TempAccountNull

void inject_trusts(int pathc, const char *paths[])
{
    printf("[+] injecting into trust cache...\n");
    
    extern uint64_t g_kern_base;
  
    static uint64_t tc = 0;
    if (tc == 0) {
	// loaded_trust_caches: 0xFFFFFFF008F702C8
        tc = g_kern_base + (0xFFFFFFF008F702C8 - 0xFFFFFFF007004000);

TempAccountNull

#!/usr/bin/env python
# pip install future
from sys import argv, stdout
from os import system, remove
from urlparse import urlparse
import re
import dfu
import ssl
import asn1
import math

TempAccountNull

diff --git a/Makefile b/Makefile
index 96e99b7..4884309 100644
--- a/Makefile
+++ b/Makefile
@@ -43,6 +43,10 @@ arm64:
 	gobjcopy -O binary -j .text bin/checkm8_arm64.o bin/checkm8_arm64.bin
 	rm bin/checkm8_arm64.o
 
+	xcrun -sdk iphoneos clang src/checkm8_nopaddingcorruption_arm64.S -target arm64-apple-darwin -Wall -o bin/checkm8_nopaddingcorruption_arm64.o
+	gobjcopy -O binary -j .text bin/checkm8_nopaddingcorruption_arm64.o bin/checkm8_nopaddingcorruption_arm64.bin

TempAccountNull

//
//  exploit.c
//  extra_time
//
//  Created by Jake James on 2/8/20.
//  Copyright © 2020 Jake James. All rights reserved.
//

#include "exploit.h"
#include "IOAccelerator_stuff.h"

TempAccountNull

/* MIT License
 *
 * Copyright (c) namazso 2018
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:

TempAccountNull

CVE-2023-41444 - Binalyze IREC.sys Vulnerable Driver

Credits

Mike Alfaro (@_mmpte_software) and Tyler Booth (@tyler_dru1d)

Description

An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges due to an improper DACL being applied to the device the driver creates.

Vulnerability Type

Incorrect Acess Control

TempAccountNull

@echo off
setlocal

REM Config section, change if required
set REG=C:\Windows\System32\reg.exe
set DEBUGGER=vsjitdebugger.exe
REM Config section end
 
set method=enable
set debugExe=

TempAccountNull

#include <windows.h>
#include <memory>
#include <string>

//returns the serial number of the first physical drive in a std::string or an empty std::string in case of failure
//based on http://codexpert.ro/blog/2013/10/26/get-physical-drive-serial-number-part-1/
std::string getFirstHddSerialNumber() {
    //get a handle to the first physical drive
    HANDLE h = CreateFileW(L"\\\\.\\PhysicalDrive0", 0, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
    if(h == INVALID_HANDLE_VALUE) return {};