CVE-2023-26818 PoC — Telegram 安全漏洞

Source

https://github.com/Zeyad-Azima/CVE-2023-26818

Associated Vulnerability

Title:Telegram 安全漏洞 (CVE-2023-26818)
Description:Telegram是一款即时通信移动应用程序。 Telegram 9.3.1、9.4.0版本存在安全漏洞，该漏洞源于DYLD_INSERT_LIBRARIES标志存在问题，攻击者利用该漏洞可以访问受限文件、麦克风或视频记录。

Description

CVE-2023-26818 Exploit MacOS TCC Bypass W/ Telegram

Readme

# Disclaimer
This exploit has been created solely for the purposes of research and for the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The author and the owner of the script disclaim any responsibility or liability for any misuse or damage caused by this software. Users are urged to use this software responsibly and only in accordance with applicable laws and regulations. Not for non-ethical usages.

# CVE-2023-26818
CVE-2023-26818 Exploit MacOS TCC Bypass W/ Telegram. You can read the vulnerability analysis <a href="https://zeyadazima.com/macos/CVE_2023_26818_P1/">Part 1</a> and <a href="https://zeyadazima.com/macos/CVE_2023_26818_P2/">Part 2</a> for sandbox bypass.

![Screenshot 2023-09-11 at 8 43 14 PM](https://github.com/Zeyad-Azima/CVE-2023-26818/assets/62406753/c207212b-050e-4ae7-a1ac-5e26abbeb391)


# Video

[![CVE-2023-26818](https://img.youtube.com/vi/fV9f7ZG5vFE/0.jpg)](https://www.youtube.com/watch?v=fV9f7ZG5vFE)


# Manual Compile and Usage
## Camera
```
gcc -dynamiclib -framework Foundation -framework AVFoundation Camexploit.m -o Cam.dylib
```
![image](https://github.com/Zeyad-Azima/CVE-2023-26818/assets/62406753/220f774e-6532-417b-b5e2-177b13752397)

## Microphone
```
gcc -dynamiclib -framework Foundation -framework AVFoundation Micexploit.m -o Micexploit.dylib
```
![image](https://github.com/Zeyad-Azima/CVE-2023-26818/assets/62406753/3b27cf97-4205-4732-8eb5-cc526bc6a1c8)

## Location
```
gcc -dynamiclib -framework Foundation -framework CoreLocation -framework AVFoundation Locexploit.m -o Locexploit.dylib
```
![image](https://github.com/Zeyad-Azima/CVE-2023-26818/assets/62406753/2283da05-4899-46d8-a93a-7d34bca23a3c)

File Snapshot


 [4.0K]  /data/pocs/90edf1a269f999fd815d378dc706dca45c33963c
├── [4.0K]  Cam-Exploit
│   ├── [2.7K]  Camexploit.m
│   └── [ 656]  CamTest.m
├── [4.0K]  Exports
│   ├── [ 55K]  Cam.dylib
│   ├── [ 54K]  Locexploit.dylib
│   └── [ 55K]  Micexploit.dylib
├── [4.0K]  libs
│   ├── [3.8K]  Camexploit.m
│   ├── [3.3K]  Locexploit.m
│   └── [3.8K]  Micexploit.m
├── [4.0K]  Location-Exploit
│   └── [1.7K]  Locexploit.m
├── [5.9K]  main.cpp
├── [4.0K]  Mic-Exploit
│   ├── [2.7K]  Micexploit.m
│   └── [ 689]  MicTest.m
└── [1.7K]  README.md

5 directories, 13 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!