CVE-2023-49313

CVE-2023-49313 XMachOViewer 0.04 中存在一个 dylib 注入漏洞，攻击者可借此破坏完整性。通过利用该漏洞，攻击者能够将未经授权的代码注入产品进程，进而可能导致远程控制以及对敏感用户数据的未授权访问。 适用于 macOS 的便携版 首先，我们来编写 dylib include include attributeconstructor static void pocvoid printf"Malicious Dylib Inserted"; 编译 gcc -dynamiclib -arch x8664 -o poc.dylib poc.c 然后进行注入：...

HookCase

HookCase HookCaseは、macOS（旧OS...

DylibHijackTest

DylibHijackTest 环境要求 安装 Python3 依赖：pip3 install -r requirements.txt 从源代码编译 dylib，因为不要相信来自 GitHub 的编译产物：gcc -dynamiclib DylibHijackTest.c -o DylibHijackTest.dylib 工作原理 ⚠️ 这会在你的机器上生成大量进程，请在虚拟机中运行 ：请务必格外小心！ inject.py 递归遍历文件夹，搜索带有 MHEXECUTE 头部的 Mach-O 二进制文件 使用指向我们恶意 dylib 的 DYLDINSERTLIBRARIES 环境变量启动...

memdumper

memdumper memdumper 在另一个已签名二进制的调试器授权（debugger entitlement）下读取正在运行的 macOS 进程的内存。其目的是让 taskforpid 和 ptrace 以该已获授权二进制身份运行，这样 EDR 记录的是它，而不是 memdumper。 作者：cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/memdumper 概述 memdumper 启动一个带有 com.apple.security.cs.debugger 以及两个允许...

CVE-2024-53407

CVE-2024-53407 Phiewer 4.1.0では、dylibインジェクションによりコマンド実行が可能となり、攻撃者はdylibファイルを注入することで、リモート制御やMacOS上の機密ユーザーデータへの不正アクセスの可能性が生じます。 再現 .dylibファイルを使用してコマンドを注入します DYLDINSERTLIBRARIES=exploitcombined.dylib /Applications/Phiewer\ \lite.app/Contents/MacOS/Phiewer\ \lite\ 影響 コマンド実行（ローカル） 参考文献...

CVE-2024-55503

CVE-2024-55503 Termius 应用 MacOS dylib 命令注入 描述 Termius v.9.9.0 之前版本中存在一个问题，允许本地攻击者通过精心构造的脚本向 DYLDINSERTLIBRARIES 组件执行任意代码。使用 dylib DYLDINSERTLIBRARIES=exploitcombined.dylib /Applications/Termius.app/Contents/MacOS/Termius 复现 影响 命令执行（本地） 参考资料 CVE 记录：https://vulners.com/cve/CVE-2024-55503...

CVE-2024-55504

CVE-2024-55504 RAR Extractor - Unarchiver Free and Pro v.6.4.0 中的一个问题允许本地攻击者注入任意代码，可能通过 MacOS 上的 exploitcombined.dylib 组件导致远程控制以及未经授权访问敏感用户数据。 复现步骤 在终端中执行 DYLDINSERTLIBRARIES=exploitcombined.dylib /Applications/RAR\ Extractor\ -\ Unarchiver\ Pro.app/Contents/MacOS/RAR\ Extractor\ -\ Unarchiver\ P...

CVE-2026-24064: Untrusted Search Path

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLDINSERTLIBRARIES...

CVE-2025-62686: Improper Privilege Management

A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 on macOS. Due to the absence of a hardened runtime and a RESTRICT segment, a local user may exploit the DYLDINSERTLIBRARIES environment...

EUVD-2023-30610

Malicious code in bioql PyPI...

EUVD-2024-52779

Malicious code in bioql PyPI...

CVE-2025-57443: Improper Privilege Management

FrostWire 6.14.0-build-326 for macOS contains permissive entitlements allow-dyld-environment-variables, disable-library-validation that allow unprivileged local attackers to inject code into the FrostWire process via the DYLDINSERTLIBRARIES environment variable. This allows escalated privileges t...

CVE-2025-5255: Incorrect Default Permissions

The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library Dylib injection. A local attacker with unprivileged access can use...

CVE-2025-5963: Incorrect Default Permissions

The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library Dylib injection. A local attacker with unprivileged access can use environmen...

CVE-2024-55950

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application currently holds...

CVE-2024-55503: Untrusted Search Path

An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLDINSERTLIBRARIES component...

CVE-2024-55950

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application currently holds...

CVE-2024-55950

Tabby (formerly Terminus) prior to version 1.0.216 is affected by a vulnerability caused by overly permissive entitlements that enable dangerous capabilities (camera, microphone, and access to personal folders) through Apple Events, plus entitlements that can permit code injection. The root cause...

CVE-2024-55950 Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application currently holds...

CVE-2024-55950: Incorrect Default Permissions

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application currently holds...