Metasploit modules that can be used to exploit Apple » Safari

Order by Disclosure Date Module Name Module Type
  • macOS Dirty Cow Arbitrary File Write Local Privilege Escalation
    Disclosure Date: 2022-12-17
    First seen: 2023-09-11
    exploit/osx/local/mac_dirty_cow
    An app may be able to execute arbitrary code with kernel privileges Authors: - Ian Beer - Zhuowei Zhang - timwr
  • Safari in Operator Side Effect Exploit
    Disclosure Date: 2020-03-18
    First seen: 2020-10-01
    exploit/osx/browser/safari_in_operator_side_effect
    This module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the <embed> element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions. Authors: - Yonghwi Jin <jinmoteam@gmail.com> - Jungwon Lim <setuid0@protonmail.com> - Insu Yun <insu@gatech.edu> - Taesoo Kim <taesoo@gatech.edu> - timwr
  • Safari in Operator Side Effect Exploit
    Disclosure Date: 2020-03-18
    First seen: 2020-10-01
    exploit/osx/browser/safari_in_operator_side_effect
    This module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the <embed> element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions. Authors: - Yonghwi Jin <jinmoteam@gmail.com> - Jungwon Lim <setuid0@protonmail.com> - Insu Yun <insu@gatech.edu> - Taesoo Kim <taesoo@gatech.edu> - timwr
  • Safari Proxy Object Type Confusion
    Disclosure Date: 2018-03-15
    First seen: 2020-04-26
    exploit/osx/browser/safari_proxy_object_type_confusion
    This module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the structure of e.g. an argument without causing a bailout, leading to a type confusion (CVE-2018-4233). The JIT region is then replaced with shellcode which loads the second stage. The second stage exploits a logic error in libxpc, which uses command execution via the launchd's "spawn_via_launchd" API (CVE-2018-4404). Authors: - saelo
  • Safari Webkit Proxy Object Type Confusion
    Disclosure Date: 2018-03-15
    First seen: 2020-04-26
    exploit/apple_ios/browser/webkit_createthis
    This module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the structure of e.g. an argument without causing a bailout, leading to a type confusion (CVE-2018-4233). The type confusion leads to the ability to allocate fake Javascript objects, as well as the ability to find the address in memory of a Javascript object. This allows us to construct a fake JSCell object that can be used to read and write arbitrary memory from Javascript. The module then uses a ROP chain to write the first stage shellcode into executable memory within the Safari process and kick off its execution. The first stage maps the second stage macho (containing CVE-2017-13861) into executable memory, and jumps to its entrypoint. The CVE-2017-13861 async_wake exploit leads to a kernel task port (TFP0) that can read and write arbitrary kernel memory. The processes credential and sandbox structure in the kernel is overwritten and the meterpreter payloads code signature hash is added to the kernels trust cache, allowing Safari to load and execute the (self-signed) meterpreter payload. Authors: - saelo - niklasb - Ian Beer - siguza
  • Safari Webkit JIT Exploit for iOS 7.1.2
    Disclosure Date: 2016-08-25
    First seen: 2020-08-14
    exploit/apple_ios/browser/safari_jit
    This module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw, obtains root and disables code signing. Finally we download and execute the meterpreter payload. This module has been tested against iOS 7.1.2 on an iPhone 4. Authors: - kudima - Ian Beer - WanderingGlitch - timwr
  • Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft
    Disclosure Date: 2015-04-08
    First seen: 2020-04-26
    auxiliary/gather/apple_safari_ftp_url_cookie_theft
    A vulnerability exists in versions of OSX, iOS, and Windows Safari released before April 8, 2015 that allows the non-HTTPOnly cookies of any domain to be stolen. Authors: - Jouko Pynnonen - joev <joev@metasploit.com>
  • SSL/TLS Version Detection
    Disclosure Date: 2014-10-14
    First seen: 2022-12-23
    auxiliary/scanner/ssl/ssl_version
    Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites, certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST. Authors: - todb <todb@metasploit.com> - et <et@metasploit.com> - Chris John Riley - Veit Hailperin <hailperv@gmail.com> - h00die
  • Mac OS X Safari file:// Redirection Sandbox Escape
    Disclosure Date: 2014-01-16
    First seen: 2020-04-26
    auxiliary/gather/safari_file_url_navigation
    Versions of Safari before 8.0.6, 7.1.6, and 6.2.6 are vulnerable to a "state management issue" that allows a browser window to be navigated to a file:// URL. By dropping and loading a malicious .webarchive file, an attacker can read arbitrary files, inject cross-domain Javascript, and silently install Safari extensions. Authors: - joev <joev@metasploit.com>
  • Apple Safari file:// Arbitrary Code Execution
    Disclosure Date: 2011-10-12
    First seen: 2020-04-26
    exploit/osx/browser/safari_file_policy
    This module exploits a vulnerability found in Apple Safari on OS X platform. A policy issue in the handling of file:// URLs may allow arbitrary remote code execution under the context of the user. In order to trigger arbitrary remote code execution, the best way seems to be opening a share on the victim machine first (this can be SMB/WebDav/FTP, or a file format that OS X might automount), and then execute it in /Volumes/[share]. If there's some kind of bug that leaks the victim machine's current username, then it's also possible to execute the payload in /Users/[username]/Downloads/, or else bruteforce your way to getting that information. Please note that non-java payloads (*.sh extension) might get launched by Xcode instead of executing it, in that case please try the Java ones instead. Authors: - Aaron Sigel - sinn3r <sinn3r@metasploit.com>
  • Apple Safari Webkit libxslt Arbitrary File Creation
    Disclosure Date: 2011-07-20
    First seen: 2020-04-26
    exploit/windows/browser/safari_xslt_output
    This module exploits a file creation vulnerability in the Webkit rendering engine. It is possible to redirect the output of a XSLT transformation to an arbitrary file. The content of the created file must be ASCII or UTF-8. The destination path can be relative or absolute. This module has been tested on Safari and Maxthon. Code execution can be achieved by first uploading the payload to the remote machine in VBS format, and then upload a MOF file, which enables Windows Management Instrumentation service to execute the VBS. Authors: - Nicolas Gregoire
  • MacOS X QuickTime RTSP Content-Type Overflow
    Disclosure Date: 2007-11-23
    First seen: 2020-04-26
    exploit/osx/rtsp/quicktime_rtsp_content_type
    This module exploits a stack-based buffer overflow in Apple QuickTime before version 7.3.1. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code. Authors: - unknown
  • Apple QuickTime 7.3 RTSP Response Header Buffer Overflow
    Disclosure Date: 2007-11-23
    First seen: 2020-04-26
    exploit/windows/misc/apple_quicktime_rtsp_response
    This module exploits a stack buffer overflow in Apple QuickTime 7.3. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com>
  • Apple QTJava toQTPointer() Arbitrary Memory Access
    Disclosure Date: 2007-04-23
    First seen: 2020-04-26
    exploit/multi/browser/qtjava_pointer
    This module exploits an arbitrary memory access vulnerability in the Quicktime for Java API provided with Quicktime 7. Authors: - hdm <x@hdm.io> - kf <kf_list@digitalmunition.com> - ddz <ddz@theta44.org>
  • Cross Platform Webkit File Dropper
    First seen: 2020-04-26
    auxiliary/server/webkit_xslt_dropper
    This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the target file-system. By default, the file will be dropped in C:\Program Files\ Authors: - Nicolas Gregoire
15 metasploit modules found
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close