Re: Mac symlink attack techniques?

Jon,

On Fri, 11 Apr 2008, Jon Hart wrote:

> Greetings,
>
> I'm curious if anyone has some input on this.  I am in a situation where
> I am able to perform a symlink attack against a process that runs as
> root on a Mac.  The catch is that I can create files that don't exist
> and get them be created mode 666 for world writable goodness, but if the
> symlink points to a file that already exists all I can do is clobber its
> content with garbage.
>
> Clearly, havoc can be made by trashing important files, but I'm looking
> for an elegant and quick method for privilege escalation.  Is
> /etc/ld.so.conf my only option?

Just a few hints off the top of my head. Specific to Mac OS X:

http://www.milw0rm.com/exploits/2737
http://www.milw0rm.com/exploits/3386

Other platforms:

http://www.0xdeadbeef.info/exploits/raptor_libnspr2
http://www.0xdeadbeef.info/exploits/raptor_libnspr3
http://www.0xdeadbeef.info/exploits/raptor_prctl2.c
http://www.milw0rm.com/exploits/792

Hope this helps,

--
Marco Ivaldi, OPST
Red Team Coordinator      Data Security Division
@ Mediaservice.net Srl    http://mediaservice.net/


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------