"iOS Crypto Heist" CVE-2025-31200 & CVE-2025-31201 iMessage...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201
• Blog Title: "iOS Crypto Heist" | CVE-2025-31200 & CVE-2025-31201 iMessage Zero-Click RCE Chain
• Suggested Section: Mobile Security > iOS Exploitation > iMessage/Media Parser Exploits (CoreAudio/Blastdoor/PAC bypass)

🎯 Content Summary

Post focus: Public disclosure of a two‑vulnerability, zero‑click iOS 18.x remote attack chain reachable via iMessage/SMS media auto‑parsing, with an attached malicious audio sample demonstrating exploitation.

Vulnerabilities
• CVE‑2025‑31200 — Heap corruption in CoreAudio’s AudioConverterService triggered by a specially crafted audio attachment. The bug is reachable during automatic media handling in iMessage/SMS (...

🔧 Technical Details

Zero‑click media parser exploitation via iMessage/SMS auto‑ingestion: Deliver a malformed audio attachment that is automatically parsed by iOS. When CoreAudio’s AudioConverterService processes the file, crafted structures corrupt heap memory, granting code execution without user interaction and reportedly escaping Blastdoor sandboxing.

PAC bypass to convert userland code exec into kernel compromise: After gaining arbitrary R/W from the media process, use a PAC‑related RPAC path bypass (CVE‑2025‑31201) to defeat pointer authentication and obtain stable kernel‑level control, enabling arbitrary memory operations and persistent privilege escalation.

Post‑exploitation abuse of CryptoTokenKit and keychain paths: With kernel‑level access, enumerate and extract key/token material and intercept authentication flows (e.g., messages/2FA). This facilitates wallet draining, silent payment/transfer authorization...

🤖 Agent Actions

I analyzed the repository and existing iOS exploitation content, researched the provided blog and its included technical appendix, and implemented a new page in the most relevant section, plus cross-linking for discoverability.

What I updated/added

• Created a new iOS exploitation technique page:

  • Path: src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md
  • Title: iMessage Media Parser Zero-Click → CoreAudio RCE → PAC/RPAC → Kernel → CryptoTokenKit Abuse
  • Content focuses on the technique (not CVE-centric): zero-click iMessage/SMS media auto-parsing exploitation, CoreAudio/AudioConverterService heap corruption, BlastDoor/Blackhole considerations, PAC bypass via RPAC path, kernel escalation example via AppleBCMWLAN/AMPDU handling, and post-exploitation via CryptoTokenKit/Keychain misuse. Includes concrete log artifacts from the disclosed chain for defensive telemetry.
  • Added “Affected versions” and consolidated “Mitigations and hardening” for defenders/red teams.
  • References: both the blog repo and the technical chain notes used.

• Linked the new page from the iOS Exploiting index:

  • Modified: src/binary-exploitation/ios-exploiting/README.md
  • Added a “iMessage/Media Parser Zero-Click Chains” section with an internal reference to the new page.

Why this location

• The repository already organizes iOS low-level exploitation content under src/binary-exploitation/ios-exploiting.
• The new page abstracts the chain’s techniques (media parser zero-click, PAC/RPAC bypass, kernel escalation, CryptoTokenKit abuse) rather than centering on CVE identifiers, matching HackTricks’ style.
• A link was added in the iOS Exploiting README to ensure discoverability.

References added

• iOS Crypto Heist repo (README): https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201
• Remote Crypto Attack Chain details: https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md

Notes

• I avoided duplicating existing mitigations content that already appears in the iOS Exploiting README, focusing the new page on this specific zero-click media parsing exploitation chain and its post-exploitation consequences.
• The page intentionally abstracts the exploit methodology and logs to provide actionable technical insight while avoiding offensive details.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201

Content Categories: Based on the analysis, this content was categorized under "Mobile Security > iOS Exploitation > iMessage/Media Parser Exploits (CoreAudio/Blastdoor/PAC bypass)".

Repository Maintenance:

• MD Files Formatting: 897 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0