Pwn2Own 2021 - Safari Full Chain

This repo contains exploit source code used by RET2 Systems at Pwn2Own 2021. It has been released for educational purposes, with accompanying blogposts for the RCE and EOP. A followup post covers a modified EOP that bypasses KASLR in a different manner (corresponding to the eop_hib directory here).

The exploit was demonstrated on Safari 14.0.3, macOS Big Sur 11.2.3. The Safari vulnerability was patched in Safari 14.1.1, assigned CVE-2021-30734. The Intel graphics driver vulnerability was patched in macOS Big Sur 11.4, assigned CVE-2021-30735.

License

The contents of this repo are licensed and distributed under the MIT license.

Want to learn?

Check out https://ret2.io/trainings