OS X Keychain EXC_BAD_ACCESS Denial Of Service

Exploit Title: OSX Keychain - EXCBADACCESS Date: 22/07/2015 Exploit Author: Juan Sacco Vendor Homepage: https://www.apple.com Software Link: https://www.apple.com/en/downloads/ Version: 9.0 55161 Tested on: OSX Yosemite 10.10.4 CVE : None History - Reported to [email protected] 20 Jul 20...

Slack: OSX slack:// protocol handler javascript injection

The Mac Slack app version 1.1 introduced the slack:// protocol handler. Due to improper input sanitization, arbitrary Javascript code can be run in the context of the client app if the user clicks on a slack:// link on a website or email. I have confirmed this issue still exists in the 1.1.1...

Apple OSX 10.10.4 DYLD_PRINT_TO_FILE Privilege Escalation Exploit

In Apple OS X 10.10.4 and prior, the DYLDPRINTTOFILE environment variable is used for redirecting logging data to a file instead of stderr. Due to a design error, this feature can be abused by a local attacker to write arbitrary files as root via restricted, SUID-root binaries. This module requir...

Apple OSX 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Exploit

Exploit for macOS platform in category local exploits !/bin/sh Simple Proof of Concept Exploit for the DYLDPRINTTOFILE local privilege escalation vulnerability in OS X 10.10 - 10.10.4 C Copyright 2015 Stefan Esser Wait months for a fix from Apple or install the following KEXT as protection...

Apple Mac OSX 10.10 - 'DYLD_PRINT_TO_FILE' Local Privilege Escalation

!/bin/sh Simple Proof of Concept Exploit for the DYLDPRINTTOFILE local privilege escalation vulnerability in OS X 10.10 - 10.10.4 C Copyright 2015 Stefan Esser Wait months for a fix from Apple or install the following KEXT as protection https://github.com/sektioneins/SUIDGuard Use at your own ris...

Apple Mac OSX 10.10 - DYLD_PRINT_TO_FILE Local Privilege Escalation

Apple Mac OSX 10.10 - DYLDPRINTTOFILE Local Privilege Escalation !/bin/sh Simple Proof of Concept Exploit for the DYLDPRINTTOFILE local privilege escalation vulnerability in OS X 10.10 - 10.10.4 C Copyright 2015 Stefan Esser Wait months for a fix from Apple or install the following KEXT as...

Impero Education Pro - System Remote Command Execution

/ If you're unsure what Impero is, it's essentially a corporate/educational RAT. Vendor site: https://www.imperosoftware.co.uk/ They recently were in the news about how they implemented "anti-radicalisation" shit or something. They had a booth at BETT back in January. They gave out donuts. Those...

Impero Education Pro - System Remote Command Execution

Impero Education Pro - System Remote Command Execution / If you're unsure what Impero is, it's essentially a corporate/educational RAT. Vendor site: https://www.imperosoftware.co.uk/ They recently were in the news about how they implemented "anti-radicalisation" shit or something. They had a boot...

Western Digital Arkeia 11.0.12 Remote Code Execution Exploit

This Metasploit module exploits a code execution flaw in Western Digital Arkeia version 11.0.12 and below. The vulnerability exists in the 'arkeiad' daemon listening on TCP port 617. Because there are insufficient checks on the authentication of all clients, this can be bypassed. Using the...

Western Digital Arkeia Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Western Digital Arkeia Remote Code Execution', 'Description' = %q This module exploits a code execution flaw in Western Digital Arke...

Western Digital Arkeia < 11.0.12 - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Western Digital Arkeia Remote Code Execution', 'Description' = %q This module exploits a code execution flaw in Western Digital Arke...

Western Digital Arkeia Remote Code Execution

This module exploits a code execution flaw in Western Digital Arkeia version 11.0.12 and below. The vulnerability exists in the 'arkeiad' daemon listening on TCP port 617. Because there are insufficient checks on the authentication of all clients, this can be bypassed. Using the ARKFSEXECCMD...

Coremail邮箱正文持久型XSS

简要描述： 为了测试，购买域名和邮箱花了二十块。 详细说明： 在母鸡的指导下把邮箱解析好了，就用自己的邮箱给coremail发了封邮件测试下。 接着发现firefox下来信邮箱的昵称img src=1被嵌入入了网页中 使用firefox插件Tamper Data抓包改我qq邮箱的昵称,不要continue 接着改sendname参数，写入 然后就触发了 漏洞证明： win7下 osx下 img src="https://images.seebug.org/upload/201506/2918161341e69ed475cebd562eaaf59b0b3a8371.png"...

Apple Mac OSX 10.10.3 (Yosemite) Safari 8.0.x - Crash (PoC)

Apple Mac OSX 10.10.3 Yosemite Safari 8.0.x - Crash PoC !/usr/bin/php ?php Title : Safari 8.0.X / OS X Yosemite 10.10.3 Crash Proof Of Concept Product Website: https://www.apple.com/safari/ Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes ,...

Adobe frequency existing 0day vulnerabilities is the Chinese hackers use-vulnerability warning-the black bar safety net

! This year 1 month Adobe is exposure found there is a not yet disclosed the new 0day vulnerability today, the company is also exposed 0day vulnerabilities, being a Chinese hacking group APT3aka UPSuse. It is reported that the 0day vulnerability is a United States security firm Fireeye in the...

UBUNTU-CVE-2015-3107

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and befor...

Wing FTP 4.4.6 Cross Site Request Forgery

Exploit Title: Wing FTP Server Cross-site Request Forgery vulnerabilities Product: Wing FTP Server Vulnerable Versions: 4.4.6 and all previous versions Tested Version: 4.4.6 Advisory Publication: 05/06/2015 Latest Update: 05/06/2015 Vulnerability Type: Cross-site Request Forgery CWE-352 CVE...

Apple Mac OSX Zero-Day Bug Allows Hackers to Install RootKit Malware

A zero-day software vulnerability discovered deep in the firmware of many Apple computers could allows an attacker to modify the system’s BIOS and install a rootkit, potentially gaining complete control of the victim’s Mac. The critical vulnerability, discovered by well-known OS X security...

TestDisk 6.14 - Check_OS2MB Stack Buffer Overflow (PoC)

TestDisk 6.14 - CheckOS2MB Stack Buffer Overflow PoC , , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. TestDisk 6.14 CheckOS2MB Stack Buffer Overflow Affected versions: TestDisk 6.14 - Linux, Windows...

TestDisk 6.14 Check_OS2MB Stack Buffer Overflow Vulnerability

This document details a stack based buffer overflow vulnerability within TestDisk version 6.14. A buffer overflow is triggered within the software when a malicious disk image is attempted to be recovered. This may be leveraged by an attacker to crash TestDisk and gain control of program execution...