DarkSword-RCE Analysis

Educational/Defensive Cybersecurity Research Repository

This repository contains reverse engineering analysis of the DarkSword iOS exploit chain captured in-the-wild. The analysis is for defensive purposes only - understanding exploit techniques to build better protections.

⚠️ Disclaimer

This repository contains analysis only - no working exploit code. The original exploit code is referenced from htimesnine/DarkSword-RCE for research purposes.

Do NOT use this information for malicious purposes.

Repository Contents

File	Description
ANALYSIS.md	Comprehensive technical documentation of the exploit chain
research_analyzer.py	Static analysis tool for detecting exploit patterns
attack_flow.py	Attack flow diagram generator
analysis_report.txt	Automated analysis results

Exploit Chain Overview

Delivery → WebKit RCE → Sandbox Escape → Kernel Exploit → Data Theft → Exfiltration

Attack Phases

1. Delivery: Malicious link → Hidden iframe → Payload loader
2. WebKit RCE: Type confusion exploit (addrof/fakeobj primitives)
3. Sandbox Escape: GPU process exploitation via IOSurface
4. Privilege Escalation: Kernel exploit for root access
5. Data Theft: Process injection into keychain, WiFi, iCloud
6. Exfiltration: Data sent to C2 server

Key Findings

C2 Infrastructure

• Domain: static.cdncounter.net
• Endpoint: /log.html

Targeted iOS Versions

• iOS 18.4
• iOS 18.6, 18.6.1, 18.6.2

Targeted Devices

• iPhone11,2 through iPhone17,5

Exploit Techniques

• ✅ Type confusion (JavaScriptCore)
• ✅ PAC bypass (ARM Pointer Authentication)
• ✅ Kernel read/write
• ✅ Process injection
• ✅ Data exfiltration

Usage

Run Analysis

# Analyze all files in directory
python3 research_analyzer.py --analyze-dir /path/to/exploit/files

# Extract strings from payload
python3 research_analyzer.py --extract-strings pe_main.js

# Detect C2 patterns
python3 research_analyzer.py --detect-c2 /path/to/files

Generate Diagrams

# Requires graphviz
pip install graphviz
python3 attack_flow.py

Defensive Recommendations

1. Update iOS - Apple has patched these vulnerabilities
2. Block C2 domain - static.cdncounter.net
3. Monitor network - Watch for /log.html endpoints
4. Deploy EDR - Detect process injection patterns

References

• Google Cloud Threat Intelligence - DarkSword Analysis
• Original Repository

License

Educational/Research use only.

---

Created for cybersecurity research and defensive purposes.