Name

why L1br4 ? because it's the my first time to find vul and use the vul to get root(not just know the vul and write exp), so i decided to use my constellation to name it

Analyse

you can see the analyse from my blog

target

on MacOS 10.13 or 10.13.1

Vul

1. queryCompletioninAVEBridge
2. getDisplayPipeCapabilityinAppleIntelFramebufferAzul
3. ReadRegister32inAppleIntelFramebufferAzul

How to use

make

At last, use the command:

./pwn

And you will get root~ Having fun with this