Hacker News Reader

Hacker News

Comment by benwilber0 | Hacker News Reader

Full thread

benwilber0

$ git clone https://github.com/kpwn/tpwn.git

Cloning into 'tpwn'...

remote: Counting objects: 16, done.

remote: Compressing objects: 100% (11/11), done.

remote: Total 16 (delta 3), reused 16 (delta 3), pack-reused 0

Unpacking objects: 100% (16/16), done.

Checking connectivity... done.

$ cd tpwn

$ make

gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3

strip tpwn

$ ./tpwn

leaked kaslr slide, @ 0x0000000008e00000

sh-3.2# whoami

root

sh-3.2#

Shit's real.

Edit: for those of you wondering, no, I didn't just run this willy-nilly. I read the code thoroughly and determined there were no side-effects aside from just the PoC dropping to a root shell.

View on HN

I did the same, didn't get the root shell but instead got a standard OS X kernel panic screen and system reboot twice before it came back to life.

And wtf @qwertyoruiop this is how you "responsibly" release zero day?!

I just upgraded to 10.10.5 yesterday!

You have quotes around "responsibly", is that a quote from somewhere in this disclosure?

You're welcome to point out that you prefer that vulns be disclosed to vendors before public release, but to chastise someone for not subscribing to your preferred methodology seems a bit off base

chastise someone for not subscribing to your preferred methodology seems a bit off base

No - chastising someone for performing an act you consider to be harmful to the public is totally legitimate.

Nice to see a 100% working widely exploitable 0day without any caveats that make it not real-world applicable. Local, so you need a non-admin account on the box which is kinda hard.

I don't understand what you're implying. This is a 0day that could be exploited from any number of outside channels.

You can also use it to build malware that would normally be defeated by an unprivileged account right?

A java applet could exploit this. With a little work, a Flash load in Safari (or really any browser) could probably exploit it.

This is a real 0day.

Go ahead and give us an example.

What user does your web browser run as? Do you use chrome? Any Chrome extensions use the NDK?

Shell script in a git repo?

I can't reply to your post lower in the thread, but saying a java applet and flash app can exploit this? It's a C program that requires a local account on the box. You would need to break out of the java sandbox into local unprivileged shell access before you could exploit this via java. Same with flash - you would need a flash exploit that breaks you out of the sandbox before you can exploit this. In other words, you'd need two major vulnerabilities to do what you want to do. That's why I posted a reply saying 'tell us how'. It's important to understand that to exploit this you need a local unprivileged account on the box.

Java applet and Flash 0days exist in the wild whether they're published or not. I am confident that 0days for them exist and are actively used right now.

So you're going to tell me that this is a non-issue because it's "unexploitable"?

I think you spelled 'exploitable' wrong, since that's what I actually said when passing on my complements to the author above. I feel like I'm arguing with a dining room table.

it's a major piece of a multi-step own, no doubt. Get write and execute from browser, email client or office doc vulns, and shit's on. Rootkit installed and bot ready to install more payload components.

Add malware to valued homebrew tool, profit.

easily exploitable in the mode of many project "installers" these days which is something like:

  curl <some_url> | bash

Phew, didn't work for me out of the box:

$ make gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3 In file included from /usr/include/dispatch/dispatch.h:51:0, from /System/Library/Frameworks/IOKit.framework/Headers/IOKitLib.h:56, from import.h:13, from lsym.h:5, from lsym.m:1: /usr/include/dispatch/object.h:143:15: error: expected identifier or '(' before '^' token typedef void (^dispatch_block_t)(void);

Just to clearify: that's just means you couldn't compile it. It doesn't imply your system is/isn't vulnerable.

Sure, but its somehow satisfying to know that its broken for those who don't make the effort to fix it. ;) (It happened to me because I'm using a different compiler than the exploit needs..)

Malware comes precompiled and ready to run, it doesn't depend on you having a compiler installed.

True that! I'm looking at you, homebrew ..

Not sure why you're looking at Homebrew.

If you're feeling jumpy about binary packages, just set `HOMEBREW_BUILD_FROM_SOURCE="1"` in your shell profile.

Nobody's forcing binaries onto you.

True, but I don't have all the time in the world to read the sources, either ..

Then you should not install them on a machine with confidential data at all, source or binary. It's that simple!

use `clang`, not `gcc`.

clang version 3.6.1 (tags/RELEASE_361/final) Target: x86_64-apple-darwin14.4.0 Thread model: posix

<-- can confirm it works out-of-the-box on OSX 10.10.4

Cool, thanks for pointing that out. I was pretty glib about my attempt to check it out ..

Reply on news.ycombinator.com