A macOS kernel exploit based on an IOHIDFamily 0day.
The prefetch timing attack I'm using for
hid for some reason doesn't work on High Sierra 10.13.2 anymore, and I don't feel like investigating that. Maybe patched, maybe just the consequence of a random change, I neither know nor care. The vuln is still there and my code does both info leak and kernel r/w, just not in the same binary - reason is explained in the write-up. If you want that feature, consider it an exercise for the reader.
The exploit consists of three parts:
pocpanics the kernel to demonstrate the presence of a memory corruption, should work on all macOS versions.
leakleaks the kernel slide, could be adapted to other versions but as-is works only on High Sierra.
hidachieves full kernel r/w, tested only on Sierra and High Sierra (up to & including 10.13.1), might work on earlier versions too.
leak need to be run as the user that is currently logged in via the GUI, and they log you out in order to perform the exploit.
hid on the other hand, gives you four options for a first argument:
stealrequires to be run as root and SIP to be disabled, but leaves you logged in the entire time.
killrequires root and forces a dirty logout by killing
logoutif executed as root or the currently logged in user, logs you out via
launchctl. Otherwise tries to log you out via AppleScript, and then falls back to
waitsimply waits for a logout, shutdown or reboot to occur.
Additionally you can specify a second argument
persist. If given,
hid will permanently disable SIP and AMFI, and install a root shell in
hid should be run either via SSH or from a
screen session, if you wish to observe their output.
Should all be self-explanatory:
make all make poc make leak make hid make clean