SQL Injection on GET parameter = id. The payloads used are boolean-based blind, error-based and UNION query.
Command Injection Vulnerability (with root privileges) in LaCie's 5big Network appliance running firmware version 2.2.8. Just open a netcat listener and run this script to receive a reverse shell to exploit the vulnerability.
A local root privilege escalation vulnerability was discovered in Hashicorp's vagrant-vmware-fusion plugin. The initial patch released by Hashicorp was 4.0.21, which contained a bug that prevented it from working on Mac systems. Subsequent releases of 4.0.22 and 4.0.23 were still exploitable, as the wrapper script executed the sudo helper as root, and the sudo helper was not root-owned, allowing an attacker to overwrite it with arbitrary ruby code which would then be executed as root when vagrant up was run. The issue was fixed in 4.0.24 by making the sudo helper root-owned.
Hashicorp's vagrant-vmware-fusion plugin for vagrant is vulnerable to privilege escalation due to a fundamental design flaw in the way the plugin is written combined with the need to elevate privileges for certain functions within Fusion. The encrypted ruby code that the plugin is comprised of must remain owned by the non-root user, creating a huge attack surface that can be exploited to manipulate the execution of the program and still get root on 4.0.24. The exploit can be patched out of the code, creating a symlink for a binary that VMWare moved in v10 and then the exploit works on Fusion 8.x and Fusion 10. This vulnerability is fixed in 4.0.25 by replacing the suid helper binary with a new go binary that contains all the required elevated operations and doesn't call back to the vulnerable ruby code.
A race condition vulnerability was discovered in the update mechanism of Vagrant 5.0.0. The vulnerability occurs when the user runs the command 'vagrant plugin update', which causes the plugin to reinstall, including replacing the sudo helper and re-applying root ownership and the suid bit. This is done via osascript with a block of shell as an easy way to show a graphical popup authentication dialog to the user. An attacker can exploit this vulnerability by scanning the process list watching for the invocation of osascript, and then replacing the sudo helper binary with an exploit payload. The attacker can then send a STOP signal to the installer to pause its execution, allowing the attacker to move the newly suid-root'ed binary to a safe place and execute it.
Sera is a free app for mac and iOS that lets you unlock your mac automatically when your iphone is within a configured proximity. Unfortunately to facilitate this it stores the users login password in their home directory at ~/Library/Preferences/no.ignitum.SeraOSX.plist which makes root privilege escalation trivial and worse than that even facilitates dumping the keychain as we can easily obtain the user's login password. If they are an admin user we can even dump items from the system keychain.
A local attacker or malware can exploit the installation process of version 5.0.0 of the Vagrant VMware Fusion plugin to escalate privileges to root. The mitigations pushed by Hashicorp for this issue were not sufficient as 5.0.1 is still exploitable with a slightly different approach. The issue is fixed in version 5.0.2.
This vulnerability is a straight to root privesc with no user interaction. It occurs because the suid root sudo helper executes /Applications/VMware Fusion.app/Contents/Library/vmnet-cli as root, but if the application isn't installed and we're a local admin user we can create a fake app directory with a payload in place of vmnet-cli that gets executed as root.
Arq Backup from Haystack Software versions of mac before 5.9.7 are vulnerable to a local root privilege escalation exploit. The updater binary has a 'setpermissions' function which sets the suid bit and root ownership on itself but it suffers from a race condition that allows you to swap the destination for these privileges using a symlink. We can exploit this to get +s and root ownership on any arbitrary binary.
Murus firewall requires the user to authenticate every time in order to obtain the access it needs to modify the firewall settings. If a local attacker or malware is running as an admin user (ie has write access to /Applications/), they can subvert this process to silently obtain root access without the user knowing.
Services By CQR