-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add CVE-2022-22616 to gatekeeper bypass module #16401
Conversation
LGTM! I think this is OK to land as-is?
I couldn't reproduce the issue where the native session dies? |
I'm on 11.2.3 with the following output:
At this point a file appeared in Downloads with a grey circle with a slash through it, and no further actions happened. Also interesting its on 11.2.3 per "About this Mac", but its being detected as 10.15.6 (this is what the UA says it is...) |
I'll try and see if I can test on a |
I can't reproduce any failures for this unfortunately. I have two devices on 10.15.7 but presumably if I allow them to update, they will receive the patch for this issue. |
I tested on 11.5.2, and the file does still have the |
#RTFM I didn't realize clicking the file was required. This is working for me with the same payload as @timwr .
|
Just added a new commit that sets the local file header in the zip like in the Jamf blog post. It will also check the reported Safari version in the user agent if CVE-2022-22616 is being used. This time, I tested on both |
Release notesThis change adds support for CVE-2022-22616 to the existing Gatekeeper bypass exploit module which reportedly covers macOS Catalina all the way to MacOS Monterey versions below 12.3. Since this now targets two CVEs, I've introduced a new CVE option to select which CVE to exploit. This default is the most recent CVE. |
Description
This adds support for CVE-2022-22616 to the existing Gatekeeper bypass exploit module which reportedly covers MacOS Big Sur all the way to MacOS Monterey versions below 12.3. Since this now targets two CVEs, I've introduced a new
CVE
option to select which CVE to exploit. This default is the most recent CVE.Notes: Currently, the native OSX payload / target dies during exploitation. Not sure if that is related to the exploit itself or if there's an issue with the payload, so I'll try and look into that next week.
Verification
msfconsole
use exploit/osx/browser/osx_gatekeeper_bypass
set CVE <cve_num>
set LHOST <tab>
set SRVHOST <tab>
exploit
Scenarios