This repo contains exploit source code used by RET2 Systems at Pwn2Own 2021.
It has been released for educational purposes, with accompanying blogposts for the RCE and EOP. A followup post covers a modified EOP that bypasses KASLR in a different manner (corresponding to the eop_hib directory here).
The exploit was demonstrated on Safari 14.0.3, macOS Big Sur 11.2.3. The Safari vulnerability was patched in Safari 14.1.1, assigned CVE-2021-30734. The Intel graphics driver vulnerability was patched in macOS Big Sur 11.4, assigned CVE-2021-30735.
The contents of this repo are licensed and distributed under the MIT license.
Check out https://ret2.io/trainings