4 ms·

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a login would be deterministic.

michaelbuckbee 9y ago
My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).
- justadudeama 9y ago
  Does this user have admin privileges? root != admin on macOS if I recall correctly.
  - giancarlostoro 9y ago
    root IS an admin in macOS. You just cannot use root the same way you expect root to work in other Unix OS' without changing stuff in the BIOS (or whatever it's called for Apple) but you can still do most admin things with root. However root does get admin privileges, but when it comes to some system directories he is banned till you "fix" root privileges. Edit: See: https://stackoverflow.com/a/33272796 https://stackoverflow.com/a/33272796 for a bit more information of what I mean.
    - justadudeama 9y ago
      Thank you, I was wrong.
      - giancarlostoro 9y ago
        It's fine, by my own definition, that isn't a true root user... It ruins everything I've come to expect from using root.
- giancarlostoro 9y ago
  The first time I tried it, it just worked. I'm certain I've used root before. On the GUI portion it works with no password, but on the terminal it does not let me login as root without a password. Some weird OS magic must be going on there?
  - tomsmeding 9y ago
    AFAIK usually sudo doesn't let you enter an empty string as a password, even when the actual password is empty. So that is what you might be experiencing.
- kofejnik 9y ago
  it worked for me on 6th try or so. First few times, the prompt was returning to my user name, but then another failed attempt left it at 'root', and the next attempt succeeded

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a login would be deterministic.

michaelbuckbee 9y ago

My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).

justadudeama 9y ago
Does this user have admin privileges? root != admin on macOS if I recall correctly.
- giancarlostoro 9y ago
  root IS an admin in macOS. You just cannot use root the same way you expect root to work in other Unix OS' without changing stuff in the BIOS (or whatever it's called for Apple) but you can still do most admin things with root. However root does get admin privileges, but when it comes to some system directories he is banned till you "fix" root privileges. Edit: See: https://stackoverflow.com/a/33272796 https://stackoverflow.com/a/33272796 for a bit more information of what I mean.
  - justadudeama 9y ago
    Thank you, I was wrong.
    - giancarlostoro 9y ago
      It's fine, by my own definition, that isn't a true root user... It ruins everything I've come to expect from using root.
giancarlostoro 9y ago
The first time I tried it, it just worked. I'm certain I've used root before. On the GUI portion it works with no password, but on the terminal it does not let me login as root without a password. Some weird OS magic must be going on there?
- tomsmeding 9y ago
  AFAIK usually sudo doesn't let you enter an empty string as a password, even when the actual password is empty. So that is what you might be experiencing.
kofejnik 9y ago
it worked for me on 6th try or so. First few times, the prompt was returning to my user name, but then another failed attempt left it at 'root', and the next attempt succeeded