This Metasploit module exploits a vulnerability in libxpc on macOS versions 10.13.3 and below. The task_set_special_port API allows callers to overwrite their bootstrap port, which is used to communicate with launchd. This port is inherited across forks: child processes will use the same bootstrap port as the parent. By overwriting the bootstrap port and forking a child processes, we can now gain a MitM position between our child and launchd. To gain root we target the sudo binary and intercept its communication with opendirectoryd, which is used by sudo to verify credentials. We modify the replies from opendirectoryd to make it look like our password was valid.
d81c090e142679481756278a6bfdf34affd2552062d989fcb8bd5743ab2960b1Apple Security Advisory 2018-7-23-5 - watchOS 4.3.1 addresses buffer overflow, code execution, and denial of service vulnerabilities.
b2ef5d97a0dd4510c8d65950bb3a0565483a6e3af0f1fedf4e319f255c891d27Apple Security Advisory 2018-7-23-3 - iOS 11.4 addresses buffer overflow, code execution, and denial of service vulnerabilities.
857fee29a90629f33ba85af6600e36de596f303b9de4fc96e0cc80eb90fae597Apple Security Advisory 2018-7-23-4 - tvOS 11.4 addresses buffer overflow, code execution, and denial of service vulnerabilities.
414e2fd1f058460610b6e631ce22a9620407a86f8b5f4823842f21a210f09bdaApple Security Advisory 2018-7-23-2 - 2018-003 Sierra, Security Update 2018-003 El Capitan addresses buffer overflow, code execution, denial of service, and information leakage vulnerabilities.
40ab18846fd839375f4ed6a0867906b19120c108c6f84988f596010072b08773Apple Security Advisory 2018-06-01-6 - tvOS 11.4 addresses buffer overflow, code execution, and denial of service vulnerabilities.
cf297a1d1709f69c63008abd53a5bad99c4a8a4734712409cc14a7f48ecae560Apple Security Advisory 2018-06-01-5 - watchOS 4.3.1 addresses buffer overflow, code execution, and denial of service vulnerabilities.
186ed96a050a6056a4439f90e0a88652005680ecf9733a2595a9efc7d2127d3eApple Security Advisory 2018-06-01-4 - iOS 11.4 addresses buffer overflow, code execution, and denial of service vulnerabilities.
235011f8d40f10f6eefc42756667cf9730b9b7549ad68a89cec4884cef6a0e64Apple Security Advisory 2018-06-01-1 - macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, and Security Update 2018-003 El Capitan are now available and address buffer overflow, code execution, and denial of service vulnerabilities.
f1c1097a0f35ab083639ce62b1aa2c922ca19a9a848c0a4f9871446a85fed753
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed