launchd-portrep

launchd-portrep launchd-portrep 是一个针对 macOS 初始用户空间进程和服务管理守护进程 launchd 中端口替换漏洞的利用程序。通过向引导端口发送精心构造的 Mach 消息，可以迫使 launchd 释放攻击者同样拥有发送权限的任何 Mach 端口的发送权限。这使得攻击者能够冒充其可查找到的任意 launchd 服务与系统其余部分通信。 漏洞细节 Launchd 在其主端口上多路复用多个不同的 Mach 消息处理程序，其中包括一个用于异常消息的 MIG 处理程序。如果某个进程向其自身的引导端口发送 machexceptionraise 或...

MacOS Kernel 10.12.1 / iOS < 10.2 - syslogd Arbitrary Port Replacement Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=977 syslogd running as root hosts the com.apple.system.logger mach service. It's part of the system.sb sandbox profile and so reachable from a lot of sandboxed contexts. Here's ...

Apple macOS 10.12.1 iOS 10.2 - powerd Arbitrary Port Replacement

Apple macOS 10.12.1 iOS 10.2 - powerd Arbitrary Port Replacement / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=976 powerd running as root hosts the com.apple.PowerManagement.control mach service. It checks in with launchd to get a server port and then wraps that in a CFPort:...

Apple macOS 10.12.1 / iOS < 10.2 - powerd Arbitrary Port Replacement

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=976 powerd running as root hosts the com.apple.PowerManagement.control mach service. It checks in with launchd to get a server port and then wraps that in a CFPort: pmServerMachPort = SCCFMachPortCreateWithPort "PowerManagement",...

Apple macOS 10.12.1 / iOS < 10.2 - syslogd Arbitrary Port Replacement

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=977 syslogd running as root hosts the com.apple.system.logger mach service. It's part of the system.sb sandbox profile and so reachable from a lot of sandboxed contexts. Here's a snippet from its mach message handling loop...