[hаckеr]

Hi guys, today I am going to show you how spawn a root shell on OS X Mavericks 10.9.5, in which you can run any command with root privileges 🤗

What You Will Need:
Mac running OS X Mavericks 10.9.5
Access to Terminal

NOTE: If you do not have these you will not be able to get root

Step One
Download my script from here and save it to your Desktop as exploit.py (or whatever you want the filename to be).

NOTE: Must be saved as a python script!!
Step Two
Open Terminal and type cd Desktop. Then type

Code

python exploit.py

or whatever you named the file.

Step Three
Let my script execute, it may take up to a minute or two. Once completed you will get something like this. You now have a root shell in which you can execute root commands!
Spoiler (Click to View)


What Can I Do With This?
1.) Steal the passwords of any account on your computer!
Download my keychaindumper.sh script and run it! Download by clicking here
2.) Make any normal user account an admin account Click spoiler for code. Spoiler (Click to View)

Code

sudo dseditgroup -o edit -a UsernameToAdd -t user admin

3.) Anything you want 👍

Hope you enjoyed my tutorial! Post your thoughts!

[NyQuil]

cool will check it out in a bit, least its not another tutorial on how to exploit something without using metasploit.

[DrakkarLevi]

Does this work only on 10.9.5? I have 10.11.1 El Capitan ;(

[hаckеr]

It only works on 10.9.5 I think. I haven't tried it on anything else

[DrakkarLevi]

Dang. Well, I have a quick question either way.

Someone ssh'd into a server on this Mac, but I guess the password wasn't saved (when you ssh into servers, typing in the password is invisible). Would this exploit allow me to obtain this password?

[hаckеr]

Probably not, but if you were running 10.9.5 you could get admin privileges and install a keylogger.

[SWCR]

Someone try it on 10.11.1?

[hаckеr]

Got you guys something :D

https://github.com/kpwn/tpwn
Works for 10.11.5>

[SOSA_]

Dang. Well, I have a quick question either way.

Someone ssh'd into a server on this Mac, but I guess the password wasn't saved (when you ssh into servers, typing in the password is invisible). Would this exploit allow me to obtain this password?

Assuming that the keypairs are stored on that computer and the password is in the keychain, yes. But you need a separate keychain stealer

---

OP, did you write this yourself?

[hаckеr]

Write what exactly? haha there's like 4 different codes included :D

[SOSA_]

Write what exactly? haha there's like 4 different codes included :D

The main exploit script

[hаckеr]

Found part of a script then modified :D

---

Did it work for you? The script was pretty complicated, so I shortened it up and made it user friendly :D

[Tr0janVirus]

Will this work for el capitan?

[WiiSport]

Really nice OP! Will try this on my old iMac. Needed this for a long time a time ago. Still going to do the idea because of your thread. Thanks :)

Kind and regards,
- WiiSport

[★ Eugtique ★]

I'll need to try :o haha thanks ^^