I've read the disclosure post by Emil Kvarnhammar of TrueSec (Hidden backdoor API to root privileges in Apple OS X) and I'm trying to confirm whether I'm vulnerable or not.
After creating an
exploit.py script with the contents of Emil's exploit POC, I run:
$ python exploit.py /bin/bash root-bash
will write file /Users/dserodio/root-bash
Then I can see that a suid root executable was indeed created:
$ ls -l root-bash
-rwsrwxrwx 1 root Domain Users 1228336 Apr 14 10:51 root-bash
But when I launch this, it doesn't seem to be a root shell:
$ exec ./root-bash
$ touch foo
$ ls -l foo
-rw-r--r-- 1 dserodi Domain Users 0 Apr 14 11:01 foo
If I use a shell script that runs
id, creates files, etc. instead of using /bin/bash to create an interactive shell, the results are the same (ie.: created as suid root but apparently without root privileges).
Can someone help me understand what's happening, and if I'm vulnerable to the "rootpipe" bug (CVE-2015-1130)?