Exploitation Summary
EIP tracks 2 public exploits for CVE-2007-0117. PoCs published by MoAB.
AI-analyzed exploit summary This exploit leverages a vulnerability in macOS's BOM (Bill of Materials) file handling to overwrite the `/bin/ps` binary with a setuid shell, achieving local privilege escalation. It manipulates the `Archive.bom` file and uses `diskutil repairPermissions` to set malicious permissions.
Description
DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows attackers to gain privileges via a BOM file under /Library/Receipts/, which triggers arbitrary file permission changes upon execution of a diskutil permission repair operation.
Exploits (2)
This exploit leverages a vulnerability in macOS's BOM (Bill of Materials) file handling to overwrite the `/bin/ps` binary with a setuid shell, achieving local privilege escalation. It manipulates the `Archive.bom` file and uses `diskutil repairPermissions` to set malicious permissions.
This exploit leverages a vulnerability in macOS's permission repair mechanism (CVE-2007-0117) to execute arbitrary commands as root via crontab manipulation. It creates a malicious .bom file and uses cron jobs to escalate privileges and execute a reverse shell.