Exploitation Summary
EIP tracks 3 public exploits for CVE-2016-1757. PoCs published by Google Security Research, fG!, gdbinit.
AI-analyzed exploit summary This exploit leverages a race condition in macOS's execve syscall handling to manipulate the memory of a suid-root binary before the old task port is invalidated. It demonstrates privilege escalation by overwriting the entrypoint of /usr/sbin/traceroute6 with shellcode to spawn a root shell.
Description
Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Exploits (3)
This exploit leverages a race condition in macOS's execve syscall handling to manipulate the memory of a suid-root binary before the old task port is invalidated. It demonstrates privilege escalation by overwriting the entrypoint of /usr/sbin/traceroute6 with shellcode to spawn a root shell.
This exploit leverages a race condition in the Mach IPC subsystem (CVE-2016-1757) to achieve local privilege escalation on OS X. It abuses bootstrap_register2 to gain root privileges or bypass System Integrity Protection (SIP) by targeting SUID or entitled binaries.
This repository contains a functional local privilege escalation exploit for CVE-2016-1757, targeting a race condition in OS X's Mach IPC mechanism. The exploit consists of a client-server pair that abuses bootstrap_register2 to escalate privileges, bypassing SIP and SUID restrictions.
References (8)
Scores
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H