SecureUnbreakableIllusion

No flaws, no leaks, no shortcuts. Secure by design, unbreakable illusion.

Please pack your exploit into a regular and installable IPA file. And open a ticket in #open-ticket to start challenge. You will have 10 minutes to pwn the challenge. During the attempt, you can request any form of restart or environment reset.

Note: Flag is in /var/jb/var/root/flag with -r-------- 1 root wheel. We have configured the sandbox profile so the two services in the attachment are reachable within the iOS sandbox.

The flag on device is a UUID string, please demonstrate you can read the content of flag by printing it out or show it on screen. Then we will give you the real flag.

We use an iPhone 8 with iOS 16.7.1 for this challenge. We highly recommend you test your exploitation on jailbroken devices or Corellium or any emulators like t8030-qemu / D22-QEMU first.