How to Easily Bypass macOS High Sierra's Login Screen & Get Root (No Password Hacking Required) « Null Byte :: WonderHowTo

It looks like there isa fatal flawin the current macOS High Sierra 10.13.1, even straight from the login menu when you first start up the computer. This severe vulnerability lets hackers — or anyone with malicious intentions — do anything they want as root users as long as they have physical access to the computer.Designated asCVE-2017-13872by Apple, this bug is not the be-all and end-all of exploitable bugs, where you can load up a remote terminal and just log into a victim's Mac without leaving the room you're in. Unless, of course, thevictim has screen-sharing enabled. If this isn't the case, the attacker is going to have to get up close and personal with the victim's laptop, meaning the attacker is going to have to James Bond his or her way to the victim's Mac and be in front of the computer itself.Appleissued a patch within 18 hoursof this vulnerability being discovered, but for users who had not yet upgraded their operating system from the original version of High Sierra (10.13.0) to 10.13.1 before applying the patch,some have reported the bug re-emerging after updating. Because this patch seems to be having some issues rolling out, you shouldtest to make sure this vulnerability doesn't affect your macOS device.Don't Miss:How to Know if You've Been HackedStep 1: Logging into Root from BootA hacker can just start up the machine, literally. When on the login window, they'd click on the "Other" option, not an actual user or guest user. For the username, they'd simply inputroot, and for the password, it would be left empty. All they have to do is click inside the password box, then hit enter. They may need to hit enter repeatedly until successfully logged in and on the desktop.If someone is already logged into the computer, a hacker could still use this root/passwordless trick to bypass privilege escalation prompts.It doesn't need to be from the login window.Security researcher Patrick Wardle was also able todemonstrate this scary exploit working remotelyif screen sharing was enabled.So what's happening here? According toPatrick's findings, the reason this takes two clicks is a logic error in the way macOS attempts to validate credentials for unknown users. In this case, the first attempt actually creates the user account and sets whatever password you used to attempt to log in (or no password). The second attempt to log in then logs in and authenticates with the account that was created with the first click.Step 2: Looting the SystemThat was quick. After getting in, the attacker can quickly install any type of software he or she wants on the victim's Mac, so long as no one is looking. They can also reset passwords, view hidden files, and anything else you can think of.Don't Miss:How to Steal MacOS Files with a Rubber DuckyProtecting Yourself from This HackNow that the scary stuff is out of the way, it's fairly simple to make sure this doesn't happen without waiting for Apple to fix this problem, or have found the patch to be ineffective.On your admin account, open a terminal window, then type the line below, followed by pressing enter. The-uargument will unlock the non-existing password allowing you to change the root password.sudo passwd -u rootIf logged into the administrator account, you'll need to input your admin password first before proceeding. Then, enter a root password, then confirm it.More Info:How to Protect Yourself from macOS High Sierra's Glaring Empty-Password Security FlawIn the end, make sure to keep that root password safe. If you lose that password, it will be completely difficult should you need it, and you will have to format or go through some extra steps to get complete access back onto your Mac.Have any questions? Comment below or hit me up on Twitter@Nitroux2.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo by Kody/Null Byte; Screenshots by Nitrous/Null ByteRelatedHow To:Protect Yourself from macOS High Sierra's Glaring Empty-Password Security FlawHow To:Create a Bootable Install USB Drive of macOS 10.12 SierraHow To:The Ultimate Guide to Hacking macOSHow To:Get iOS 10's New Wallpaper on Any PhoneHow To:Fix the 'Software Update Is Required to Connect to Your iPhone' Warning on Your MacHacking macOS:How to Hack a Mac Password Without Changing ItHacking macOS:How to Hack a MacBook with One Ruby CommandNews:'Messages in iCloud' Finally Available for Macs, Not Just iOS DevicesNews:8 Tips for Creating Strong, Unbreakable PasswordsHow To:Bypass the Password Login Screen on Windows 8Hacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)Hacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHow To:Get iOS 10 on Your iPad or iPhone Right Now with Apple's Public BetaHow To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToHacking macOS:How to Perform Privilege Escalation, Part 1 (File Permissions Abuse)How To:Bypass Locked Windows Computers to Run Kali Linux from a Live USBHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:Hack Metasploitable 2 Part 1How To:Steal Ubuntu & MacOS Sudo Passwords Without Any CrackingHow To:Customize the Login Window Background on Your MacHacking macOS:How to Bypass the LuLu Firewall with Google Chrome DependenciesHow To:This LastPass Phishing Hack Can Steal All Your Passwords—Here's How to Prevent ItOne-Tap, Hassle-Free Logins:Automate the Sign-In Process for Your Favorite Websites on AndroidGoodnight Byte:Coding a Web-Based Password Cracker in PythonSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordNews:Flaw in the Latest Linux Graphical Server Allows Passwordless LoginsHow To:Bypass Windows and Linux PasswordsHow To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitGoodnight Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsHow To:Hack Mac OS X Lion PasswordsHow To:Make an Unbreakable Linux Password Using a SHA-2 Hash AlgorithmMastering Security, Part 1:How to Manage and Create Strong PasswordsGoodnight Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingCommunity Byte:Coding a Web-Based Password Cracker in PythonHow To:Avoid Root Password Reset on Kali Live USB Persistence BootHow To:Remotely Reset Router P.DG AV4001NNews:Super humanos. Adrenalina, en 60 segundos. www.explainers.tvHow To:log on Windows 7 with username & passwordGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingNews:Change from BASH to zsh