Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
rootsh — Local privilege escalation for OS X 10.10.5 via CVE-2016-1828. | Kitploit
Tools/GitHubGitHub/bazad/rootsh
Privilege EscalationVulnerability AnalysisExploitationBinary Exploitation
GitHubbazad/rootsh

rootsh

Local privilege escalation for OS X 10.10.5 via CVE-2016-1828.

View RepositoryWebsite
8624110 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

rootsh

rootsh is a local privilege escalation targeting OS X Yosemite 10.10.5 build 14F27. It exploits CVE-2016-1758 and CVE-2016-1828, two vulnerabilities in XNU that were patched in OS X El Capitan 10.11.4 and 10.11.5. rootsh will not work on platforms with SMAP enabled.

CVE-2016-1758

CVE-2016-1758 is an information leak caused by copying out uninitialized bytes of kernel stack to user space. By comparing leaked kernel pointers with fixed reference addresses it is possible to recover the kernel slide.

CVE-2016-1828

CVE-2016-1828 is a use-after-free during object deserialization. By passing a crafted binary-serialized dictionary into the kernel, it is possible to trigger a virtual method invocation on an object with a controlled vtable pointer.

License

The rootsh code is released into the public domain. As a courtesy I ask that if you use any of this code in another project you attribute it to me.

Download Tool