Apple 

Safari RCE – $80K USD

  • Works on iPhone 11 or on MacOSX , latest version. 

iOS PE

  • iPhone XR –  $60K USD

         o From App / user to Kernel

         o Latest version

  • iPhone 11 – $80K USD

         o From App / user to Kernel

         o Latest version

 Linux

LPE – $50K USD

  • User to root
  • PE should bypass LSM (Linux Security Module) such as AppArmor and SELinux
  • PE Should run on latest versions on at least 2 of the following distributions:

         o Ubuntu – currently 19.4

         o Debian – currently 9

         o Fedora – currently 29

         o CentOS – currently 7

  • PE should gain root unconfined.
  • Minimum Kernel version – 4.x
  • On field – will be tested on ubuntu.

Chrome

RCE – $80K USD

  • Runs on latest version
  • Works on latest version
  • Achieves shellcode with breakpoint popped out
  • Runs on Windows latest Build, 64-bits

SBX

Note – One prize would be given to participants that their SBX applies to both categories

 Chrome SBX on Windows – $80K USD

  • The vulnerability has to be in Chrome browser
  • Researcher should patch Chrome’s sources in order to demonstrate the exploit.
  • Will take the researcher an hour to test

o Should be well documented, otherwise it would take longer

Android

SBX

  • Galaxy A10 – SM-10- $50K USD

o Android 10

o Should run code on 64-bit

o Latest kernel, latest security update

  • Pixel 4 – $80K USD

o Android 10

o Latest kernel, latest security update

o Should run code on 64-bit

 Android Kernel PE

  • Galaxy A10 – SM-10 – $50K USD

o Android 10

o Latest kernel, latest security update

o Exploit has to run code and gain root from untrusted_app

  • Pixel 4 – $80K USD

o Android 10

o Latest kernel, latest security update

o Exploit has to run code and gain root from untrusted_app

 

 Windows

PE

  • Medium to System – $10K USD
  • Should work on latest version (19H2) on default Windows configurations.
  • Success measurement(One of the above):

o Raise a bp in a system process

o Pop cmd in system privileges

o Run an arbitrary shellcode with system privileges

  • From Chrome Sandbox to Kernel – $40K USD

o Should work on latest version (19H2) on default Windows configurations.

o Success measurement(One of the above):

o Raise a bp in the kernel

o Pop cmd in high privileges

o Run an arbitrary shellcode in the kernel

o BSOD (researcher will probably get a lower prize)

o HVCI Bypass – $50K USD

o From system to kernel, when HVCI turned on

o Should work on latest version (19H2 – latest insider), on default Windows configurations.

o Success measurement

o Run an arbitrary shellcode with an arbitrary size in the kernel (shellcode / unsigned driver)

 Exchange 

All items below must work on at least one of the latest version of Exchange 2013, Exchange 2016 or Exchange 2019

Pre Authentication RCE – $75K USD

o Run Code with Exchange permissions (nt system)

o write file to the disk (WebShell)

o must work on default configurations

o remote code execution on Exchange without authentication

o success measurement

Post Authentication RCE – $60K USD

o Run Code with Exchange permissions (nt system)

o write file to the disk (WebShell)

o must work on default configurations

o Remote code execution on Exchange server after authentication

o Success measurement

Impersonation – $40K USD

o Successfully read and write emails as any user in the system, while authenticated as other.

o must work on default configurations

o Impersonation Vulnerability

o Success measurement – 

Aauthentication bypass – $40K USD

o login as user for one or more of Exchange interfaces (OWA, EWS, Etc..) and read and write emails.

o must work on default configurations

o Success measurement