KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #claude-code #codex #dsh #dsh-plugin #ai-agent #ai-agents #deepseek-harness #agent-skills #macos #cli

bl_sbx

★ 324 Open GitHub ↗

itunesstored & bookassetd sbx escape

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# bl_sbx
## itunesstored & bookassetd Sandbox Escape

This repository contains a proof-of-concept demonstrating how maliciously crafted `downloads.28.sqlitedb` and `BLDatabaseManager.sqlite` databases can escape the sandbox of **itunesstored** and **bookassetd** on iOS. By abusing their download mechanisms, the POC enables writing arbitrary `mobile`-owned files to restricted locations in `/private/var/`, including MobileGestalt cache files—allowing device modifications such as spoofing the device type.

### Key Points
- Compatible with iOS **26.2b1 and below** (tested on iPhone 12, iOS 26.0.1).
- **Stage 1 (itunesstored):** Delivers a crafted `BLDatabaseManager.sqlite` to a writable container.
- **Stage 2 (bookassetd):** Downloads attacker-controlled EPUB payloads to arbitrary file paths.
- Writable paths include:
  - `/private/var/containers/Shared/SystemGroup/.../Library/Caches/`
  - `/private/var/mobile/Library/FairPlay/`
  - `/private/var/mobile/Media/`
- Demonstrates modifying `com.apple.MobileGestalt.plist` to validate successful exploitation.

### Outcome
iOS fails to block crafted download tasks, allowing unauthorized file writes unless the target path requires `root` ownership (or the fileowner is not `mobile`).

**Check the blogpost for more information**

### Disclaimer
This project is for **educational purposes only**.  
Do **not** use it for illegal activities.  
Apple may patch this behavior at any time.

bl_sbx

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README