deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Viscosity setuid-set ViscosityHelper Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/setuid_viscosity.rb
Platform: osx
Disclosure date: 2012-08-12
References: CVE-2012-4284, OSVDB-84709, EDB-20485, URL-http://blog.zx2c4.com/791
Targets: Viscosity 1.4.1 / Mac OS X x86, Viscosity 1.4.1 / Mac OS X x64

Description:
This module exploits a vulnerability in Viscosity 1.4.1 on Mac OS X. The
            vulnerability exists in the setuid ViscosityHelper, where an insufficient
            validation of path names allows execution of arbitrary python code as root.
            This module has been tested successfully on Viscosity 1.4.1 over Mac OS X
            10.7.5.

Check method (fingerprinting):
unless file? datastore['Viscosity']
      vprint_error 'ViscosityHelper not found'
      return CheckCode::Safe('ViscosityHelper not found')
    end

    check = cmd_exec("find  #{datastore['Viscosity']} -type f -user root -perm -4000")

    unless check.include? 'ViscosityHelper'
      return CheckCode::Safe('ViscosityHelper is not setuid root')
    end

    CheckCode::Vulnerable('Setuid ViscosityHelper binary found')
  end
Metasploit Module: Mac OS X Feedback Assistant Race Condition
Type: exploit
Path: modules/exploits/osx/local/feedback_assistant_root.rb
Disclosure date: 2019-04-13
References: CVE-2019-8565, URL-http://web.archive.org/web/[PII_REDACTED]3938/https://medium.com/0xcc/rootpipe-reborn-part-ii-e5a1ffff6afe, URL-https://support.apple.com/en-in/HT209600, URL-https://github.com/ChiChou/sploits
Targets: Mac OS X x64 (Native Payload), Python payload, Command payload

Description:
This module exploits a race condition vulnerability in Mac's Feedback Assistant.
          A successful attempt would result in remote code execution under the context of
          root.

Check method (fingerprinting):
version = get_system_version

    return CheckCode::Unknown('Could not retrieve OSX version') if version.blank?

    version = Rex::Version.new(version)

    if version >= Rex::Version.new('10.14.4')
      return CheckCode::Safe("OSX version #{version} is not vulnerable.")
    end

    CheckCode::Appears("OSX version #{version} appears vulnerable.")
  end
Metasploit Module: OS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection (Shellshock)
Type: exploit
Path: modules/exploits/osx/local/vmware_bash_function_root.rb
Platform: osx
Disclosure date: 2014-09-24
References: CVE-2014-6271, OSVDB-112004, EDB-34765
Targets: Mac OS X 10.9 Mavericks x64 (Native Payload)

Description:
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
          handles external environment variables. This module targets the VMWare Fusion
          application, allowing an unprivileged local user to get root access.

Check method (fingerprinting):
check_str = Rex::Text.rand_text_alphanumeric(5)
    # ensure they are vulnerable to bash env variable bug
    if cmd_exec("env x='() { :;}; echo #{check_str}' bash -c echo").include?(check_str) &&
       cmd_exec("file '#{datastore['VMWARE_PATH']}'") !~ /cannot open/

      CheckCode::Vulnerable('Target is vulnerable to bash environment variable injection and VMware is present')
    else
      CheckCode::Safe('Target is not vulnerable to bash env injection or VMware not found')
    end
  end
Metasploit Module: Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/dyld_print_to_file_root.rb
Platform: osx
Disclosure date: 2015-07-21
References: CVE-2015-3760, URL-https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html, URL-https://www.reddit.com/r/netsec/comments/3e34i2/os_x_1010_dyld_print_to_file_local_privilege/

Description:
In Apple OS X 10.10.4 and prior, the DYLD_PRINT_TO_FILE environment
          variable is used for redirecting logging data to a file instead of
          stderr. Due to a design error, this feature can be abused by a local
          attacker to write arbitrary files as root via restricted, SUID-root
          binaries.

Check method (fingerprinting):
(ver?) ? CheckCode::Appears('Target version appears vulnerable') : CheckCode::Safe('Target version is not vulnerable')
  end
Metasploit Module: Mac OS X Root Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/root_no_password.rb
Platform: osx
Disclosure date: 2017-11-29
References: CVE-2017-13872, URL-https://twitter.com/lemiorhan/status/[PII_REDACTED]41770752, URL-https://news.ycombinator.com/item?id=15800676, URL-https://forums.developer.apple.com/thread/79235

Description:
This module exploits a serious flaw in MacOSX High Sierra.
          Any user can login with user "root", leaving an empty password.
Metasploit Module: Setuid Tunnelblick Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/setuid_tunnelblick.rb
Platform: osx
Disclosure date: 2012-08-11
References: CVE-2012-3485, OSVDB-84706, EDB-20443, URL-http://blog.zx2c4.com/791
Targets: Tunnelblick 3.2.8 / Mac OS X x86, Tunnelblick 3.2.8 / Mac OS X x64

Description:
This module exploits a vulnerability in Tunnelblick 3.2.8 on Mac OS X. The
            vulnerability exists in the setuid openvpnstart, where an insufficient
            validation of path names allows execution of arbitrary shell scripts as root.
            This module has been tested successfully on Tunnelblick 3.2.8 build 2891.3099
            over Mac OS X 10.7.5.

Check method (fingerprinting):
unless file? datastore['Tunnelblick']
      vprint_error 'openvpnstart not found'
      return CheckCode::Safe('openvpnstart not found')
    end

    check = cmd_exec("find  #{datastore['Tunnelblick']} -type f -user root -perm -4000")

    unless check.include? 'openvpnstart'
      return CheckCode::Safe('openvpnstart is not setuid root')
    end

    CheckCode::Vulnerable('Setuid openvpnstart binary found')
  end
Metasploit Module: Mac OS X libxpc MITM Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/libxpc_mitm_ssudo.rb
Platform: osx
Disclosure date: 2018-03-15
References: CVE-2018-4237, URL-https://github.com/saelo/pwn2own2018

Description:
This module exploits a vulnerablity in libxpc on macOS <= 10.13.3
          The task_set_special_port API allows callers to overwrite their bootstrap port,
          which is used to communicate with launchd. This port is inherited across forks:
          child processes will use the same bootstrap port as the parent.
          By overwriting the bootstrap port and forking a child processes, we can now gain
          a MitM position between our child and launchd.

          To gain root we target the sudo binary and intercept its communication with
          opendirectoryd, which is used by sudo to verify credentials. We modify the
          replies from opendirectoryd to make it look like our password was valid.

Check method (fingerprinting):
version = Rex::Version.new(get_system_version)
    if version >= Rex::Version.new('10.13.4')
      CheckCode::Safe("macOS version #{version} is patched")
    else
      CheckCode::Appears("macOS version #{version} appears vulnerable")
    end
  end
Metasploit Module: Mac OS X "tpwn" Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/tpwn.rb
Platform: osx
Disclosure date: 2015-08-16
References: URL-https://github.com/kpwn/tpwn

Description:
This module exploits a null pointer dereference in XNU to escalate
          privileges to root.

          Tested on 10.10.4 and 10.10.5.

Check method (fingerprinting):
ver? ? CheckCode::Appears('Target version appears vulnerable') : CheckCode::Safe('Target version is not vulnerable')
  end
Metasploit Module: Arkeia Backup Client Type 77 Overflow (Mac OS X)
Type: exploit
Path: modules/exploits/osx/arkeia/type77.rb
Platform: osx
Disclosure date: 2005-02-18
References: CVE-2005-0491, OSVDB-14011, BID-12594
Targets: Arkeia 5.3.1 Stack Return (boot)

Description:
This module exploits a stack buffer overflow in the Arkeia backup
          client for the Mac OS X platform. This vulnerability affects
          all versions up to and including 5.3.3 and has been tested
          with Arkeia 5.3.1 on Mac OS X 10.3.5.

Check method (fingerprinting):
info = arkeia_info
    if !(info and info['Version'])
      return Exploit::CheckCode::Safe('Could not retrieve Arkeia server version')
    end

    vprint_status('Arkeia Server Information:')
    info.each_pair do |k, v|
      vprint_status("   #{k + (' ' * (30 - k.length))} = #{v}")
    end

    if (info['System'] !~ /Darwin/)
      vprint_status('This module only supports Mac OS X targets')
      return Exploit::CheckCode::Detected("Arkeia detected on #{info['System']} but this module only supports Mac OS X")
    end

    if (info['Version'] =~ /Backup (4\.|5\.([012]\.|3\.[0123]$))/)
      return Exploit::CheckCode::Appears("Arkeia #{info['Version']} appears vulnerable")
    end

    return Exploit::CheckCode::Safe("Arkeia #{info['Version']} does not appear to be vulnerable")
  end
Metasploit Module: Mac OS X Persistent Payload Installer
Type: exploit
Path: modules/exploits/osx/persistence/launch_plist.rb
Disclosure date: 2012-04-01
References: URL-https://taomm.org/vol1/pdfs/CH%202%20Persistence.pdf, URL-https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html
Targets: Mac OS X x64 (Native Payload), Mac OS X x86 (Native Payload for 10.14 and earlier), Mac OS X Apple Sillicon, Python payload, Command payload

Description:
This module provides a persistent boot payload by creating a launch item, which can be
          a LaunchAgent or a LaunchDaemon. LaunchAgents run with user level permissions and are triggered
          upon login by a plist entry in ~/Library/LaunchAgents. LaunchDaemons run with
          elevated privilleges, and are launched before user login by a plist entry in the ~/Library/LaunchDaemons directory.
          In either case the plist entry specifies an executable that will be run before or at login.

          Verified on OSX 11.7.10 (Big Sur)

Check method (fingerprinting):
folder = File.dirname(backdoor_path).shellescape
    folder = File.dirname(folder)
    return CheckCode::Safe("#{folder} not found") unless exists?(folder)
    return CheckCode::Safe("#{folder} not writable") unless writable?(folder)

    CheckCode::Appears("#{folder} is writable")
  end
Metasploit Module: Samba trans2open Overflow (Mac OS X PPC)
Type: exploit
Path: modules/exploits/osx/samba/trans2open.rb
Platform: osx
Disclosure date: 2003-04-07
References: CVE-2003-0201, OSVDB-4469, BID-7294, URL-https://seclists.org/bugtraq/2003/Apr/103

Description:
This exploits the buffer overflow found in Samba versions
          2.2.0 to 2.2.8. This particular module is capable of
          exploiting the bug on Mac OS X PowerPC systems.
Metasploit Module: Samba lsa_io_trans_names Heap Overflow
Type: exploit
Path: modules/exploits/osx/samba/lsa_transnames_heap.rb
Platform: osx
Disclosure date: 2007-05-14
References: CVE-2007-2446, OSVDB-34699
Targets: Mac OS X 10.4.x x86 Samba 3.0.10, Mac OS X 10.4.x PPC Samba 3.0.10, DEBUG

Description:
This module triggers a heap overflow in the LSA RPC service
          of the Samba daemon. This module uses the szone_free() to overwrite
          the size() or free() pointer in initial_malloc_zones structure.
Metasploit Module: AppleFileServer LoginExt PathName Overflow
Type: exploit
Path: modules/exploits/osx/afp/loginext.rb
Platform: osx
Disclosure date: 2004-05-03
Authors: hdm
References: CVE-2004-0430, OSVDB-5762, BID-10271
Targets: Mac OS X 10.3.3

Description:
This module exploits a stack buffer overflow in the AppleFileServer service
          on MacOS X. This vulnerability was originally reported by Atstake and
          was actually one of the few useful advisories ever published by that
          company. You only have one chance to exploit this bug.
          This particular exploit uses a stack-based return address that will
          only work under optimal conditions.
Metasploit Module: MacOS X QuickTime RTSP Content-Type Overflow
Type: exploit
Path: modules/exploits/osx/rtsp/quicktime_rtsp_content_type.rb
Platform: osx
Disclosure date: 2007-11-23
Authors: unknown
References: CVE-2007-6166, OSVDB-40876, BID-26549
Targets: Mac OS X 10.4.0 PowerPC, QuickTime 7.0.0, Mac OS X 10.5.0 PowerPC, QuickTime 7.2.1, Mac OS X 10.4.8 x86, QuickTime 7.1.3, Mac OS X 10.5.0 x86, QuickTime 7.2.1

Description:
This module exploits a stack-based buffer overflow in Apple QuickTime
          before version 7.3.1. By sending an overly long RTSP response to a
          client, an attacker may be able to execute arbitrary code.
Metasploit Module: Mail.app Image Attachment Command Execution
Type: exploit
Path: modules/exploits/osx/email/mailapp_image_exec.rb
Platform: unix
Disclosure date: 2006-03-01
Authors: hdm
References: CVE-2006-0395, CVE-2007-6165, OSVDB-40875, BID-26510, BID-16907
Targets: Mail.app - Command Payloads, Mail.app - Binary Payloads (x86), Mail.app - Binary Payloads (ppc)

Description:
This module exploits a command execution vulnerability in the
          Mail.app application shipped with Mac OS X 10.5.0. This flaw was
          patched in 10.4 in March of 2007, but reintroduced into the final
          release of 10.5.
Metasploit Module: UFO: Alien Invasion IRC Client Buffer Overflow
Type: exploit
Path: modules/exploits/osx/misc/ufo_ai.rb
Platform: osx
Disclosure date: 2009-10-28
References: CVE-2009-10006, OSVDB-65689, EDB-14013
Targets: Mac OS X 10.5.8 x86, UFOAI 2.2.1

Description:
This module exploits a buffer overflow in the IRC client component
          of UFO: Alien Invasion 2.2.1.
Metasploit Module: Remote for Mac 2025.6 Unauthenticated UDP Keyboard RCE
Type: exploit
Path: modules/exploits/osx/misc/remote_for_mac_udp_rce.rb
Platform: unix
Disclosure date: 2025-05-27
Authors: Chokri Hammedi
Targets: Unix Shell

Description:
This module exploits an unauthenticated remote code execution vulnerability in Remote for Mac 2025.6.
          When the "Allow unknown devices" setting is enabled, it is possible to simulate keyboard input via UDP packets
          without authentication. By sending a sequence of key presses, an attacker can open the Terminal and execute
          arbitrary shell commands, achieving code execution as the current user.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'getVersion')
    })

    return CheckCode::Safe('Application might not be Remote For Mac') unless res&.code == 200

    json_body = res.get_json_document
    auth_enabled = json_body.fetch('requires.auth', nil)

    return CheckCode::Detected('Remote For Mac detected, but authentication enabled') unless auth_enabled.to_s == 'false'

    version = json_body.fetch('version').to_s

    return CheckCode::Unknown('Could not determine target version') if version.empty?

    target_version = Rex::Version.new(version)
    vulnerable_version = Rex::Version.new('2025.7')

    return CheckCode::Appears("Detected vulnerable version #{version} with authentication disabled") if target_version <= vulnerable_version

    CheckCode::Safe("Target version #{version} is not vulnerable")
  end
Metasploit Module: Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion
Type: exploit
Path: modules/exploits/osx/browser/adobe_flash_delete_range_tl_op.rb
Platform: osx
Disclosure date: 2016-04-27
References: CVE-2016-4117, BID-90505, URL-https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html, URL-http://www.securitytracker.com/id/1035826, URL-https://helpx.adobe.com/security/products/flash-player/apsa16-02.html, URL-https://helpx.adobe.com/security/products/flash-player/apsb16-15.html
Targets: Mac OS X

Description:
This module exploits a type confusion on Adobe Flash Player, which was
          originally found being successfully exploited in the wild. This module
          has been tested successfully on:
          macOS Sierra 10.12.3,
          Safari and Adobe Flash Player 21.0.0.182,
          Firefox and Adobe Flash Player 21.0.0.182.
Metasploit Module: Safari in Operator Side Effect Exploit
Type: exploit
Path: modules/exploits/osx/browser/safari_in_operator_side_effect.rb
Disclosure date: 2020-03-18
References: CVE-2020-9801, CVE-2020-9850, CVE-2020-9856, URL-https://github.com/sslab-gatech/pwn2own2020
Targets: Mac OS X x64 (Native Payload), Python payload, Command payload

Description:
This module exploits an incorrect side-effect modeling of the 'in' operator.
          The DFG compiler assumes that the 'in' operator is side-effect free, however
          the <embed> element with the PDF plugin provides a callback that can trigger
          side-effects leading to type confusion (CVE-2020-9850).
          The type confusion can be used as addrof and fakeobj primitives that then
          lead to arbitrary read/write of memory. These primitives allow us to write
          shellcode into a JIT region (RWX memory) containing the next stage of the
          exploit.
          The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server,
          and extracts a macOS application containing our payload into /var/db/CVMS.
          The payload can then be opened with CVE-2020-9801, executing the payload
          as a user but without sandbox restrictions.
Metasploit Module: Safari User-Assisted Applescript Exec Attack
Type: exploit
Path: modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb
Platform: unix
Disclosure date: 2015-10-16
References: CVE-2015-7007, URL-https://support.apple.com/en-us/HT205375

Description:
In versions of Mac OS X before 10.11.1, the applescript:// URL
          scheme is provided, which opens the provided script in the Applescript
          Editor. Pressing cmd-R in the Editor executes the code without any
          additional confirmation from the user. By getting the user to press
          cmd-R in Safari, and by hooking the cmd-key keypress event, a user
          can be tricked into running arbitrary Applescript code.

          Gatekeeper should be disabled from Security & Privacy in order to
          avoid the unidentified Developer prompt.
Metasploit Module: macOS Gatekeeper check bypass
Type: exploit
Path: modules/exploits/osx/browser/osx_gatekeeper_bypass.rb
Disclosure date: 2021-03-25
References: CVE-2021-30657, CVE-2022-22616, URL-https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508, URL-https://objective-see.com/blog/blog_0x64.html, URL-https://jhftss.github.io/CVE-2022-22616-Gatekeeper-Bypass/, URL-https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/
Targets: macOS x64 (Native Payload), Python payload, Command payload

Description:
This module exploits two CVEs that bypass Gatekeeper.

          For CVE-2021-30657, this module serves an OSX app (as a zip) that contains no
          Info.plist, which bypasses gatekeeper in macOS < 11.3.
          If the user visits the site on Safari, the zip file is automatically extracted,
          and clicking on the downloaded file will automatically launch the payload.
          If the user visits the site in another browser, the user must click once to unzip
          the app, and click again in order to execute the payload.

          For CVE-2022-22616, this module serves a gzip-compressed zip file with its file header pointing
          to the `Contents` directory which contains an OSX app. If the user downloads the file via Safari,
          Safari will automatically decompress the file, removing its `com.apple.quarantine` attribute.
          Because of this, the file will not require quarantining, bypassing Gatekeeper on
          MacOS versions below 12.3.
Metasploit Module: Mozilla Firefox 3.6.16 mChannel Use-After-Free
Type: exploit
Path: modules/exploits/osx/browser/mozilla_mchannel.rb
Platform: osx
Disclosure date: 2011-05-10
References: CVE-2011-0065, OSVDB-72085, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=634986, URL-http://www.mozilla.org/security/announce/2011/mfsa2011-13.html

Description:
This module exploits a use-after-free vulnerability in Mozilla
          Firefox 3.6.16. An OBJECT element, mChannel, can be freed via the
          OnChannelRedirect method of the nsIChannelEventSink Interface. mChannel
          becomes a dangling pointer and can be reused when setting the OBJECTs
          data attribute. This module has been tested on Mac OS X 10.6.6, 10.6.7,
          10.6.8, 10.7.2 and 10.7.3.
Metasploit Module: Apple OS X Software Update Command Execution
Type: exploit
Path: modules/exploits/osx/browser/software_update.rb
Platform: osx
Disclosure date: 2007-12-17
References: CVE-2007-5863, OSVDB-40722
Targets: Automatic

Description:
This module exploits a feature in the Distribution Packages,
          which are used in the Apple Software Update mechanism. This feature
          allows for arbitrary command execution through JavaScript. This exploit
          provides the malicious update server. Requests must be redirected to
          this server by other means for this exploit to work.
Metasploit Module: Apple Safari file:// Arbitrary Code Execution
Type: exploit
Path: modules/exploits/osx/browser/safari_file_policy.rb
Platform: %w{java osx unix}
Disclosure date: 2011-10-12
References: CVE-2011-3230, OSVDB-76389, URL-http://vttynotes.blogspot.com/2011/10/cve-2011-3230-launch-any-file-path-from.html#comments, URL-http://support.apple.com/kb/HT5000

Description:
This module exploits a vulnerability found in Apple Safari on OS X platform.
          A policy issue in the handling of file:// URLs may allow arbitrary remote code
          execution under the context of the user.

          In order to trigger arbitrary remote code execution, the best way seems to
          be opening a share on the victim machine first (this can be SMB/WebDav/FTP, or
          a file format that OS X might automount), and then execute it in /Volumes/[share].
          If there's some kind of bug that leaks the victim machine's current username,
          then it's also possible to execute the payload in /Users/[username]/Downloads/,
          or else bruteforce your way to getting that information.

          Please note that non-java payloads (*.sh extension) might get launched by
          Xcode instead of executing it, in that case please try the Java ones instead.
Metasploit Module: Safari Proxy Object Type Confusion
Type: exploit
Path: modules/exploits/osx/browser/safari_proxy_object_type_confusion.rb
Platform: osx
Disclosure date: 2018-03-15
References: CVE-2018-4233, CVE-2018-4404, URL-https://github.com/saelo/cve-2018-4233, URL-https://github.com/saelo/pwn2own2018, URL-https://saelo.github.io/presentations/blackhat_us_18_attacking_client_side_jit_compilers.pdf
Targets: Python payload, Command payload

Description:
This module exploits a type confusion bug in the Javascript Proxy object in
          WebKit. The DFG JIT does not take into account that, through the use of a Proxy,
          it is possible to run arbitrary JS code during the execution of a CreateThis
          operation. This makes it possible to change the structure of e.g. an argument
          without causing a bailout, leading to a type confusion (CVE-2018-4233).

          The JIT region is then replaced with shellcode which loads the second stage.
          The second stage exploits a logic error in libxpc, which uses command execution
          via the launchd's "spawn_via_launchd" API (CVE-2018-4404).