Dropbox 3.3.x - OSX FinderLoadBundle Local Root Exploit

The setuid root FinderLoadBundle that was included in older DropboxHelperTools versions for OS X allows loading of dynamically linked shared libraries that are residing in the same directory. The directory in which FinderLoadBundle is located is owned by root and that prevents placing arbitrary...

Dropbox 3.3.x - OSX FinderLoadBundle Privilege Escalation

Dropbox 3.3.x - OSX FinderLoadBundle Privilege Escalation !/bin/bash Exploit Title: Dropbox FinderLoadBundle OS X local root exploit Google Dork: N/A Date: 29/09/15 Exploit Author: cenobyte Vendor Homepage: https://www.dropbox.com Software Link: N/A Version: Dropbox 1.5.6, 1.6-7., 2.1-11., 3.0.,...

Apple Mac OSX Regex Engine (TRE) - Integer Signedness Overflow

Apple Mac OSX Regex Engine TRE - Integer Signedness Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=429 The OS X regex engine function tretnfarunparallel contains the following code: int tbytes; ... if !matchtags numtags = 0; else numtags = tnfa-numtags; ... i...

Apple Mac OSX Regex Engine (TRE) - Stack Buffer Overflow (PoC)

Apple Mac OSX Regex Engine TRE - Stack Buffer Overflow PoC Source: https://code.google.com/p/google-security-research/issues/detail?id=428 OS X Libc uses the slightly obscure TRE regex engine http://laurikari.net/tre/ If used in enhanced mode by passing the REGENHANCED flag to regcomp TRE support...

Apple Mac OSX Regex Engine (TRE) - Stack Buffer Overflow (PoC)

Source: https://code.google.com/p/google-security-research/issues/detail?id=428 OS X Libc uses the slightly obscure TRE regex engine http://laurikari.net/tre/ If used in enhanced mode by passing the REGENHANCED flag to regcomp TRE supports arbitrary-width hex literals. Here is the code used to...

Bug in iOS and OSX Allows Writing of Arbitrary Files Via AirDrop

There is a major vulnerability in a library in iOS that allows an attacker to overwrite arbitrary files on a target device and, when used in conjunction with other techniques, install a signed app that the device will trust without prompting the user with a warning dialog. The vulnerability lies ...

AirDrop Bug in Apple iOS and OSX allows Hackers to Install Malware Silently

With the launch of iOS 9, Apple gave us an ultimate reason to upgrade our Apple devices to its new operating system. The latest iOS 9 includes a security update for a nasty bug that could be exploited to take full control of your iPhone or Macs, forcing most of the Apple users to download the...

Apple Mac OSX Install.Framework - SUID Root Runner Binary Privilege Escalation

Apple Mac OSX Install.Framework - SUID Root Runner Binary Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=478 The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects can be connected to by...

Apple Mac OSX - Install.framework suid Helper Privilege Escalation

Apple Mac OSX - Install.framework suid Helper Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=314 The private Install.framework has a few helper executables in /System/Library/PrivateFrameworks/Install.framework/Resources, one of which is suid root...

Advertising software use the Apple OS X system vulnerabilities to steal data-vulnerability warning-the black bar safety net

! Malwarebytes security researchers found an advertisement software installation program is accessing MAC OS X's password management system Keychain to. In July, researchers have identified the Mac OS X operating system of a local elevation of Privilege（LPF）vulnerabilities. Experts have found tha...

Apple Mac OSX Entitlements - 'Rootpipe' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Apple OS X Entitlements Rootpipe Privilege Escalation', 'Description' = %q This module exploits the rootpipe vulnerability and...

Geotweet - Social engineering tool for human hacking

Another way to use Twitter and instagram. Geotweet is an osint application that allows you to track tweets and instagram and trace geographical locations and then export to google maps. Allows you to search on tags, world zones and user info and timeline. Requirements Python 2.7 PyQt4, tweepy,...

Apple Mac OSX 10.10.5 - XNU Local Privilege Escalation

Apple Mac OSX 10.10.5 - XNU Local Privilege Escalation Source: https://github.com/kpwn/tpwn tpwn cve-2015-???? poc os x 10.10.5 kernel local privilege escalation vulnerability got burned in 10.11 full writeup etason shout out @ unthreadedjb 4 hax Proof of Concept:...

Apple Mac OSX 10.10.5 - 'XNU' Local Privilege Escalation

Source: https://github.com/kpwn/tpwn tpwn cve-2015-???? poc os x 10.10.5 kernel local privilege escalation vulnerability got burned in 10.11 full writeup etason shout out @ unthreadedjb 4 hax Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37825....

Immunity Canvas: OSX_DYLD_PRINT_TO_FILE

Name| osxdyldprinttofile ---|--- CVE| CVE-2015-3760 Exploit Pack| CANVAS Description| OS X DYLDPRINTTOFILE local privilege escalation Notes| Repeatability: Multiple Times Notes: Tested on: - 10.10.3 VENDOR: Apple CVE Url: https://vulners.com/cve/CVE-2015-3760 CVE Name: CVE-2015-3760...

Mozilla Firefox < 39.03 - 'pdf.js' Same Origin Policy

/ Exploit Title: Firefox CVE-2015-4495 Test Run the index.html Make sure the main.js is in the same directory and we should be able to see the directory listing. 3. Solution Upgrade to the latest firefox 39.0.3 / var starttimeout=2000; var sandboxcontexti=null; var DIRCACHE=; var FILECACHE=; var...

CVE-2015-5558

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a...

OSX Keychain - EXC_BAD_ACCESS Denial of Service Vulnerability

Exploit for macOS platform in category dos / poc Exploit Title: OSX Keychain - EXCBADACCESS Date: 22/07/2015 Exploit Author: Juan Sacco Vendor Homepage: https://www.apple.com Software Link: https://www.apple.com/en/downloads/ Version: 9.0 55161 Tested on: OSX Yosemite 10.10.4 CVE : None History -...

Apple Mac OSX Keychain - EXC_BAD_ACCESS Denial of Service

Apple Mac OSX Keychain - EXCBADACCESS Denial of Service Exploit Title: OSX Keychain - EXCBADACCESS Date: 22/07/2015 Exploit Author: Juan Sacco Vendor Homepage: https://www.apple.com Software Link: https://www.apple.com/en/downloads/ Version: 9.0 55161 Tested on: OSX Yosemite 10.10.4 CVE : None...

Apple Mac OSX Keychain - EXC_BAD_ACCESS Denial of Service

Exploit Title: OSX Keychain - EXCBADACCESS Date: 22/07/2015 Exploit Author: Juan Sacco Vendor Homepage: https://www.apple.com Software Link: https://www.apple.com/en/downloads/ Version: 9.0 55161 Tested on: OSX Yosemite 10.10.4 CVE : None History - Reported to [email protected] 20 Jul 20...