macOS LaunchDaemon iOS 17.2 – Privilege Escalation
#!/usr/bin/env python3
macos
macos 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
RoyalTSX 6.0.1 – RTSZ File Handling Heap Memory Corruption PoC
RoyalTSX 6.0.1 RTSZ File Handling Heap Memory Corruption PoC
Google Chrome Browser 111.0.5563.64 – AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
## Exploit Title: Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
HospitalRun 1.0.0-beta – Local Root Exploit for macOS
# Exploit Title: HospitalRun 1.0.0-beta - Local Root Exploit for macOS
Fetch Softworks Fetch FTP Client 5.8 – Remote CPU Consumption (Denial of Service)
# Exploit Title: Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service)
Laravel Valet 2.0.3 – Local Privilege Escalation (macOS)
# Exploit Title: Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)
Atlassian Jira Server Data Center 8.16.0 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
MacOS 320.whatis Script – Privilege Escalation
# Exploit Title: MacOS 320.whatis Script - Privilege Escalation
Source Engine CS:GO BuildID: 4937372 – Arbitrary Code Execution
# Exploit Title: Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution
VMware Fusion 11.5.2 – Privilege Escalation
# Exploit Title: VMware Fusion 11.5.2 - Privilege Escalation
VMWare Fusion – Local Privilege Escalation
Local Privilege Escalation via VMWare Fusion
macOS 10.14.6 (18G87) – Kernel Use-After-Free due to Race Condition in wait_for_namespace_event()
The XNU function wait_for_namespace_event() in bsd/vfs/vfs_syscalls.c releases a file descriptor for use by userspace...
macOS 10.14.6 – root->kernel Privilege Escalation via update_dyld_shared_cache
Tested on macOS Mojave (10.14.6, 18G87) and Catalina Beta (10.15 Beta 19A536g).
macOS XNU – Missing Locking in checkdirs_callback() Enables Race with fchdir_common()
On macOS, when a new mount point is created, the kernel uses checkdirs() to, as
Apple macOS 10.15.1 – Denial of Service (PoC)
# Exploit Title: Apple macOS 10.15.1 - Denial of Service (PoC)
XNU – Remote Double-Free via Data Race in IPComp Input Path
=== Summary ===
macOS 18.7.0 Kernel – Local Privilege Escalation
# macOS-Kernel-Exploit
macOS iMessage – Heap Overflow when Deserializing
There is a heap overflow in [NSURL initWithCoder:] that can be reached via iMessage and likely other paths. When an N...
Typora 0.9.9.24.6 – Directory Traversal
# Exploit Title: Code execution via path traversal
Evernote 7.9 – Code Execution via Path Traversal
Exploit Title: Code execution via path traversal
macOS XNU – Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image
XNU has various interfaces that permit creating copy-on-write copies of data
FaceTime – Texture Processing Memory Corruption
There is a memory corruption issue that occurs when processing a malformed RTP video stream in FaceTime. It appears t...
macOS XNU – Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File
XNU has various interfaces that permit creating copy-on-write copies of data
Microsoft Remote Desktop 10.2.4(134) – Denial of Service (PoC)
# Exploit Title: Microsoft Remote Desktop 10.2.4(134) - Denial of Service (PoC)
Apple macOS 10.13 – ‘workq_kernreturn’ Denial of Service (PoC)
# Exploit Title: MacOS 10.13 - 'workq_kernreturn' Denial of Service (PoC)
SwitchVPN for macOS 2.1012.03 – Privilege Escalation
=======================================================================
CuteFTP Mac 3.1 – Denial of Service (PoC)
# Exploit Title: CuteFTP Mac 3.1 Denial of Service (PoC)
FaceTime – ‘readSPSandGetDecoderParams’ Stack Corruption
There are a variety of problems that occur when processing malformed H264 streams in readSPSandGetDecoderParams, lead...
FaceTime – ‘VCPDecompressionDecodeFrame’ Memory Corruption
There is a heap corruption vulnerability in VCPDecompressionDecodeFrame which is called by FaceTime. This bug can be ...
LiquidVPN 1.36 / 1.37 – Privilege Escalation
=======================================================================
Apple Intel GPU Driver – Use-After-Free/Double-Delete due to bad Locking
This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug id 635599405.)
Apple macOS 10.13.4 – Denial of Service (PoC)
# Exploit Title: Apple MacOS 10.13.4 - Denial of Service (PoC)
Charles Proxy 4.2 – Local Privilege Escalation
Charles Proxy is a great mac application for debugging web services and
Apple macOS Kernel – Use-After-Free Due to Lack of Locking in nvidia GeForce Driver
nvDevice::SetAppSupportBits is external method 0x107 of the nvAccelerator IOService.
Yosoro 1.0.4 – Remote Code Execution
# Exploit title: Yosoro 1.0.4 - Remote Code Execution
Apple macOS 10.13.2 – Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules
Here's a kextd method exposed via MIG (com.apple.KernelExtensionServer)
Google Software Updater macOS – Unsafe use of Distributed Objects Privilege Escalation
Google software updater ships with Chrome on MacOS and installs a root service (com.google.Keystone.Daemon.UpdateEngine)
macOS Kernel – Use-After-Free Due to Lack of Locking in ‘AppleEmbeddedOSSupportHostClient::registerNotificationPort’
AppleEmbeddedOSSupportHost.kext is presumably involved in the communication with the OS running on the touch bar on n...
Arq 5.10 – Local Privilege Escalation (2)
#!/bin/bash
Arq 5.10 – Local Privilege Escalation (1)
#!/usr/bin/env ruby
macOS – ‘sysctl_vfs_generic_conf’ Stack Leak Through Struct Padding
The sysctls vfs.generic.conf.* are handled by sysctl_vfs_generic_conf(), which is implemented as follows:
macOS 10.13 (17A365) – Kernel Memory Disclosure due to Lack of Bounds Checking in ‘AppleIntelCapriController::getDisplayPipeCapability’
AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure