Apple Mac OSX Kernel - IOAccelDisplayPipeUserClient2 Use-After-Free

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=565 Kernel UaF with IOAccelDisplayPipeUserClient2 with spoofed no more senders notifications repro: while true; do ./iospoofig4; done Likely to crash in various ways; have observed NULL derefs and NX traps. Tested on...

Apple Mac OSX - Kernel no-more-senders Use-After-Free

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=567 Kernel UaF due to audit session port failing to correctly account for spoofed no-more-senders notifications Tested on ElCapitan 10.11 15a284 on MacBookAir 5,2 / //...

Apple Mac OSX iOS - Unsandboxable Kernel Code Exection Due to iokit Double Release in IOKit

Apple Mac OSX iOS - Unsandboxable Kernel Code Exection Due to iokit Double Release in IOKit Source: https://code.google.com/p/google-security-research/issues/detail?id=620 I wanted to demonstrate that these iOS/OS X kernel race condition really are exploitable so here's a PoC which gets RIP on OS...

Apple Mac OSX - Kernel IOAccelMemoryInfoUserClient Use-After-Free

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=566 Kernel UaF with IOAccelMemoryInfoUserClient with spoofed no more senders notifications repro: while true; do ./iospoofig7; done Tested on ElCapitan 10.11 15a284 on...

Apple Mac OSX - Kernel Hypervisor Driver Use-After-Free

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=580 The hvspace lock group gets an extra ref dropped when you kill a process with an AppleHV userclient; one via IOService::terminateWorker calling the AppleHVClient::fre...

Technical analysis: Apple syslogd to mention the right vulnerability, affecting numerous iOS and OSX version of the CVE-2 0 1 6-1 7 2 2-a vulnerability warning-the black bar safety net

! This iOS 9.2.1 the latest update, Apple fixes a code execution vulnerability, and is by Zimperium zLabs two fellows Nikias Bassen and Joshua J. Drake in syslogd in the discovery. In this article, we will share how to determine the vulnerability and the vulnerability behind can allow an attacker...

Critical OpenSSH Flaw Leaks Private Crypto Keys to Hackers

A 'Serious' security vulnerability has been discovered and fixed in OpenSSH – one of the most widely used open-source implementations of the Secure Shell SSH Protocol. The critical vulnerability could be exploited by hackers to force clients to leak their secret private cryptographic keys,...

Penbox - A Tool That Has All The Tools, Penetration Tester'S Repo

PenBox A Penetration Testing Framework , The Hacker's Repo our hope is in the last version we will have evry script that a hacker needs : Requirements Python 2 sudoer Versions Version v1.1 : DrupalHacking : 1: Drupal Bing Exploiter 2: Get Drupal Websites 3: Drupal Mass Exploiter PrivatTools: 1 Ge...

WordPress JS External Link Info 1.21 Open Redirect

%%%%%%%%%%%%% : : Exploit Title : Wordpress Js External Link Info Open Redirect : : Exploit Author : Ashiyane Digital Security Team : : Date: 11 01 2016 : : Tested On : Windows / Linux / OSX : : Vender : Wordpress.org : : Version : 1.21 : : Google Dork :...

CVE-2015-8071

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute...

Write Messages to Users

This module utilizes the wall1 or write1 utilities, as appropriate, to send messages to users on the target system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Write Messages to Users',...

LastPass Vault Decryptor

This module extracts and decrypts LastPass master login accounts and passwords, encryption keys, 2FA tokens and all the vault passwords This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' require 'sqlite...

Apple iOS/OS X/watchOS ImageIO memory corruption vulnerability (CNVD-2015-07102)

OS X formerly Mac OS X is the latest version of Apple's proprietary operating system for the Macintosh computer. iOS is an operating system developed by Apple for mobile devices. A security vulnerability exists in Apple iOS versions prior to 9.1, OS X versions prior to 10.11.1, and watchOS versio...

Safari User-Assisted Applescript Exec Attack Exploit

Exploit for macOS platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Safari User-Assisted Applescript Exec Attack', 'Description' = %q In versions...

Mac OS X rsh Environment Variables Privilege Elevation

Added: 10/15/2015 CVE: CVE-2015-5889 Background The remotecmds component of Apple Mac OS X contains an rsh binary program that allows a user to execute commands on another computer across a computer network. Problem The rsh binary in the remotecmds component of Mac OS X versions prior to 10.11...

Immunity Canvas: OSX_RSH_LIBMALLOC

Name| osxrshlibmalloc ---|--- CVE| CVE-2015-5889 Exploit Pack| CANVAS Description| OS X rsh/libmalloc local privilege escalation Notes| Repeatability: Multiple Times Notes: Exploit should work on many different versions of MacOS X 64bit, but it has been specifically tested on: - 10.10.3 - 10.10.1...

issetugid() + rsh + libmalloc OS X Local Root

CVE-2015-5889: issetugid + rsh + libmalloc osx local root tested on osx 10.9.5 / 10.10.5 jul/2015 by rebel import os,time,sys env = s = os.stat"/etc/sudoers".stsize env'MallocLogFile' = '/etc/crontab' env'MallocStackLogging' = 'yes' env'MallocStackLoggingDirectory' = 'a\n root echo "ALL ALL=ALL...

Apple Mac OSX 10.9.5/10.10.5 - 'rsh/libmalloc' Local Privilege Escalation

CVE-2015-5889: issetugid + rsh + libmalloc osx local root tested on osx 10.9.5 / 10.10.5 jul/2015 by rebel import os,time,sys env = s = os.stat"/etc/sudoers".stsize env'MallocLogFile' = '/etc/crontab' env'MallocStackLogging' = 'yes' env'MallocStackLoggingDirectory' = 'a\n root echo "ALL ALL=ALL...

Apple Mac OSX 10.9.510.10.5 - rshlibmalloc Local Privilege Escalation

Apple Mac OSX 10.9.510.10.5 - rshlibmalloc Local Privilege Escalation CVE-2015-5889: issetugid + rsh + libmalloc osx local root tested on osx 10.9.5 / 10.10.5 jul/2015 by rebel import os,time,sys env = s = os.stat"/etc/sudoers".stsize env'MallocLogFile' = '/etc/crontab' env'MallocStackLogging' =...

Dropbox < 3.3.x - OSX FinderLoadBundle Privilege Escalation

!/bin/bash Exploit Title: Dropbox FinderLoadBundle OS X local root exploit Google Dork: N/A Date: 29/09/15 Exploit Author: cenobyte Vendor Homepage: https://www.dropbox.com Software Link: N/A Version: Dropbox 1.5.6, 1.6-7., 2.1-11., 3.0., 3.1., 3.3. Tested on: OS X Yosemite 10.10.5 CVE: N/A Dropb...