Shelly12

Run SSH on iOS 12 device.

Only worked on iPad Air 1, iOS 12.4

Working

Get root

Set tfp0 to hsp4

Escape Sandbox

Restore/Remount RootFS

Defeat KASLR

Bypass AMFI

Spawn SSH Shell