MacDirtyCow

MacDirtyCow CVE-2022-46689, 일명 MacDirtyCow의 예시입니다. 개요 MacDirtyCow는 Linux의 Dirty COW 취약점과 유사한 macOS의 권한 상승 취약점입니다. 이 취약점은 macOS의 XNU 커널이 사용하는 copy-on-writeCOW 메커니즘에 존재합니다. 이 취약점으로 인해 공격자는 읽기 전용 루트 소유 파일을 수정할 수 있으며, 이로 인해 영향을 받는 시스템에서 루트 권한을 획득할 수 있습니다. 이 취약점은 macOS의 XNU 커널이 메모리 페이지에서...

MacDirtyCowDemo

macOS 13.0.1 で CVE-2022-46689（Dirty Cow バグの macOS 版）を使って root を取得します。Apple の XNU ソース から抽出したテストケースを使用します。 https://worthdoingbadly.com/macdirtycow/ 使い方 macOS 13.0.1 / 12.6.1（またはそれ以下）のマシンで、次を実行します： root@kitploit: clang -o switcharoo vmunalignedcopyswitchrace.c sed -e "s/rootok/permit/g" /etc/pam.d/s...

CVE-2023-32413

macOS LPE CVE-2023-32413 / ZDI-23-845 / Pwn2Own Vancouver 2023 익스플로잇 이 코드는 Pwn2Own Vancouver 2023https://youtu.be/c0cS4R0ja-I?t=180에서 시연된 익스플로잇 코드입니다. 이 코드는 CVE-2023-32413을 악용하여 취약한 모든 macOS에서 루트 권한을 획득합니다. 해당 취약점은 읽을 수 있는 모든 파일을 덮어쓸 수 있는 논리적 TOCTOUTime-of-check time-of-use입니다. 이 익스플로잇은 빠르고 100%...

macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common() Exploit

On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new filesystem has just been mounted. If so, replace them with the new mount point....

macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()

macOS XNU - Missing Locking in checkdirscallback Enables Race with fchdircommon On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new...

macOS XNU - Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image

macOS XNU - Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected agains...

macOS XNU - Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image

XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected against later modifications by the source process; otherwise, the source process might be...

macOS XNU - Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File

/ XNU has various interfaces that permit creating copy-on-write copies of data between processes, including out-of-line message descriptors in mach messages. It is important that the copied memory is protected against later modifications by the source process; otherwise, the source process might ...

Apple macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1372 the kernel libproc API proclistuptrs has the following comment in it's userspace header: / Enumerate potential userspace pointers embedded in kernel data structures. Currently inspects kqueues only. NOTE: returned "pointers"...