ffs

FFS - S Sistema de Archivos Esta es una herramienta CLI para buscar archivos como grep que no usa el kernel del sistema operativo para leer archivos, sino que lee tus discos directamente. Es prácticamente inútil, pero increíblemente genial. esto es solo 1.5k líneas de código C que: requiere sudo...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

执行摘要 macOS 的 Music 和 TV 存在不安全的重命名操作，导致通过完全控制用户的 TCC.db 来获得 FDA。 我针对每个应用分别提交了漏洞报告，如果适用，可以合并。 根本问题在于这些应用拥有 FDA 权限，但未能对其文件操作进行清理。 利用描述 Music 和 TV 在这方面几乎相同，只是路径不同。此后我将以 Music 为例。TV 的利用代码非常直接，请自行查看。 Music 具有将文件复制到用户资料库的功能，该功能通过一个专用文件夹实现，用户可以在此文件夹中“拖放”文件。 用户只需在 /Music/Music/Media.localized/Automaticall...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

CVE-2025-61229

CVE-2025-61229 描述 来自开发者博客： 用户可设置的 Before/After shell 脚本在提权状态下运行，拥有 SuperDuper 的 TCC 完全磁盘访问权限。由于这些 shell 脚本由复制或计划任务的设置文件引用，恶意攻击者可以修改这些设置以运行自己的脚本。 来自 CVE： Shirt Pocket 的 SuperDuper! 3.10 及更早版本中存在一个问题，允许本地攻击者修改默认任务模板，以 root 权限和完全磁盘访问权限执行任意预飞脚本，从而绕过 macOS 隐私控制。 归属 本作者并非漏洞发现者，SuperDuper...

CVE-2026-65400-poc

CVE-2026-65400 — macOS 屏幕共享预认证 root 文件读取（只读 PoC） 只读概念验证。 它通过从易受攻击主机读取一个仅 root 可读的文件来演示认证绕过。 它不会向目标写入任何内容：不写入 LaunchDaemon、不写入 shell 启动文件、不写入 crontab、 不包含 RCE 利用链。 在本人自有的一台 Mac（macOS Tahoe 26.5.2，未打补丁）上运行。序列号已打码。 摘要 screensharingd —— 驱动 macOS 屏幕共享 / Apple 远程管理 （TCP 5900 ）的守护进程 ——...

PGHoard Path Traversal vulnerability

A vulnerability has been discovered that could allow an attacker to acquire disk access with privileges equivalent to those of pghoard, allowing for unintended path traversal. Depending on the permissions/privileges assigned to pghoard, this could allow disclosure of sensitive information...

PYSEC-2026-1778 PGHoard Path Traversal vulnerability

A vulnerability has been discovered that could allow an attacker to acquire disk access with privileges equivalent to those of pghoard, allowing for unintended path traversal. Depending on the permissions/privileges assigned to pghoard, this could allow disclosure of sensitive information...

CVE-2026-33054 Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard...

CVE-2025-69604

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

EUVD-2025-206519

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

PT-2026-5345

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-69604

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-69604

Shirt Pocket's SuperDuper! (versions 3.11 and earlier) on macOS is vulnerable to a flaw where a local attacker can modify the default task template . This modification allows the installation of an arbitrary package capable of executing shell scripts with root privileges and Full Disk Access , ef...

CVE-2025-69604

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2021-31727

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL...

CVE-2025-64699

An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 EC2007 Kernel v5.22. The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw...

EUVD-2025-206011

An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 EC2007 Kernel v5.22. The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw...

CVE-2025-64699

An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 EC2007 Kernel v5.22. The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw...

CVE-2025-64699

An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 EC2007 Kernel v5.22. The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw...

CVE-2025-64699

An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 EC2007 Kernel v5.22. The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw...