launchd-portrep

launchd-portrep launchd-portrep は、macOS の最初のユーザースペースプロセスでありサービス管理デーモンである launchd におけるポート置換の脆弱性を利用したエクスプロイトです。ブートストラップポートに細工した Mach メッセージを送信することで、攻撃者も送信権を持つ任意の Mach ポートについて、launchd にその送信権を解放させることができます。これにより、攻撃者はシステムの他の部分に対して、検索できる任意の launchd サービスになりすますことができます。 The vulnerability Launchd...

POC-CVE-2018-4327-and-CVE-2018-4330

brokentooth CVE-2018-4327 の POC（少なくともそうだと思います。CVE-2018-4327 と CVE-2018-4330 は両方とも @SparkZheng によって記述されましたが、どちらがどのバグに関連するかは書かれていません。彼が最初にこれを説明したので、推測しています）。 iPhone 6S 11.3.1 でテスト済み 11.4 までは動作するはず SpringBoard およびいくつかのサービス上で、PC（ARM における IP レジスタ相当）を好きな値に設定できます。 コードを実行し、設定の BT...

toothfairy

toothfairy brokentooth（下記リンク）に関連しています。 brokentoothとは異なり、toothfairyはBluetoothメニューでボタンを押す必要がありません。 両方のCVEは@SparkZhengによって公開されましたが、POCがなかったため、学習目的でPOCを作成することにしました。 コードは完璧ではありませんが、目的は果たせます。 iPhone 6S 11.3.1でテスト済み。 11.4までは動作するはずです。 bluetoothdおよびその他のいくつかのサービスで、PC（ARM版のIPレジスタ）を任意の値に設定できます。...

brokentooth

brokentooth CVE-2018-4327 の POC（少なくとも私はそう考えています。CVE-2018-4327 と CVE-2018-4330 はどちらも @SparkZheng によって議論されましたが、どちらのバグがどれに対応するのかは彼からは明確ではありません。彼が最初に説明したのがこれだったので、推測しています）。 iPhone 6S 11.3.1 でテスト済み 11.4 までは動作するはずです SpringBoard といくつかのサービス上で、PC（IP レジスタの ARM 版）を任意の値に設定できます。コードを実行してから BT...

macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to Invalid mach Message Parsing in _xpc_serializer_unpack

/ xpcserializerunpack in libxpc parses mach messages which contain xpc messages. There are two reasons for an xpc mach message to contain descriptors: if the message body is large, then it's sent as a MACHMSGOOLDESCRIPTOR. Also if the message contains other port resources eg memory entry ports th...

voucher_swap: Exploiting MIG reference counting in iOS 12

Posted by Brandon Azad, Project Zero In this post I'll describe how I discovered and exploited CVE-2019-6225, a MIG reference counting vulnerability in XNU's taskswapmachvoucher function. We'll see how to exploit this bug on iOS 12.1.2 to build a fake kernel task port, giving us the ability to re...

Apple iOSmacOS - Sandbox Escape due to mach Message sent from Shared Memory

Apple iOSmacOS - Sandbox Escape due to mach Message sent from Shared Memory iohideventsystem sets up a shared memory event queue; at the end of this shared memory buffer it puts a mach message which it sends whenever it wants to notify a client that there's data available in the queue. As a clien...

Apple iOS/macOS - Sandbox Escape due to mach Message sent from Shared Memory

iohideventsystem sets up a shared memory event queue; at the end of this shared memory buffer it puts a mach message which it sends whenever it wants to notify a client that there's data available in the queue. As a client we can modify this mach message such that the server hidd on MacOS,...

Apple iOS / macOS - Sandbox Escape due to mach Message sent from Shared Memory Exploit

Exploit for multiple platform in category dos / poc Apple iOS/macOS - Sandbox Escape due to mach Message sent from Shared Memory iohideventsystem sets up a shared memory event queue; at the end of this shared memory buffer it puts a mach message which it sends whenever it wants to notify a client...

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 bluetoothd Memory Corruption

// // main.m // bluetoothdPoC // // Created by Rani Idan. // Copyright Ac 2018 zLabs. All rights reserved. // import "AppDelegate.h" include extern kernreturnt bootstraplookupmachportt bs, const char servicename, machportt service; / When hijacking session between bluetoothd and client, add...

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 - bluetoothd Memory Corruption Exploit

Exploit for iOS platform in category dos / poc // // main.m // bluetoothdPoC // // Created by Rani Idan. // Copyright © 2018 zLabs. All rights reserved. // import "AppDelegate.h" include extern kernreturnt bootstraplookupmachportt bs, const char servicename, machportt service; / When hijacking...

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 - 'bluetoothd' Memory Corruption

// // main.m // bluetoothdPoC // // Created by Rani Idan. // Copyright © 2018 zLabs. All rights reserved. // import "AppDelegate.h" include extern kernreturnt bootstraplookupmachportt bs, const char servicename, machportt service; / When hijacking session between bluetoothd and client, add callba...

MacOS Kernel 10.12 - Double vm_deallocate in Userspace MIG Code Use-After-Free Exploit

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=954 Proofs of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40954.zip Userspace MIG services often use machmsgserver or...

MacOS Kernel < 10.12.2 / iOS < 10.2 - Broken Kernel Mach Port Name uref Handling Privileged Po

Exploit for multiple platform in category local exploits / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=959 Proofs of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40957.zip When sending and receiving mach messages from userspa...

Apple OS XiOS - mach_ports_register Multiple Memory Safety s

Apple OS XiOS - machportsregister Multiple Memory Safety s Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=882 machportsregister is a kernel task port MIG method. It's defined in MIG like this: routine machportsregister targettask : taskt; initportset : machportarrayt = ^array o...

Apple Mac OSX - 'gst_configure' Kernel Buffer Overflow

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=596 The external method 0x206 of IGAccelGLContext is gstconfigure. This method takes an arbitrary sized input structure passed in rsi but doesn't check the size of that structure passed in rcx. text:000000000002A366...

Code injection

The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed...

CVE-2015-7047

CVE-2015-7047 is a local privilege-escalation vulnerability affecting Apple platforms: iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1. The issue arises from a crafted mach message that is misparsed by the kernel, enabling a local user to gain privileges. Public explo...

CVE-2015-7047

The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed...