67 lines
No EOL
3.9 KiB
Text
67 lines
No EOL
3.9 KiB
Text
Source: https://code.google.com/p/google-security-research/issues/detail?id=477
|
|
|
|
Install.framework has a suid root binary here: /System/Library/PrivateFrameworks/Install.framework/Resources/runner
|
|
This binary vends the IFInstallRunner Distributed Object, which has the following method:
|
|
|
|
[IFInstallRunner makeReceiptDirAt:asRoot:]
|
|
|
|
If you pass 1 for asRoot, then this code will treat the makeReceiptDirAt string as a path and make two directories
|
|
(Library/Receipts) below it. At first glance this code looks immediately racy and no doubt we could play some
|
|
symlink tricks to get arbitrary directories created, but, on second glance, we can do a lot more!
|
|
|
|
This code is using distributed objects which is a "transparent" IPC mechanism: what this means in practise is that
|
|
not only can I call methods on the IFInstallRunner object running in the suid root process, but I can also pass it objects
|
|
from my process; when the suid root process then tries to call methods on those object this will actually result in callbacks
|
|
into my process :)
|
|
|
|
In this case rather than just passing an NSString as the makeReceiptDirAt parameter I create and pass an instance of my own class
|
|
"InitialPathObject" which behaves a bit like a string but gives me complete control over its behaviour from my process.
|
|
|
|
By creating a couple of this custom classes and implementing various methods we can reach calls to mkdir, chown and unlink with euid == 0.
|
|
We can completely control the string passed to mkdir and unlink.
|
|
In the chown case the code will chown our controlled path to root:admin; regular os x users are members of the admin group which means that this
|
|
will give the user access to files which previously belonged to a different group.
|
|
|
|
To hit the three actions (mkdir, chown and unlink) with controlled arguments we need to override various
|
|
combinations of selectors and fail at the right points:
|
|
|
|
InitialPathObject = the object we pass to the makeReceiptDirAt selector
|
|
overrides: - stringByAppendingPathComponent
|
|
* will be called twice:
|
|
* first time: return an NSString* pointing to a non-existant file
|
|
* second time: return SecondFakeStringObject
|
|
|
|
SecondFakeStringObject = returned by the second call to stringByAppendingPathComponent
|
|
overrides: - length
|
|
* will be called by the NSFileManager?
|
|
* return length of path to non-existant file
|
|
- getCharacters:
|
|
* will be called by the NSFileManager?
|
|
* return character of the non-existant file path
|
|
- fileSystemRepresentation
|
|
* for MKDIR:
|
|
* first time: return char* of the target path
|
|
* second time: return char* to non-existant file
|
|
* third time: return char* to non-existant file
|
|
* for CHOWN:
|
|
* first time: return char* of temporary directory to create and ignore
|
|
* second time: return char* of target path
|
|
* for UNLINK:
|
|
* first time: return char* of temporary directory to create and ignore
|
|
* second time: return char* to non-existant file
|
|
* third time: return char* to path to unlink
|
|
- stringByAppendingPathComponent:
|
|
* for MKDIR:
|
|
* not called
|
|
* for CHOWN:
|
|
* return NSString* pointing to file which does exist // to bail out before creating /Receipts
|
|
* for UNLINK
|
|
* not called
|
|
|
|
build: clang -o as_root_okay_then_poc as_root_okay_then_poc.m -framework Foundation
|
|
run: ./as_root_okay_then_poc MKDIR|CHOWN|UNLINK <target>
|
|
|
|
note that this will create some root-owned temporary directories in /tmp which will need to be manually cleaned up
|
|
|
|
Proof of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38137.zip |