CVE-2015-5889

Related Files

Mac OS X 10.9.5 / 10.10.5 rsh/libmalloc Privilege Escalation

Posted Oct 27, 2015

Authored by rebel, shandelman116 | Site metasploit.com

This Metasploit module writes to the sudoers file without root access by exploiting rsh and malloc log files. Makes sudo require no password, giving access to su even if root is disabled. Works on OS X 10.9.5 to 10.10.5 (patched on 10.11).

tags | exploit, root

systems | apple, osx

advisories | CVE-2015-5889

SHA-256 | 1959cf26f98a303dd73293b46328a6156cc9e858b22283d3803da877cf76e849

Download | Favorite | View

issetugid() + rsh + libmalloc OS X Local Root

Posted Oct 3, 2015

Authored by Philip Pettersson

The default root-suid binary /usr/bin/rsh on Mac OS X uses execv() in an insecure manner. /usr/bin/rsh will invoke /usr/bin/rlogin if launched with only a host argument, without dropping privileges or clearing the environment. This exploit will pass "MallocLogFile" to /usr/bin/rsh, which is then passed on to rlogin and interpreted by libmalloc to create a root-owned file with partially controlled contents at /etc/crontab which gives a rootshell via sudo. Tested on 10.9.5 / 10.10.5 but it most likely works on much older versions too.

tags | exploit, root

systems | apple, osx

advisories | CVE-2015-5889

SHA-256 | 57369dae3073aa171e586034196b70f67cf18695ca619dddcbe2f77bfce377a9

Download | Favorite | View