| #include <windows.h> | |
| #include <memory> | |
| #include <string> | |
| //returns the serial number of the first physical drive in a std::string or an empty std::string in case of failure | |
| //based on http://codexpert.ro/blog/2013/10/26/get-physical-drive-serial-number-part-1/ | |
| std::string getFirstHddSerialNumber() { | |
| //get a handle to the first physical drive | |
| HANDLE h = CreateFileW(L"\\\\.\\PhysicalDrive0", 0, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); | |
| if(h == INVALID_HANDLE_VALUE) return {}; |
| @echo off | |
| setlocal | |
| REM Config section, change if required | |
| set REG=C:\Windows\System32\reg.exe | |
| set DEBUGGER=vsjitdebugger.exe | |
| REM Config section end | |
| set method=enable | |
| set debugExe= |
Mike Alfaro (@_mmpte_software) and Tyler Booth (@tyler_dru1d)
An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges due to an improper DACL being applied to the device the driver creates.
Incorrect Acess Control
| /* MIT License | |
| * | |
| * Copyright (c) namazso 2018 | |
| * | |
| * Permission is hereby granted, free of charge, to any person obtaining a copy | |
| * of this software and associated documentation files (the "Software"), to deal | |
| * in the Software without restriction, including without limitation the rights | |
| * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
| * copies of the Software, and to permit persons to whom the Software is | |
| * furnished to do so, subject to the following conditions: |
| // | |
| // exploit.c | |
| // extra_time | |
| // | |
| // Created by Jake James on 2/8/20. | |
| // Copyright © 2020 Jake James. All rights reserved. | |
| // | |
| #include "exploit.h" | |
| #include "IOAccelerator_stuff.h" |
| diff --git a/Makefile b/Makefile | |
| index 96e99b7..4884309 100644 | |
| --- a/Makefile | |
| +++ b/Makefile | |
| @@ -43,6 +43,10 @@ arm64: | |
| gobjcopy -O binary -j .text bin/checkm8_arm64.o bin/checkm8_arm64.bin | |
| rm bin/checkm8_arm64.o | |
| + xcrun -sdk iphoneos clang src/checkm8_nopaddingcorruption_arm64.S -target arm64-apple-darwin -Wall -o bin/checkm8_nopaddingcorruption_arm64.o | |
| + gobjcopy -O binary -j .text bin/checkm8_nopaddingcorruption_arm64.o bin/checkm8_nopaddingcorruption_arm64.bin |
| #!/usr/bin/env python | |
| # pip install future | |
| from sys import argv, stdout | |
| from os import system, remove | |
| from urlparse import urlparse | |
| import re | |
| import dfu | |
| import ssl | |
| import asn1 | |
| import math |
| void inject_trusts(int pathc, const char *paths[]) | |
| { | |
| printf("[+] injecting into trust cache...\n"); | |
| extern uint64_t g_kern_base; | |
| static uint64_t tc = 0; | |
| if (tc == 0) { | |
| // loaded_trust_caches: 0xFFFFFFF008F702C8 | |
| tc = g_kern_base + (0xFFFFFFF008F702C8 - 0xFFFFFFF007004000); |