MacDirtyCow

MacDirtyCow Ejemplo de CVE-2022-46689 también conocido como MacDirtyCow. ¿Qué es? MacDirtyCow es una vulnerabilidad de escalada de privilegios en macOS, similar a la vulnerabilidad Dirty COW en Linux. La vulnerabilidad reside en el mecanismo de copia en escritura COW utilizado por el kernel XNU d...

MacDirtyCowDemo

Obtén root en macOS 13.0.1 con CVE-2022-46689 el equivalente en macOS del bug Dirty Cow, usando el caso de prueba extraído del código fuente de XNU de Apple. https://worthdoingbadly.com/macdirtycow/ Uso En una máquina con macOS 13.0.1 / 12.6.1 o inferior, ejecuta: clang -o switcharoo...

CVE-2023-32413

Exploit de LPE en macOS CVE-2023-32413 / ZDI-23-845 / Pwn2Own Vancouver 2023 Este es el código del exploit que se mostró en Pwn2Own Vancouver 2023 https://youtu.be/c0cS4R0ja-I?t=180. Este código explota CVE-2023-32413 para obtener privilegios de root en cualquier macOS vulnerable. La vulnerabilid...

macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common() Exploit

On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new filesystem has just been mounted. If so, replace them with the new mount point....

macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()

macOS XNU - Missing Locking in checkdirscallback Enables Race with fchdircommon On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new...

macOS XNU - Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image

XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected against later modifications by the source process; otherwise, the source process might be...

macOS XNU - Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image

macOS XNU - Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected agains...

macOS XNU - Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File

/ XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected against later modifications by the source process; otherwise, the source process might ...

Apple macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1372 the kernel libproc API proclistuptrs has the following comment in it's userspace header: / Enumerate potential userspace pointers embedded in kernel data structures. Currently inspects kqueues only. NOTE: returned "pointers"...