Name: LaunchAsRoot
Rating: 3.7 (2 reviews)

This looks to be the perfect application black hat's would search for to help install their malware without prompting a user for credentials. FAIL for SECURITY

Version 1.0

6 answer(s)

Borlox

19 May 2011

It does prompt for credentials.

Like (2)

Scottyo

19 May 2011

Sounds like it basically implements sudo open -a appname which is already easily done no matter the color of your hat, and wouldn't appear to add any vulnerabilities, since the secret sauce is still your admin credentials. I think 1 star is a rather harsh rating. I haven't had occasion to use it it, so can't rate it yet myself.

Like (2)

sjk

21 May 2011

Run "sudo open -a TextEdit" and the saved file will be owned by the current user. Open TextEdit with LaunchAsRoot and the saved file will be owned by root.

Scottyo

21 May 2011

< > Yes, but you can chown to any account anyway once you own the file, so it still doesn't basically increase the risk level, though inadvertent chowning to root could *possibly* open a hole if other permissions are bad, but I don't see an exploit.

sjk

22 May 2011

. > "… you can chown to any account anyway once you own the file …" Huh? > so it still doesn't basically increase the risk level, though inadvertent chowning to root could *possibly* open a hole if other permissions are bad, but I don't see an exploit. I don't understand your reasoning, though maybe we agree that LaunchAsRoot isn't opening exploits to anything that's not already possible in other ways? If anything, Oldr4ver might want to validate his claim that LaunchAsRoot doesn't prompt for credentials. It did for at least Borlox, and me.

Scottyo

23 May 2011

>> "… you can chown to any account anyway once you own the file …" >Huh? Sorry, using chown, you can assign ownership of any file you own to anyone else in the system (but I either have a mis-memory or something has changed. Back in the 80s, on HP-UX at least, chown could be executed by anyone but only worked on files you owned, whereas now it's only available to root [and via sudo of course]). I was addressing the following: >Run "sudo open -a TextEdit" and the saved file will be owned by the current user. Open TextEdit with LaunchAsRoot and the saved file will be owned by root. So after running the sudo command above you could sudo chown root theFile thereby achieving the same end as the LaunchAsRoot version. So LaunchAsRoot has only made it convenient, but hasn't added to the cracker's arsenal. Of course, if you can sudo, you're already in like Flynn anyway. And if you don't know the ownership difference between the two invocations when saving a file, you could be surprised (unpleasantly if execute is set) by root owning it in the LaunchAsRoot case. BTW I haven't verified that difference. >I don't understand your reasoning, though maybe we agree that LaunchAsRoot isn't opening exploits to anything that's not already possible in other ways? >If anything, Oldr4ver might want to validate his claim that LaunchAsRoot doesn't prompt for credentials. It did for at least Borlox, and me. If it indeed always prompts foe sudoer credentials (not sure how it could work otherwise), then we're agreed: LaunchAsRoot is not adding capabilities/exploits, just making it more convenient to do something that was already doable. Sorry, much of the confusion was probably caused by my mistaken assumption that chown could (still) be used by any user rather than just by root and sudoers.

LaunchAsRoot

Overview

LaunchAsRoot Screenshots

4 LaunchAsRoot Reviews