Mobile Hacking Labs
Lens Pic
LensPic is a photo-sharing app for iPhone - filters, stories, and a DM inbox where users send each other pictures. It ships with LensKit, a small internal library the developers use for on-device rendering. Somewhere in that pipeline, LensPic trusts data it shouldn't, and LensKit trusts LensPic more than it should.
Your target device has LensPic pre-installed and running. Every player gets their own personal inbox — anything you send there, the app will try to open..
Objective
Get LensPic to execute code of your choosing for real, with a valid ARM64 Pointer Authentication signature, not just a lucky crash, and read the flag.
This app runs on arm64e. Pointer Authentication is supposed to make it effectively impossible to redirect execution to an address you don't already have a legitimately-signed pointer to. Somewhere in this app, that guarantee doesn't hold.
Skills Required
- Reverse Engineering: Proficiency in disassembling and analyzing compiled code.
- Exploitation of low level memory corruption bugs
