3 ms·
I haven't read through all 1000 comments on the other thread, so apologies if it's been covered somewhere else, but... Does anyone know if this can be exploite
by 13of40 9y ago
I haven't read through all 1000 comments on the other thread, so apologies if it's been covered somewhere else, but... Does anyone know if this can be exploited programmatically to bypass the need for 'sudo'. For example, could malware use this to elevate itself to root once it's running as a low-privileged user on the system?
- Qerub 9y agoYeah, sure. Here's a example from https://twitter.com/duo_labs/status/935607023026229249 https://twitter.com/duo_labs/status/935607023026229249 on how to escalate to root: /usr/bin/osascript -e 'do shell script "<command to be run as root>" user name "root" password "" with administrator privileges'
- 13of40 9y agoFrom the comments on that, it seems like you need to do the exploit in the UI first. According the the analysis of the bug, "Upon receiving a mach XPC message, opendirectoryd invokes..." but what happens on the client end of the XPC message isn't mentioned. I'm just wondering if a low privileged user can initiate that programmatically, and whether they could do it from code that doesn't need to be signed, like a shell script.