6 ms·
$ git clone https://github.com/kpwn/tpwn.git https://github.com/kpwn/tpwn.git Cloning into 'tpwn'... remote: Counting objects: 16, done. remote: Compressing
by benwilber0 11y ago
$ git clone https://github.com/kpwn/tpwn.git https://github.com/kpwn/tpwn.git
Cloning into 'tpwn'...
remote: Counting objects: 16, done.
remote: Compressing objects: 100% (11/11), done.
remote: Total 16 (delta 3), reused 16 (delta 3), pack-reused 0
Unpacking objects: 100% (16/16), done.
Checking connectivity... done.
$ cd tpwn
$ make
gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3
strip tpwn
$ ./tpwn
leaked kaslr slide, @ 0x0000000008e00000
sh-3.2# whoami
root
sh-3.2#
Shit's real.
Edit: for those of you wondering, no, I didn't just run this willy-nilly. I read the code thoroughly and determined there were no side-effects aside from just the PoC dropping to a root shell.
- mmaunder 11y agoNice to see a 100% working widely exploitable 0day without any caveats that make it not real-world applicable. Local, so you need a non-admin account on the box which is kinda hard.
- benwilber0 11y agoI don't understand what you're implying. This is a 0day that could be exploited from any number of outside channels.
- brazzledazzle 11y agoYou can also use it to build malware that would normally be defeated by an unprivileged account right?
- benwilber0 11y agoA java applet could exploit this. With a little work, a Flash load in Safari (or really any browser) could probably exploit it. This is a real 0day.
- honest_joe 11y agoexcept it's no longer an 0day.
- mmaunder 11y agoGo ahead and give us an example.
- benwilber0 11y agoWhat user does your web browser run as? Do you use chrome? Any Chrome extensions use the NDK?
- ossreality 11y agolmao, something running under the NDK is massively sandboxed and would not be exploitable like this.
- jsprogrammer 11y agoShell script in a git repo?
- deleted 11y ago[deleted]
- mmaunder 11y agoI can't reply to your post lower in the thread, but saying a java applet and flash app can exploit this? It's a C program that requires a local account on the box. You would need to break out of the java sandbox into local unprivileged shell access before you could exploit this via java. Same with flash - you would need a flash exploit that breaks you out of the sandbox before you can exploit this. In other words, you'd need two major vulnerabilities to do what you want to do. That's why I posted a reply saying 'tell us how'. It's important to understand that to exploit this you need a local unprivileged account on the box.
- benwilber0 11y agoJava applet and Flash 0days exist in the wild whether they're published or not. I am confident that 0days for them exist and are actively used right now. So you're going to tell me that this is a non-issue because it's "unexploitable"?
- mmaunder 11y agoI think you spelled 'exploitable' wrong, since that's what I actually said when passing on my complements to the author above. I feel like I'm arguing with a dining room table.
- bro-stick 11y agoit's a major piece of a multi-step own, no doubt. Get write and execute from browser, email client or office doc vulns, and shit's on. Rootkit installed and bot ready to install more payload components.
- fit2rule 11y agoAdd malware to valued homebrew tool, profit.
- ams6110 11y agoeasily exploitable in the mode of many project "installers" these days which is something like: curl <some_url> | bash
- devy 11y agoI did the same, didn't get the root shell but instead got a standard OS X kernel panic screen and system reboot twice before it came back to life. And wtf @qwertyoruiop this is how you "responsibly" release zero day?! I just upgraded to 10.10.5 yesterday!
- akerl_ 11y agoYou have quotes around "responsibly", is that a quote from somewhere in this disclosure? You're welcome to point out that you prefer that vulns be disclosed to vendors before public release, but to chastise someone for not subscribing to your preferred methodology seems a bit off base
- matthewmacleod 11y agochastise someone for not subscribing to your preferred methodology seems a bit off base No - chastising someone for performing an act you consider to be harmful to the public is totally legitimate.
- fit2rule 11y agoPhew, didn't work for me out of the box: $ make gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3 In file included from /usr/include/dispatch/dispatch.h:51:0, from /System/Library/Frameworks/IOKit.framework/Headers/IOKitLib.h:56, from import.h:13, from lsym.h:5, from lsym.m:1: /usr/include/dispatch/object.h:143:15: error: expected identifier or '(' before '^' token typedef void (^dispatch_block_t)(void);
- klapinat0r 11y agoJust to clearify: that's just means you couldn't compile it. It doesn't imply your system is/isn't vulnerable.
- fit2rule 11y agoSure, but its somehow satisfying to know that its broken for those who don't make the effort to fix it. ;) (It happened to me because I'm using a different compiler than the exploit needs..)
- MagerValp 11y agoMalware comes precompiled and ready to run, it doesn't depend on you having a compiler installed.
- deleted 11y ago[deleted]