Cisco AnyConnect 3.1.08009 – Local Privilege Escalation (via DMG Install Script)
Yorick Koster, July 2015
osx
osx 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Apple qlmanage – SceneKit::daeElement::setElementName Heap Overflow
Source: https://code.google.com/p/google-security-research/issues/detail?id=467
Apple Mac OSX Regex Engine (TRE) – Stack Buffer Overflow (PoC)
Source: https://code.google.com/p/google-security-research/issues/detail?id=428
Apple Mac OSX Regex Engine (TRE) – Integer Signedness / Overflow
Source: https://code.google.com/p/google-security-research/issues/detail?id=429
Apple Mac OSX – Install.framework suid Helper Privilege Escalation
Source: https://code.google.com/p/google-security-research/issues/detail?id=314
Apple Mac OSX Install.Framework – Arbitrary mkdir / unlink and chown to Admin Group
Source: https://code.google.com/p/google-security-research/issues/detail?id=477
Apple Mac OSX Install.Framework – SUID Root Runner Binary Privilege Escalation
Source: https://code.google.com/p/google-security-research/issues/detail?id=478
Disconnect.me Mac OSX Client 2.0 – Local Privilege Escalation
Disconnect.me is the search engine entrusted by the Tor Browser.
Apple Mac OSX 10.10.5 – ‘XNU’ Local Privilege Escalation
Source: https://github.com/kpwn/tpwn
Apple Mac OSX Keychain – EXC_BAD_ACCESS Denial of Service
# Exploit Title: OSX Keychain - EXC_BAD_ACCESS
Apple Mac OSX 10.10.3 (Yosemite) Safari 8.0.x – Crash (PoC)
#!/usr/bin/php
MacKeeper – URL Handler Remote Code Execution
#!/usr/bin/python
Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation
########################################################
Apple Mac OSX < 10.10.x - GateKeeper Bypass
# Exploit Title: OS X Gatekeeper bypass Vulnerability
Apple Mac OSX 10.9.5 – IOKit IntelAccelerator Null Pointer Dereference
// clang -o ig_2_3_exploit ig_2_3_exploit.c -framework IOKit -framework CoreFoundation -m32 -D_FORTIFY_SOURCE=0
Apple Mac OSX networkd – ‘effective_audit_token’ XPC Type Confusion Sandbox Escape
// Requires Lorgnette: https://github.com/rodionovd/liblorgnette
Apple Mac OSX 10.9.x – sysmond XPC Privilege Escalation
Source: https://code.google.com/p/google-security-research/issues/detail?id=121
Apple Mac OSX Safari 8.0 – Crash (PoC)
@w3bd3vil
Apple Mac OSX – Local Security Bypass
// source: https://www.securityfocus.com/bid/67023/info
Apple Mac OSX (Lion) Kernel xnu-1699.32.7 except xnu-1699.24.8 NFS Mount – Local Privilege Escalation
/* * Apple Mac OS X Lion Kernel
Apple Mac OSX 10.9 – Hard Link Memory Corruption
MacOSX/XNU HFS Multiple Vulnerabilities
Apple Motion 5.0.7 – Integer Overflow
Apple Motion Integer Overflow Vulnerability
Apple Mac OSX 10.8.4 – Local Privilege Escalation
#!/usr/bin/python
Apple Mac OSX Server – DirectoryService Buffer Overflow
Core Security - Corelabs Advisory
CodeBlocks 12.11 (OSX) – Crash (PoC)
# Exploit Title: CodeBlocks 12.11 (Mac OS X) Crash POC
Google Chrome 26.0.1410.43 (Webkit) – OBJECT Element Use-After-Free (PoC)
#---object-beforeload-chrome.html------------------------------------------------------------------------------------...
Viscosity – Local Privilege Escalation
#!/bin/sh
Microsoft Office 2008 SP0 (Mac) – RTF pFragments
#RTF Pfragments exploit for MAC office 2008
Apple Mac OSX 10.6.5 / iOS 4.3.3 Mail – Denial of Service
source: https://www.securityfocus.com/bid/50446/info
Apple Mac OSX < 10.6.7 - Kernel Panic (Denial of Service)
Mac OS X < 10.6.7 Kernel Panic Exploit
Apple Mac OSX (Lion) – Directory Services Security Bypass
source: https://www.securityfocus.com/bid/49676/info