DarkSword — iOS 18 Full-Chain Exploit

Step 1: WebKit RCE
  │  CVE-2025-31277 (iOS 18.4-18.5): JIT type confusion trong JavaScriptCore
  │  CVE-2025-43529 (iOS 18.6-18.7): Garbage collection flaw trong JSC
  ▼
Step 2: WebContent → GPU Sandbox Escape
  │  CVE-2025-14174: ANGLE out-of-bounds memory corruption (WebGL/WebGPU)
  │  → Pivot từ WebContent sandbox vào GPU process
  ▼
Step 3: GPU → mediaplaybackd Sandbox Escape
  │  CVE-2025-43510: Copy-on-Write bug
  │  → Arbitrary function call primitives trong mediaplaybackd
  │  → mediaplaybackd có broader permissions than GPU process
  ▼
Step 4: Load JavaScriptCore trong mediaplaybackd
  │  Không phải vulnerability — technique:
  │  → Load JSC framework vào mediaplaybackd
  │  → Execute JavaScript trong elevated context
  ▼
Step 5: Kernel Exploit
  │  CVE-2025-43520: XNU VFS race condition
  │  → Physical + virtual memory read/write primitives
  ▼
Step 6: Kernel Code Injection
  │  CVE-2025-43521: AppleM2ScalerCSCDriver vulnerability
  │  → Final privilege escalation
  │  → Inject in-memory JavaScript implants vào system processes
  ▼
Full Device Compromise

Component: JavaScriptCore JIT compiler
Type: Type confusion
Target: iOS 18.4-18.5

JIT compiler makes incorrect type assumptions:
  1. Attacker crafts JavaScript triggering JIT compilation
  2. JIT generates native code assuming variable is Type A
  3. At runtime, variable is actually Type B
  4. Type confusion → read/write outside intended bounds
  → Arbitrary read/write trong WebContent process

Component: JavaScriptCore garbage collector
Type: Use-after-free (via GC timing)
Target: iOS 18.6-18.7 (alternative entry when 31277 patched)

Garbage collector frees object while still referenced:
  1. Trigger specific GC timing via JS allocation patterns
  2. Object freed prematurely
  3. Dangling reference → UAF
  → Same end result: arbitrary r/w in WebContent

Component: ANGLE (Almost Native Graphics Layer Engine) — WebGL/WebGPU
Type: Out-of-bounds memory corruption
Role: First sandbox escape (WebContent → GPU process)

WebGL/WebGPU processing crosses process boundary:
  1. Malicious WebGL commands craft bad GPU command buffer
  2. GPU process parses command buffer → OOB write
  3. Code execution trong GPU process
  → GPU process runs với less restrictions than WebContent

Component: XPC / memory management
Type: COW bypass
Role: Second sandbox escape (GPU → mediaplaybackd)

Copy-on-Write should isolate memory between processes:
  1. Shared memory page between GPU process and mediaplaybackd
  2. COW bug: modification visible in both processes
  3. Attacker corrupts data in mediaplaybackd context
  4. → Arbitrary function call primitive trong mediaplaybackd

Tại sao mediaplaybackd:
  - Accessible từ GPU process via XPC
  - Runs với broader entitlements
  - Can load arbitrary frameworks (including JSC)

Component: XNU kernel — Virtual File System layer
Type: Race condition (TOCTOU)
Role: Kernel privilege escalation → physrw

VFS race condition between check and use:
  1. Two threads race on VFS operations
  2. Thread A: check permission/state of vnode
  3. Thread B: change vnode state between check and use
  4. Thread A: use stale state → incorrect kernel behavior
  5. → Physical + virtual memory read/write primitives

Kỹ thuật escalation:
  physrw → page table manipulation → full kernel control

Component: Apple GPU scaler driver
Type: Not fully disclosed
Role: Final privilege escalation + code injection

Used to inject JavaScript implants into system processes:
  - Load JSC into target processes
  - Execute JS trong elevated context
  - Extract data from multiple processes simultaneously

WebContent (very restricted sandbox)
     │
     ├── CVE-2025-14174 (ANGLE OOB)
     ▼
GPU Process (less restricted, but still sandboxed)
     │
     ├── CVE-2025-43510 (COW bug)
     ▼
mediaplaybackd (broad permissions, can load frameworks)
     │
     ├── Load JavaScriptCore
     ├── CVE-2025-43520 (kernel VFS race)
     ▼
Kernel (full control)

Sau khi có kernel r/w:
  1. Inject JSC framework vào target system processes
  2. Execute JavaScript trong context của mỗi process
  3. JavaScript code:
     ├── Extract Safari history, cookies, passwords
     ├── Read WhatsApp/Signal databases
     ├── Access photos, contacts, location
     └── Exfiltrate to C2 server

Advantages:
  - Không có persistent binary trên disk
  - Khó detect (in-memory only)
  - Dễ update payloads (just change JS)
  - Nhưng: không survive reboot

November 2025:
  Saudi Arabian users visiting fake Snapchat messaging site
  → UNC6748 operates site
  → Full device compromise trong minutes, zero-click

Sau đó:
  Multiple threat actors adopt DarkSword
  → Watering hole attacks across 4 countries
  → Targeting journalists, activists, political figures

iOS 18 sandbox quá chặt cho direct WebContent → kernel path
→ Phải chain multiple sandbox escapes
→ Mỗi hop tăng permissions dần dần
→ Attack surface analysis: trace accessible services tại MỖI privilege level

ANGLE (GPU), AppleM2ScalerCSCDriver:
  - Hardware-related code thường complex, less audited
  - Cross-process memory sharing = COW bugs
  → GPU/media drivers là high-value targets

VFS layer (file system) trong XNU:
  - Multi-threaded by nature
  - Complex locking semantics
  - Race windows between check and use
  → Fruitful area cho kernel bug hunting

Native implant vs JS implant:
  Native: persistent, performant, harder to update
  JS: in-memory only, flexible, easy to update, hard to forensics
  → Trend: fileless, memory-only exploitation