How to Hack Mac OS X Lion Passwords « Null Byte :: WonderHowTo

This Null Byte is a doozey.On Sunday, September 19th, an exploit for the latest Mac OS X 10.7 "Lion" wasdiscovered by Patrick Dunstan. This exploit allows for an attacker, even remotely, to request to have the root user's password changed without knowing the password to the system beforehand. This would lead to the legitimate owner of the system getting locked out, as well as all of their files being compromised (unless disc encryption was in place). Let's go over why this happens, and how to stop it until a patch comes out.A Byte of InfoThe way a Mac system stores its user passwords is similar to Linux, as they are both built off of the Unix kernel. A user creates an account, and then the encrypted hash of the user's password file, their "Shadow" file, is saved in a .plist file located in /var/db/dslocal/nodes/Default/users. The normal way a user would crack this, is to obtain a users Generated User ID (GID) and find it in the shadow file. This flaw is averted by only allowing the root user to view the shadow file.This still holds true in Lion. However, one major flaw was overlooked. Non-root users cannot directly view hash data, but rather, they canextractit from Directory Services.Step1How to Extract the HashesNormally, to see profile information about a user, you invoke this command in a terminal:$ dscl localhost -read /Local/Default/Users/<root user>To see hash data, we just invoke Directory Services using the /Search/ path like so:$ dscl localhost -read /Search/Users/<root user>Now, in the terminal output you should see a line in there that says:dsAttrTypeNative:ShadowHashData:Look at the bytes below it. Bytes 28-32 are the password salt (4 bytes are in each octet), and bytes 32-96 are the SHA512 hash. From there, the user wanting privilege escalation can then load the hash into a password cracker for SHA512 hashes with 4 byte salts. There is one made by the author of the exploitherewritten in python (brownie points for that, good sir).Step2Copy > pastethe code in a text document and name it "hack.py".Get a password list to run against the file - you can find good ones atPacket Storm.In a terminal, change to the directory "hack.py" is in and issue the command with this syntax:$ python hack.py <username> <path/to/dictionary/file>Wait until it completes and retrieves your password.What if it Can't Crack the Password?That's simple, not only did Mac slip up on being able toreadpassword hashes, any user can issue the "passwd" command to changeanyuser's passwords. Feel safe still, Mac users?Here's an example:$ dscl localhost -passwd /Search/Users/<root user>You will then be prompted to enter a new password for the user. There it is, easier than denying your teenage daughter a brand new car, a user can change your password.How Do I Keep Myself Safe from This?Keep a REALLY long password, that isn't in a dictionary (full ASCII jumbles are preferred).Never leave your computer unattended, and do not enable remote access. This is disabled by default, so don't worry if you're unsure.Hacker artwork byaltemarkWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Upgrade to Mountain Lion from Leopard (OS X 10.5 to 10.8)How To:Hack Your PC into a Mac! How to Install OS X Mountain Lion on Any Intel-Based ComputerHow To:Create a Bootable Install DVD or USB Drive of OS X 10.8 Mountain LionHow To:Hack into a Mac Without the PasswordHow To:Create a Bootable Install USB Drive of Mac OS X 10.9 MavericksHow To:Organize applications in Mac OS X Lion using LaunchpadHow To:Get JumpPad the Windows version of Mac OS X Lion LaunchPadHow To:Reformat Mac OS X Without a Recovery Disc or DriveHow To:Share files between two Macs with Airdrop in OS X LionHow To:Install Mac OS X 10.7 Lion BetaHow To:Use an SD card to install Mac OS X LionHow To:Install Mac OS X Lion on a PCHow To:Change OS X’s Annoying Default Settings Using TerminalHow To:Get a Mac OS X Lion theme in Snow LeopardHow To:Protect Yourself from Someone Trying to Hack into Your MacHow To:View Your Friend's Tweets in the Contacts App on Mac OS X Mountain LionHow To:Disable Password Prompts When Downloading Free Apps in the Mac App StoreHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Install the Command Line Developer Tools Without XcodeHow To:3 Free Alternatives to Apple's iPhotoHow To:Use the Simple Finder user interface in Mac OS XHow To:Use the Mac OS X terminalMac Troubleshooting:How to Find Your Restart, Shutdown & Uptime HistoryHow To:Open Third-Party Apps from Unidentified Developers in macOSHow To:Enable Google Chrome's Secret (And Possibly Dangerous) Experimental FeaturesHow To:Quote emails in full or part with Mac OS X's Mail appHow To:Set custom pronunciations in Mac OS X's VoiceOver toolHow To:Draw Simba ( the Lion King )News:This Hack Turns Your iPad into a Multi-Window Multitasking Powerhouse for $10How To:Organize your Mail in Mac OS XHow To:Get Mac OS X's App Dock on Your Windows PCHow To:The Ultimate Guide to Password-Protecting Files & Folders in Mac OS X YosemiteHow To:USB Tether Your Android Device to Your Mac—Without RootingHow To:Every Mac Is Vulnerable to the Shellshock Bash Exploit: Here's How to Patch OS XMac for Hackers:How to Get Your Mac Ready for HackingHow To:Download OS X 10.11 El Capitan on Your MacNews:Calvin & Hobbes + OS X Desktop WallpaperHow To:Access Hidden Mac OS X Settings in Lion and Mountain Lion Without Using TerminalNews:MAC OS X on PC for REALzZz, My FriendzZz...!Secure Your Computer, Part 1:Password-Protect your BIOS Boot Screen