Press 5 keys and become r00t aka CVE-2021-30655

Introduction

I personally love vulnerabilities with stories. This one is of that kind… About one year ago, I submitted a vulnerability to Apple that they were unable to reproduce. We exchanged some emails with the clarifications, but the security team still couldn’t have validated the original vulnerability. Then they asked me to run sysdiagnose in order to collect logs that could have helped them.

The problem

Like a real security researcher I checked how the /usr/bin/sysdiagnose acutally works. It turned out that it executes a lot of commands:

$ strings /usr/bin/sysdiagnose | grep "/bin"
/usr/bin/leaks
/usr/bin/footprint
/usr/bin/sample
/usr/bin/find
/usr/bin/hdiutil
/usr/bin/dmc
/usr/bin/killall
/usr/bin/odutil
/usr/bin/nfsstat
/usr/bin/nclist
/bin/cat
/bin/launchctl
/usr/bin/pluginkit
[...]

The output is then saved to /private/var/tmp/ directory and archived as tar.gz archive. I unpacked it, and indeed I saw a lot of different logs. You can run it by pressing Shift+Control+Option+Command+Period. While it was running, I opened Crescendo to trace all the events that the sysdiagnose produced.

As you can see, that tool runs as root. As it launches a lot of different executables, I spotted an opportunity to elevate my privileges.

After some time, I found the LPE! Sysdiagnose measures WiFi velocity by running /usr/libexec/wifivelocityd. That daemon tries to launch a tool that doesn’t exist on macOS. That tool should be present in the /usr/local/bin directory that the standard user sometimes has access to. (kudos CodeColorist for sharing this technique in his blog post) If you have Homebrew installed, this directory is writeable by your user and anyone else being in admin group. Wifivelocityd will try to execute the following executable:

Proof of Concept #1

The exploitation now is pretty simple. Create /usr/local/bin/wl file with the following content:

#!/bin/sh

echo 1 > /tmp/LPE_WL

Then give it executable permissions:

chmod +x /usr/local/bin/wl

And press that 😈 5 keys Shift+Control+Option+Command+Period.

Proof of Concept #2

The WiFi velocity diagnoses can also be triggered differently by running WiFi Diagnostics app.

Proof of concept #3

Just wait. 😊 Wifivelocityd will periodically be launched by macOS to test your WiFi, so the /usr/local/bin/wl will be automatically executed.

Timeline

Kudos section

It seems that Gary Nield and Tim Michaud also found that vulnerability. Congratz 🤘🏻