Skip to content

Instantly share code, notes, and snippets.

@daguy666
Created November 29, 2017 15:11
Show Gist options
  • Select an option

  • Save daguy666/67b9eaca3ab6206f873da091b2a8ac02 to your computer and use it in GitHub Desktop.

Select an option

Save daguy666/67b9eaca3ab6206f873da091b2a8ac02 to your computer and use it in GitHub Desktop.

Lock fun

Assuming you have read this tweet from lemiorhan talking about how to get the root bypass.

After doing the above you are set with a root account with no password. If your remote access settings allow for "All Users" then root can access with no password.

If you enter a new a password on the account and disable it, you can bypass all of that by starting the entire workflow over. Click the lock and enter root and leave the password blank. It will overwrite what you originally had set.

If you read this post by Patrick Wardle it goes over the lower level details on why this happens, and how it stores the password.

As of now the best way to mitigate this problem is to set a really strong password for the root account and then keep the root account enabled. This way you can't overwrite the password.

@lacyrhoades
Copy link
Copy Markdown

So without activating or deactivating accounts i.e. Users & Groups panel still only shows normal user(s):

  1. Terminal as normal user
  2. sudo passwd
  3. Enter strong password

Now I cannot do the "click the lock" trick and I never had to activate root. Or did I somehow implicitly / accidentally activate root by doing these steps?

@daguy666
Copy link
Copy Markdown
Author

@lacyrhoades by doing that, you enable the root account (if it was disabled) and have a strong password. This should be fine.

With the password and enabled account, you can not click the lock and bypass auth.

@daguy666
Copy link
Copy Markdown
Author

Its out! https://support.apple.com/en-us/HT208315 try this update.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment