OS X 10.11.6 LPE PoC for CVE-2016-4655 / CVE-2016-4656
A detailed analysis of the CVEs used in this PoC is available here: Analysis and exploitation of Pegasus kernel vulnerabilities (CVE-2016-4655 / CVE-2016-4656)
OS X 10.11.6 LPE PoC for CVE-2016-4655 / CVE-2016-4656
OS X 10.11.6 LPE PoC for CVE-2016-4655 / CVE-2016-4656
A detailed analysis of the CVEs used in this PoC is available here: Analysis and exploitation of Pegasus kernel vulnerabilities (CVE-2016-4655 / CVE-2016-4656)
I got a crash instead of get root, my os x version is 10.11.5, the following is my log.
Anonymous UUID: XXXXXXXXXXXXXXXXXXXX
Tue Oct 25 11:27:13 2016
*** Panic Report ***
panic(cpu 0 caller 0xffffff80141ce5fa): Kernel trap at 0xffffff80140b9138, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x0000000016448d3f, CR3: 0x00000001baabd0dc, CR4: 0x00000000001627e0
RAX: 0x0000000016448d48, RBX: 0xffffff8027f2aba0, RCX: 0x0000000000000001, RDX: 0x000000008c000001
RSP: 0xffffff91313fbcc8, RBP: 0xffffff91313fbdc0, RSI: 0x000000000000004c, RDI: 0xffffff8027f2aba0
R8: 0x0000000000000000, R9: 0x0000000000000001, R10: 0xffffff802921c850, R11: 0xffffff8030a1d930
R12: 0x0000000000000000, R13: 0xffffff80268c58dc, R14: 0xffffff80268c58d8, R15: 0x000000000000004c
RFL: 0x0000000000010206, RIP: 0xffffff80140b9138, CS: 0x0000000000000008, SS: 0x0000000000000010
Fault CR2: 0x0000000016448d3f, Error code: 0x0000000000000002, Fault CPU: 0x0, PL: 0
Backtrace (CPU 0), Frame : Return Address
0xffffff91313fb950 : 0xffffff80140dab12
0xffffff91313fb9d0 : 0xffffff80141ce5fa
0xffffff91313fbbb0 : 0xffffff80141ec463
0xffffff91313fbbd0 : 0xffffff80140b9138
0xffffff91313fbdc0 : 0xffffff80146e37b6
0xffffff91313fbe00 : 0xffffff8014199a75
0xffffff91313fbe30 : 0xffffff80140df283
0xffffff91313fbe60 : 0xffffff80140c28b8
0xffffff91313fbea0 : 0xffffff80140d2665
0xffffff91313fbf10 : 0xffffff80141b8bc5
0xffffff91313fbfb0 : 0xffffff80141eca38
BSD process name corresponding to current thread: pwn
Mac OS version:
15F34
Kernel version:
Darwin Kernel Version 15.5.0: Tue Apr 19 18:36:36 PDT 2016; root:xnu-3248.50.21~8/RELEASE_X86_64
Kernel UUID: 7E7B0822-D2DE-3B39-A7A5-77B40A668BC6
Kernel slide: 0x0000000013e00000
Kernel text base: 0xffffff8014000000
__HIB text base: 0xffffff8013f00000
System model name: MacBookPro11,1 (Mac-189A3D4F975D5FFC)
System uptime in nanoseconds: 173558934435
last loaded kext at 13573279324: org.virtualbox.kext.VBoxNetAdp 5.0.12 (addr 0xffffff7f96bee000, size 28672)
loaded kexts:
org.virtualbox.kext.VBoxNetAdp 5.0.12
org.virtualbox.kext.VBoxNetFlt 5.0.12
org.virtualbox.kext.VBoxUSB 5.0.12
org.virtualbox.kext.VBoxDrv 5.0.12
com.apple.filesystems.autofs 3.0
com.apple.driver.AudioAUUC 1.70
com.apple.driver.AGPM 110.22.0
com.apple.driver.ApplePlatformEnabler 2.6.0d0
com.apple.driver.X86PlatformShim 1.0.0
com.apple.driver.AppleHDAHardwareConfigDriver 274.9
com.apple.driver.AppleGraphicsDevicePolicy 3.12.7
com.apple.driver.AppleHDA 274.9
com.apple.driver.AppleUpstreamUserClient 3.6.1
com.apple.driver.AppleOSXWatchdog 1
com.apple.driver.pmtelemetry 1
com.apple.iokit.IOUserEthernet 1.0.1
com.apple.driver.AppleLPC 3.1
com.apple.driver.AppleIntelHD5000Graphics 10.1.4
com.apple.iokit.IOBluetoothSerialManager 4.4.5f3
com.apple.driver.AppleThunderboltIP 3.0.8
com.apple.driver.ACPI_SMC_PlatformPlugin 1.0.0
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 4.4.5f3
com.apple.Dont_Steal_Mac_OS_X 7.0.0
com.apple.driver.AppleHV 1
com.apple.driver.AppleFIVRDriver 4.1.0
com.apple.driver.AppleSMCLMU 208
com.apple.driver.AppleIntelFramebufferAzul 10.1.4
com.apple.driver.AppleCameraInterface 5.46.0
com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0
com.apple.driver.AppleMuxControl 3.12.8
com.apple.driver.AppleBacklight 170.8.9
com.apple.driver.AppleMCCSControl 1.2.13
com.apple.iokit.SCSITaskUserClient 3.7.7
com.apple.driver.AppleUSBTCButtons 245.4
com.apple.driver.AppleUSBStorageCoexistentDriver 3.7.1
com.apple.driver.AppleUSBCardReader 3.7.1
com.apple.iokit.IOBluetoothUSBDFU 4.4.5f3
com.apple.driver.AppleUSBTCKeyEventDriver 245.4
com.apple.driver.AppleUSBTCKeyboard 245.4
com.apple.driver.AppleFileSystemDriver 3.0.1
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0
com.apple.BootCache 38
com.apple.iokit.IOAHCIBlockStorage 2.8.5
com.apple.driver.AppleAHCIPort 3.1.8
com.apple.driver.AirPort.Brcm4360 1040.1.1a6
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleRTC 2.0
com.apple.driver.AppleACPIButtons 4.0
com.apple.driver.AppleHPET 1.8
com.apple.driver.AppleSMBIOS 2.1
com.apple.driver.AppleACPIEC 4.0
com.apple.driver.AppleAPIC 1.7
com.apple.nke.applicationfirewall 163
com.apple.security.quarantine 3
com.apple.security.TMSafetyNet 8
com.apple.iokit.IOUSBUserClient 900.4.1
com.apple.kext.triggers 1.0
com.apple.driver.DspFuncLib 274.9
com.apple.kext.OSvKernDSPLib 525
com.apple.driver.AppleSMBusPCI 1.0.14d1
com.apple.iokit.IOSurface 108.2.1
com.apple.driver.IOPlatformPluginLegacy 1.0.0
com.apple.driver.X86PlatformPlugin 1.0.0
com.apple.driver.IOPlatformPluginFamily 6.0.0d7
com.apple.iokit.IOBluetoothHostControllerUSBTransport 4.4.5f3
com.apple.iokit.IOBluetoothFamily 4.4.5f3
com.apple.driver.CoreCaptureResponder 1
com.apple.driver.AppleHDAController 274.9
com.apple.iokit.IOHDAFamily 274.9
com.apple.iokit.IOAudioFamily 204.4
com.apple.vecLib.kext 1.2.0
com.apple.driver.AppleThunderboltEDMSink 4.1.1
com.apple.driver.AppleThunderboltDPOutAdapter 4.1.3
com.apple.driver.AppleIntelLpssUARTCommon 2.0.60
com.apple.AppleGraphicsDeviceControl 3.12.8
com.apple.iokit.IOAcceleratorFamily2 205.10
com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0
com.apple.driver.AppleIntelLpssUART 2.0.57
com.apple.driver.AppleIntelLpssDmac 2.0.60
com.apple.iokit.IOSerialFamily 11
com.apple.driver.AppleGraphicsControl 3.12.8
com.apple.driver.AppleBacklightExpert 1.1.0
com.apple.iokit.IONDRVSupport 2.4.1
com.apple.driver.AppleSMC 3.1.9
com.apple.driver.AppleSMBusController 1.0.14d1
com.apple.iokit.IOGraphicsFamily 2.4.1
com.apple.iokit.IOUSBMassStorageClass 4.0.2
com.apple.iokit.IOSCSIBlockCommandsDevice 3.7.7
com.apple.iokit.IOUSBMassStorageDriver 1.0.0
com.apple.iokit.IOSCSIArchitectureModelFamily 3.7.7
com.apple.driver.usb.IOUSBHostHIDDevice 1.0.1
com.apple.driver.AppleUSBMultitouch 250.5
com.apple.iokit.IOUSBHIDDriver 900.4.1
com.apple.driver.usb.cdc 5.0.0
com.apple.driver.usb.networking 5.0.0
com.apple.driver.usb.AppleUSBHostCompositeDevice 1.0.1
com.apple.driver.usb.AppleUSBHub 1.0.1
com.apple.driver.AppleUSBMergeNub 900.4.1
com.apple.driver.AppleXsanScheme 3
com.apple.iokit.IOAHCIFamily 2.8.1
com.apple.driver.AppleThunderboltDPInAdapter 4.1.3
com.apple.driver.AppleThunderboltDPAdapterFamily 4.1.3
com.apple.driver.AppleThunderboltPCIDownAdapter 2.0.2
com.apple.driver.AppleThunderboltNHI 4.0.4
com.apple.iokit.IOThunderboltFamily 6.0.2
com.apple.iokit.IO80211Family 1110.26
com.apple.driver.mDNSOffloadUserClient 1.0.1b8
com.apple.iokit.IONetworkingFamily 3.2
com.apple.driver.corecapture 1.0.4
com.apple.driver.AppleIntelLpssGspi 2.0.60
com.apple.driver.usb.AppleUSBXHCIPCI 1.0.1
com.apple.driver.usb.AppleUSBXHCI 1.0.1
com.apple.iokit.IOUSBFamily 900.4.1
com.apple.iokit.IOUSBHostFamily 1.0.1
com.apple.driver.AppleUSBHostMergeProperties 1.0.1
com.apple.driver.AppleEFINVRAM 2.0
com.apple.driver.AppleEFIRuntime 2.0
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.iokit.IOSMBusFamily 1.1
com.apple.security.sandbox 300.0
com.apple.kext.AppleMatch 1.0.0d1
com.apple.driver.AppleKeyStore 2
com.apple.driver.AppleMobileFileIntegrity 1.0.5
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.DiskImages 417.4
com.apple.iokit.IOStorageFamily 2.1
com.apple.iokit.IOReportFamily 31
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleACPIPlatform 4.0
com.apple.iokit.IOPCIFamily 2.9
com.apple.iokit.IOACPIFamily 1.4
com.apple.kec.Libm 1
com.apple.kec.pthread 1
com.apple.kec.corecrypto 1.0
Model: MacBookPro11,1, BootROM MBP111.0138.B17, 2 processors, Intel Core i5, 2.4 GHz, 8 GB, SMC 2.16f68
Graphics: Intel Iris, Intel Iris, Built-In
Memory Module: BANK 0/DIMM0, 4 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343531533641465238412D50422020
Memory Module: BANK 1/DIMM0, 4 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343531533641465238412D50422020
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x112), Broadcom BCM43xx 1.0 (7.21.95.175.1a6)
Bluetooth: Version 4.4.5f3 17904, 3 services, 19 devices, 1 incoming serial ports
Network Service: Wi-Fi, AirPort, en0
Serial ATA Device: APPLE SSD SM0256F, 251 GB
USB Device: USB 3.0 Bus
USB Device: Card Reader
USB Device: Apple Internal Keyboard / Trackpad
USB Device: BRCM20702 Hub
USB Device: Bluetooth USB Host Controller
Thunderbolt Bus: MacBook Pro, Apple Inc., 17.2
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.