0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Mach Race OSX - Privilege Escalation
Author
Risk
[Security Risk High
]0day-ID
Category
Date add
CVE
Platform
Source: https://github.com/gdbinit/mach_race Mach Race OS X Local Privilege Escalation Exploit (c) fG! 2015, 2016, reverser@put.as - https://reverse.put.as A SUID, SIP, and binary entitlements universal OS X exploit (CVE-2016-1757). Usage against a SUID binary: ./mach_race_server /bin/ps _compat_mode for i in seq 0 1000000; do ./mach_race_client /bin/ps; done Against an entitled binary to bypass SIP: ./mach_race_server /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_shove _geteuid for i in seq 0 1000000; do ./mach_race_client /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_shove; done Note: because the service name is not modified you can't chain this exploit from user to root and then use it to bypass SIP since bootstrap_register2 will fail the second time (service is already registered with launchd from the first run). The solution is to add a parameter to use a different service name for example. Note2: there's no need to make this into two separate apps, a single binary works, you just need to fork a server and client. References: https://reverse.put.as/wp-content/uploads/2016/04/SyScan360_SG_2016_-_Memory_Corruption_is_for_wussies.pdf http://googleprojectzero.blogspot.pt/2016/03/race-you-to-kernel.html Tested against Mavericks 10.10.5, Yosemite 10.10.5, El Capitan 10.11.2 and 10.11.3. Fixed in El Capitan 10.11.4. Should work with all OS X versions (depends if bootstrap_register2 exists on older versions). Alternative implementation with bootstrap_create_server possible for older versions. Proof of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39741.zip # 0day.today [2024-11-15] #