Apple macOS 10.13.1 (High Sierra) – Insecure Cron System Local Privilege Escalation

• Exploit Database
• 125 阅读

• 作者： Mark Wadham
  日期： 2017-12-06
• 类别：

  • local
  平台：

  • macos
• 来源：https://www.exploit-db.com/exploits/43247/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

  Recently I was working on an security issue in some other software that has yet to be disclosed which created a rather interesting condition. As a non-root user I was able to write to any file on the system that was not SIP-protected but the resulting file would not be root-owned, even if it previously was.   This presented an interesting challenge for privilege escalation - how would you exploit this to obtain root access? The obvious first attempt was the sudoers file but sudo is smart enough not to process it if the file isn&apos;t root-owned so that didn&apos;t work.   I then discovered (after a tip from a friend - thanks pndc!) that the cron system in macOS does not care who the crontab files are owned by. Getting root was a simple case of creating a crontab file at: </code><code> /var/at/tabs/root </code><code> with a 60-second cron line, eg: </code><code> * * * * * chown root:wheel /tmp/payload && chmod 4755 /tmp/payload </code><code> and then waiting for it to execute. It&apos;s not clear if this is a macOS-specific issue or a hangover from the BSD-inherited cron system, I suspect the latter.   The issue has been reported to Apple so hopefully they will fix it.