Exploitation Summary
EIP tracks 5 public exploits for CVE-2017-13872.
PoCs published by Metasploit, Lemiorhan, giovannidispoto, including Metasploit module auxiliary/scanner/vnc/ard_root_pw.
AI-analyzed exploit summary This Metasploit module exploits CVE-2017-13872, a privilege escalation vulnerability in macOS High Sierra 10.13.1, allowing any user to gain root access by leaving the password empty. It writes a payload to a temporary file, makes it executable, and executes it with root privileges using osascript.
Description
An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name.
Exploits (5)
This Metasploit module exploits CVE-2017-13872, a privilege escalation vulnerability in macOS High Sierra 10.13.1, allowing any user to gain root access by leaving the password empty. It writes a payload to a temporary file, makes it executable, and executes it with root privileges using osascript.
This is a writeup describing CVE-2017-13872, a critical authentication bypass vulnerability in macOS High Sierra. The issue allows any user to log in as 'root' with an empty password after repeated login attempts. The document includes mitigation steps, detection methods, and references to advisory sources.
This repository claims to patch CVE-2017-13872 but only contains a simple C program that unlocks the root account using 'sudo passwd -u root'. It does not address the actual vulnerability (a buffer overflow in the Broadcom Wi-Fi driver).
This Metasploit module exploits CVE-2017-13872 to enable and set the root account password on unpatched macOS High Sierra systems with Screen Sharing or Remote Management enabled. It uses VNC authentication to test and set the root password.
This Metasploit module exploits CVE-2017-13872, a privilege escalation vulnerability in macOS High Sierra 10.13.1, allowing any user to gain root access by logging in as 'root' with an empty password. It writes a payload to a temporary file, makes it executable, and executes it with root privileges using AppleScript.
References (10)
Scores
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H