WebKit memory corruption RCE in Apple iOS

This repository contains a proof-of-concept (PoC) exploit for CVE-2016-4657, a memory corruption vulnerability in the WebKit JavaScript engine affecting iOS 9.3 and the Nintendo Switch captive portal browser. The main exploit is implemented in 'attack.html', which uses advanced JavaScript techniques to manipulate memory and trigger the vulnerability. The exploit is designed to be run in a browser environment, specifically targeting the Nintendo Switch's captive portal (which uses a WebKit-based browser) or vulnerable versions of iOS Safari. The 'index.html' file serves as a landing page that detects the Nintendo Switch user agent and redirects to the exploit. The 'README.md' provides a brief overview and references a technical article for further reading. The 'tuto.md' is a detailed technical write-up on JavaScript engine exploitation, not directly part of the exploit but useful for understanding the context. The exploit demonstrates the vulnerability by corrupting array lengths and alerting the user, and may cause the browser to crash, showing exploitability. No weaponized payload is included; this is a research PoC.

This repository is a proof-of-concept (PoC) exploit for CVE-2016-4657, a WebKit vulnerability, targeting the Nintendo Switch's browser. The structure includes a minimal custom browser written in C++ (main.cpp) for Debian Linux, which simulates the Nintendo Switch user agent and loads an online exploit page. The main exploit logic is implemented in JavaScript (exploit/jailbreak.js) and is loaded via an HTML page (exploit/index.html). The exploit attempts to trigger a memory corruption bug in WebKit, resulting in a browser crash on the Nintendo Switch. The repository is intended for academic purposes and does not provide a persistent jailbreak or code execution, but demonstrates the feasibility of exploiting the vulnerability. The codebase includes supporting files for logging (exploit/logger.js) and styling (exploit/style.css). The only network endpoint directly targeted is the hosted exploit page (https://idan5x.github.io/Switcheroo/), which is loaded by the custom browser.