   │   ├── [ 731]  AppleNeuralEngine.h
│   │   │   ├── [ 557]  AppleNeuralEngine-Structs.h
│   │   │   ├── [ 423]  NSCopying.h
│   │   │   └── [ 435]  NSSecureCoding.h
│   │   ├── [ 226]  build_macos.sh
│   │   ├── [ 73K]  exploit
│   │   ├── [2.7K]  exploit.h
│   │   ├── [ 54K]  exploit.m
│   │   ├── [6.5K]  IOGPU.c
│   │   ├── [3.7K]  IOGPU.h
│   │   ├── [4.3K]  iokit.h
│   │   ├── [9.3K]  IOSurface.c
│   │   ├── [2.1K]  IOSurface.h
│   │   ├── [ 64K]  model_tmp.hwx
│   │   └── [3.4K]  utils.c
│   ├── [ 33K]  mymodel.mlmodel
│   ├── [4.1K]  PoC.m
│   ├── [4.0K]  Preview Content
│   │   └── [4.0K]  Preview Assets.xcassets
│   │       └── [  63]  Contents.json
│   ├── [ 590]  RebootModal.swift
│   ├── [3.6K]  respring.m
│   └── [ 256]  util.m
├── [4.0K]  acceleratortroll.xcodeproj
│   ├── [ 35K]  project.pbxproj
│   ├── [4.0K]  project.xcworkspace
│   │   ├── [ 135]  contents.xcworkspacedata
│   │   └── [4.0K]  xcshareddata
│   │       └── [ 238]  IDEWorkspaceChecks.plist
│   ├── [4.0K]  xcshareddata
│   │   └── [4.0K]  xcschemes
│   │       ├── [2.9K]  acceleratortroll-debug.xcscheme
│   │       └── [2.9K]  acceleratortroll.xcscheme
│   └── [4.0K]  xcuserdata
│       └── [4.0K]  jancr.xcuserdatad
│           └── [4.0K]  xcschemes
│               └── [ 624]  xcschememanagement.plist
├── [1.0K]  LICENSE
└── [ 859]  README.md

17 directories, 63 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!