WebKit Use-After-Free Arbitrary Code Execution

This repository is a proof-of-concept (POC) exploit for CVE-2023-28205, a use-after-free vulnerability in Apple WebKit. The repository contains 13 files, including JavaScript modules for memory manipulation, an HTML file (index.html) that serves as the exploit entry point, a main exploit script (poc.js), and a simple Python HTTP server (server.py) for local hosting. The exploit is triggered by visiting the HTML page in a vulnerable browser, which loads poc.js and executes the exploit logic. The JavaScript code manipulates Map and Date objects to trigger a use-after-free condition, then attempts to demonstrate memory reuse or browser crash, indicating exploitability. The code is modular, with supporting files for low-level memory operations, heap spraying, and debugging. No weaponized payload is included; the POC demonstrates the vulnerability and memory corruption potential. The exploit targets Apple WebKit on macOS and iOS platforms. The server.py script allows easy local hosting of the exploit files for testing.

This repository is a proof-of-concept (POC) exploit for CVE-2023-28205, a use-after-free vulnerability in Apple WebKit. The structure includes a Python HTTP server (server.py) to serve the exploit files, an HTML file (index.html) that loads the exploit, and a JavaScript POC (poc.js) that triggers the vulnerability by manipulating Map and Date objects to induce a use-after-free condition. The 'module/' directory contains supporting JavaScript modules for memory manipulation and exploitation primitives, suggesting the code is designed for advanced browser exploitation research. The exploit is intended to be run in a browser environment, targeting vulnerable versions of WebKit (Safari on macOS/iOS). No weaponized payload is included; the POC demonstrates the bug and can cause a browser crash or potentially arbitrary code execution if further developed.