CVE-2023-42860

CVE-2023-42860 针对 CVE-2023-42860 的利用程序（仅用于研究目的）。 此利用程序适用于 macOS 13.3 之前的版本，尽管 Apple 的变更日志 称已在 14.1 版本中修复。 步骤 1. 下载 InstallAssistant.pkg 2. 修改 exploit.sh 文件中的变量 TARGETFILE，指向系统上的一个 SIP 保护文件（默认目标是系统 TCC 数据库）。 3. 以 root 身份运行利用程序： root@kitploit: $ ./exploit.sh PATHTOPKG 4. 现在，您应看到文件的 受限制标志 已被 移除...

POC

POC 仅供研究使用！ 一个包含我所发现漏洞的 POC 与 Exploit 的公开合集。 CVE-2022-22583 PackageKit ：应用程序或许能够访问受限文件（SIP 绕过） CVE-2022-26690 PackageKit ：恶意应用程序或许能够修改文件系统的受保护部分（SIP 绕过） CVE-2022-32800 PackageKit ：应用或许能够修改文件系统的受保护部分（SIP 绕过） CVE-2022-26728 SoftwareUpdate ：恶意应用程序或许能够访问受限文件（TCC 绕过） CVE-2022-22616 Safari Downloads...

mach_race

Mach Race OS X 本地权限提升漏洞利用 c fG! 2015, 2016, [email protected] - https://reverse.put.as 一个针对 SUID、SIP 和二进制 entitlements 的通用 OS X 漏洞利用 CVE-2016-1757。 针对 SUID 二进制文件的使用方法： ./machraceserver /bin/ps compatmode for i in seq 0 1000000; do ./machraceclient /bin/ps; done 针对具有 entitlements 的二进制文件以绕过...

decrypted

decrypted 适用于运行在启用了 SIP 的 macOS 上的 iOS 应用程序的 FairPlay 解密器（导出 iPA），利用 CVE-2025-24204。支持 macOS 15.0-15.2 仍在开发中 致谢 CVE-2025-24204 解密器...

Exploit for Race Condition in Apple Ipados

macOS LPE CVE-2023-32413 / ZDI-23-845 / Pwn2Own Vancouver 202...

Apple macOS ramrod arbitrary argv[0] execution vulnerability

Talos Vulnerability Report TALOS-2024-2010 Apple macOS ramrod arbitrary argv0 execution vulnerability July 30, 2024 CVE Number CVE-2024-40800 SUMMARY An arbitrary argv0 execution vulnerability exists in the ramrod binary of Apple macOS version 14.5 23F79 x8664. An attacker can inject an arbitrary...

A Technical Analysis of CVE-2022-22583 and CVE-2022-32800

This blog entry discusses the technical details of how we exploited CVE-2022-22583 using a different method. We also tackle the technical details of CVE-2022-32800, another SIP-bypass that we discovered more recently, in this report...

Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities

More than two years ago, a researcher, A2nkF demonstrated the exploit chain from root privilege escalation to SIP-Bypass up to arbitrary kernel extension loading. In this blog entry, we will discuss how we discovered 3 more vulnerabilities from the old exploit chain...

Mac Users Targeted by Spyware Spreading via Xcode Projects

A campaign aimed at Mac users is spreading the XCSSET suite of malware, which has the capability to hijack the Safari web browser and inject various JavaScript payloads that can steal passwords, financial data and personal information, deploy ransomware and more. Infections are propagating via...

Exploit for Improper Input Validation in Apple Mac_Os_X

CVE-2019-8561 Proof of concept exploit for CVE-2019-8561 disc...

macOS 10.11.* / 10.12.* Kernel Code Execution - SIP bypass 0day Exploit

Privilege Escalation Exploit for OS macOS from root to kernel. Usage Info sudo ./exploit This is private exploit. You can buy it at https://0day.today...

Mach Race OSX - Local Privilege Escalation

Mach Race OSX - Local Privilege Escalation Source: https://github.com/gdbinit/machrace Mach Race OS X Local Privilege Escalation Exploit c fG! 2015, 2016, [email protected] - https://reverse.put.as A SUID, SIP, and binary entitlements universal OS X exploit CVE-2016-1757. Usage against a SUID binar...

Apple Mac OS X Zero Day Vulnerability SIP Bypass

System Integrity Protection SIP was implemented in OS X El Capitan and imposes limitations on what actions that Mac computers’ root accounts can take against protected paths of the operating system. Yesterday at the SysCan360 conference in Singapore, a researcher from SentinelOne disclosed detail...