Manouchehri

#!/usr/bin/python
import socket, ssl, select, time, re
from thread import start_new_thread
from struct import pack

TYPE_ENUM = 0
TYPE_STRING = 2
TYPE_BYTES = TYPE_STRING

def clean(s):

Manouchehri

/*
* (un)comment correct payload first (x86 or x64)!
* 
* $ gcc cowroot.c -o cowroot -pthread
* $ ./cowroot
* DirtyCow root privilege escalation
* Backing up /usr/bin/passwd.. to /tmp/bak
* Size of binary: 57048
* Racing, this may take a while..
* /usr/bin/passwd overwritten

Manouchehri

/*
 * CVE-2016-5195 dirtypoc
 *
 * This PoC is memory only and doesn't write anything on the filesystem.
 * /!\ Beware, it triggers a kernel crash a few minutes.
 *
 * gcc -Wall -o dirtycow-mem dirtycow-mem.c -ldl -lpthread
 */

#define _GNU_SOURCE

Manouchehri

from collections import defaultdict

import angr
import simuvex
import claripy

import analysis

"""
Memory metadata we keep for each address, like the addresses of the malloc

Manouchehri

.PHONY: using-gcc using-gcc-static using-clang

using-gcc:
	g++-4.8 -o main-gcc -lasan -O -g -fsanitize=address -fno-omit-frame-pointer main.cpp && \
	ASAN_OPTIONS=symbolize=1 ASAN_SYMBOLIZER_PATH=$(shell which llvm-symbolizer) ./main-gcc

using-gcc-static:
	g++-4.8 -o main-gcc-static -static-libstdc++ -static-libasan -O -g -fsanitize=address -fno-omit-frame-pointer main.cpp && \
	ASAN_OPTIONS=symbolize=1 ASAN_SYMBOLIZER_PATH=$(shell which llvm-symbolizer) ./main-gcc-static

Manouchehri

# In order for gpg to find gpg-agent, gpg-agent must be running, and there must be an env
# variable pointing GPG to the gpg-agent socket. This little script, which must be sourced
# in your shell's init script (ie, .bash_profile, .zshrc, whatever), will either start
# gpg-agent or set up the GPG_AGENT_INFO variable if it's already running.

# Add the following to your shell init to set up gpg-agent automatically for every shell
if [ -f ~/.gnupg/.gpg-agent-info ] && [ -n "$(pgrep gpg-agent)" ]; then
    source ~/.gnupg/.gpg-agent-info
    export GPG_AGENT_INFO
else

Manouchehri

1. brew install gnupg21, pinentry-mac (this includes gpg-agent and pinentry)

2. Generate a key: $ gpg --gen-key

3. Take the defaults. Whatevs

4. Tell gpg-agent to use pinentry-mac:

   $ vim ~/.gnupg/gpg-agent.conf 
   

Manouchehri

#!/usr/bin/env python
# -*- coding: utf-8 vi:noet
# Dump a clear-text version of an SSH key from gpg-agent

__author__ = "Jérôme Carretero <[email protected]>"
__licence__ = "MIT"

import sys, io, subprocess, re, ctypes

libgcrypt = ctypes.CDLL("libgcrypt.so")

Manouchehri

; Input	SHA256 : 3A74FBDF96B5E73F930F5887A82E4008FFB8484AE180DD3F7DE7480BC5577345
; Input	MD5    : 614D07EF7777CFF5CFDF741587A097DA
; Input	CRC32  : B326AB6B

; ---------------------------------------------------------------------------
; File Name   :	D:\_anal_temp\shellcode2.bin
; Format      :	Binary file
; Base Address:	0000h Range: 0000h - 02FCh Loaded length: 02FCh

		.686p

Manouchehri

# This was all run from user space
# I haven't tested it with root
# ... but it didn't prompt for any permissions under userspace ^_^
# Tested on 10.11.5

import objc
from Foundation import NSBundle
EAP8021X_bundle = NSBundle.bundleWithPath_('/System/Library/PrivateFrameworks/EAP8021X.framework')
Security_bundle = NSBundle.bundleWithIdentifier_('com.apple.security')