CVE-2016-1757

This exploit leverages a race condition in macOS's execve syscall handling to manipulate the memory of a suid-root binary before the old task port is invalidated. It demonstrates privilege escalation by overwriting the entrypoint of /usr/sbin/traceroute6 with shellcode to spawn a root shell.

This exploit leverages a race condition in the Mach IPC subsystem (CVE-2016-1757) to achieve local privilege escalation on OS X. It abuses bootstrap_register2 to gain root privileges or bypass System Integrity Protection (SIP) by targeting SUID or entitled binaries.

This repository contains a functional local privilege escalation exploit for CVE-2016-1757, targeting a race condition in OS X's Mach IPC mechanism. The exploit consists of a client-server pair that abuses bootstrap_register2 to escalate privileges, bypassing SIP and SUID restrictions.