Michael Lynn pudquick

10.10.3: createmobileaccount

Today, @osxreverser on Twitter announced their analysis of Apple's OS X 10.10.3 fix for CVE-2015-113 privilege escalation (aka "rootpipe") and an adapted unofficial fix for OS X 10.9:

https://twitter.com/osxreverser/status/587639173919727616

Apple apparently added a new private entitlement named "com.apple.private.admin.writeconfig" and made it required for calling the XPC service "writeconfig".

Shortly after 10.10.3 was released, it was discovered that the tool "createmobileaccount" (which can be used to pre-create a mobile account and home path prior to a user with network credentials logging into a machine) was no longer functioning properly.

	# Example usage of the function:
	# decompress('somefile.pack.lzma', 'somefile.pack')
	# Decompresses a lzma compressed file from the first input file path to the second output file path

	import sys

	from ctypes import CDLL, Structure, c_void_p, c_size_t, c_uint, c_uint32, c_uint64, create_string_buffer, addressof, sizeof, byref

	class lzma_stream(Structure):
	_fields_ = [

	import sys
	from ctypes import CDLL
	JavaLaunching = CDLL('/System/Library/PrivateFrameworks/JavaLaunching.framework/JavaLaunching')

	if (JavaLaunching.JLIsRuntimeInstalled() == 0):
	print "Apple JRE is not installed."
	sys.exit(1)
	else:
	print "Apple JRE is installed."
	sys.exit(0)

	# Python routines for parsing bom files
	#
	# Examples so far:
	#
	# dump_bom(filename) - prints diagnostic structure information about bom file (including path list)

	from ctypes import BigEndianStructure, c_char, c_uint8, c_uint16, c_uint32, sizeof, memmove, addressof

	class BOMHeader(BigEndianStructure):
	_pack_ = 1

	import tempfile, os.path, shutil, glob, os, subprocess, re

	debug = True

	# It should take the logs from tmp and clone them somewhere
	# It can then bunzip and combine them
	def log(s):
	global debug
	if debug:
	print s

	cmd = [pkgbuild,
	"--root", root,
	"--identifier", pkg_identifier,
	"--version", version,
	"--scripts", script_root,
	pkg_output_path]

	if opts.sign:
	# Use slice assignment to insert an additional option before the final argument
	cmd[-1:] = ["--sign", opts.sign, pkg_output_path]

	def default_interface():
	# 203.0.113.1 is reserved in TEST-NET-3 per RFC5737
	# Should never be local, essentially equal to "internet"
	# This should get the 'default' interface
	s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
	try:
	# Uses UDP for instant 'connect' and port 9 for discard
	# protocol: http://en.wikipedia.org/wiki/Discard_Protocol
	s.connect(('203.0.113.1', 9))
	client = s.getsockname()[0]

	# Based on: https://developer.apple.com/library/mac/documentation/Cocoa/Conceptual/URLLoadingSystem/Tasks/UsingNSURLConnection.html#//apple_ref/doc/uid/20001836-SW5

	from gurl import *
	from Foundation import NSData, NSString

	class Purl(Gurl):
	'''A POST variant of Gurl'''
	def initWithOptions_(self, options):
	'''Set up our Purl object'''
	# Inherit our basic setup from Gurl

	#!/usr/bin/python

	# As written, this requires the following:
	# - OS X 10.6+ (may not work in 10.10, haven't tested)
	# - python 2.6 or 2.7 (for collections.namedtuple usage, should be fine as default python in 10.6 is 2.6)
	# - pyObjC (as such, recommended to be used with native OS X python install)

	# Only tested and confirmed to work against 10.9.5
	# Run with root