Kernel Apple Vulnerability –

I have been away for some time.

In the first day of my return I have found the following vulnerability related with Apple.

It seems nasty… Although it cannot be remotely exploited it might be used in phishing campaigns that might trick the user to execute some software that takes ownership of the computer.

More info:

Exploit / Proof of concept


Exploring Mac OS Server – afctl Adaptive Firewall

I have learned a lot in the past months Mac OS X Server and his capabilities and what are services it can give with lower cost than competition.

The several services presented by OS Server are interesting, in the middle of the most eye candy services I have found one that allows us to improve security controls in a situation where for some time I thought there was not much to do in the native OS.

The bellow tool would allow us to mitigate brute force attacks in automated way. Something that was not known to me without extra tools.

Apple has implemented the Adaptive Firewall on Mac OS Server

Enable the service with the following command:

sudo /Applications/ -c
sudo /Applications/ -f

afctl is a tool for temporarily blocking a given ipv4 or ipv6 address using the built-in firewall.
All blocking requests have a time to live; they are unblocked when it expires.

afctl also maintins a whitelist of addresses that it will not block.
All block requests are checked against this list before being added to the blacklist.

All the firewall rules managed by afctl are grouped into a rule set to allow for bulk enabling/disabling via -e & -d.

I did not find much documentation about this tool.

I will try to update this information while I learn.

For now what I have is the following from the man factl page:

afctl [-v debug_level] [-a ip_address -t ttl] [-w ip_address] [-r ip_address] [-x ip_address] [-c -i interval] [-e] [-d] [-f]

-v -debug_level Verbosity, ascenting numbers are more verbose. level 0 is default level 1 is basic progress.

-a -ip_address Add address to the blacklist. ip_address can be ipv4 or ipv6 in CDIR notation. No DNS names allowed. An optional -t parameter allows the specification of the time in minutes that the address will remain blocked.

-r -ip_address Remove address from the blacklist. It will also be removed from the firewall rules.

-w -ip_address Add address to the white list. ip_address can be ipv4 or ipv6 in CDIR notation. No DNS names allowed.

-x -ip_address Remove an address from the white list. ip_address can be ipv4 or ipv6 in CDIR notation. No DNS names allowed.

-c -i interval Self configure. The afctl tool will query the system configuration and determine the addresses that need to be  (routers, local interfaces, nameservers). It will also modify its launchd plist to invoke the tool every interval to remove old entries from the blacklist. If -i interval is not specified, then a default value of 15 minutes will be used.

-d Disables all firewall rules managed by afctl using a rule set (see man page for ipfw ). Currently ipfw only ( ip6fw does not support rule sets).

-e Enables the rules disabled by -d (above)

-f Forces afctl into a running state (sets the proper key in af.plist and writes out af_state )

We can also get a summary of the afctl activity running the following command:

sudo /Applications/

Information available from Apple is very restrict and almost resumes to this and user support questions:

I will post more as soon I have news.

OpenWRT and Raspberry PI Access Point

Today I decided to build one personal access point for my travels.

I had one Raspberry PI 2 in my drawers and I decided to use it.

I wanted to prepare something fancy based on web environment and not in bash.

Trying to see what exists compatible with raspberry pi I have found OpenWRT…

I tried to install it and everything work well until I tried to put the wireless cards working. 🙁

The wi-fi did not start-up, I could not make it work…
Until I found I had to install some packages…

I have installed the hostapd package
I have installed the hostapd-common
I have installed the hostapd-utils

This is required to transform the device into an access point.

To install this packages I used the web interface.
Menu System -> Software

Finally I discovered that the network drivers did not exist, I have installed the drivers for the wireless network cards…

opkg install kmod-rt2800-lib kmod-rt2800-usb kmod-rt2x00-lib kmod-rt2x00-usb

The suddenly I have a new menu and I can see wi-fi networks… 🙁

But I am not still able to connect or able to advertise my SSID… 🙁

I Hope to be able to complete this post very soon with all the required steps.

List all IP addresses range in a 16 bit network v1.0


Pass some IP address as part of a command string to test reverse proxy vulnerability and scan the internal network behind the proxy. Running one already existing python script that receives this Ip as one possible dmz host to scan open tcp ports.

Exploit only accepts one DMZ ip as argument. Does not accept any range or array of IP addresses.


Script that provides me all possible IPs one per one in a network with 16 or more bits so the python exploit script can be called with the ip address as argument.


The python script call from shell with the ip and argument for scanning the DMZ network.

Script does nothing it only list all the ip address in a 16bit network starting from until it reaches

Create multiple parallel requests as they are not dependent and will be faster if executed in parallel.

# List all IPs in 16 Bit Network
let first_Octet=192
let second_Octet=168
let third_Octet=0
let fourth_Octet=0
while [ $third_Octet -lt 255 ]
		while [ $fourth_Octet -lt 255 ]
			let fourth_Octet=$[$fourth_Octet+1]
			echo $host
		let third_Octet=$[$third_Octet+1]
		let fourth_Octet=0


File Management

Working in bash will force us to understand file management and how to work with them.

Create Files

To create a folder / directory use the mkdir command the argument will be the folder name that you wish to create, you can use more than one argument and in that case it will create more than one folder.

touch command can be used to create files, like in the folders the argument is the file name. If you use more than one argument you will create more than one file.

Cat command outputs the content of a file to screen. It has no paging, if you open the wrong type of files your terminal might get mess up, you will need to use reset to make it return to initial state.

less also allows you to see the content of a command, the difference is that this command will allow us to search contents or move up or down in the file.

Less command also tries to identify the type of file.

Open command can be used to open a file with the program that is associated to it. This command will open the file in the graphic mode so you will leave bash.

open .

The command “file” will tell you what type of the file is, this will allow you to understand if the file is a picture or a binary file for example.

Remember that the extension is not mandatory in the shell.

Use the “TAB” key for autocomplete

Working with Files

rm is remove command

mv is move command

In Mac OS the file names are not case sensitive. This is a difference between Linux and OSx

File names can contain almost any character except the “/”

Advises for file names:

  • Use only letters and numbers if you use multiple words use a “-” or “_” as a separator
  • Use only lower case characters
  • Avoid using spaces specially if they are in the end of the file.
  • Avoid using the following characters
    • `
    • *
    • #
    • !
    • $
    • ?
    • @
    • &
    • |
    • { }
    • ( )
    • : ;
    • \
    • < >
    • “TAB”
    • “SPACE”
    • “DELETE”

If we have file names with this previous characters we need to use an escape character.

  1. Backslash ( \ ) is the escape character and it can escape a single character.
  2. Single quotes (‘ ‘) can escape all characters between them

Path types

There are 2 types of file paths, relative and absolute paths.

Absolute paths normally start with a “/” or with a “.

Example: /var/log

Relative paths

They do not start with a “/” or “.” and are resolved to a working directory.

Example: cd ~ will send us to the current user home path.

Handling Files and Folders

To copy files we use the command “cp” that stands for copy.

You can use now the “man cp” to know what you can do with the command. If you notice the command takes 2 arguments where the first argument is the Origin and the second argument is the destination.

It also can take multiple arguments as sources to one destination.

cp command will silently overwrite existing files.

To copy directories and the contents we need to use the option -R that states for recursively.

The command will be similar to the files “cp -R Origin Destination”

Like files we can also use multiple sources to one or multiple destinations.

Another command to deal with Files and Folders is the “mv” command that states for moving.

Like the copy command we need also 2 arguments, one for origin and another to destination.

Use the “man mv” to get more information about the command and his arguments and options.

Files can be deleted with the “rm” command, that stands for remove.

The command can receive one or more arguments that are the list of the files or folders to remove.

Because removing the files is permanent we can use the -i option, that will ask us to confirm for each file to remove.

The “-i” option can also be used for other commands.