DYLD_PRINT_TO_FILE Privilege Escalation in Apple OS X 10.10.x (dyld)

This repository contains a single Metasploit module: 'Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation'. The exploit targets a local privilege escalation vulnerability (CVE-2015-3760) in Apple OS X versions 10.10.0 through 10.10.4. The vulnerability allows a local attacker to write arbitrary files as root by abusing the DYLD_PRINT_TO_FILE environment variable with SUID-root binaries. The module uploads a payload binary to a writable directory (default '/.Trashes'), then uses a crafted environment variable to write a line to '/etc/sudoers', granting the attacker passwordless sudo access. The exploit then executes the payload as root, typically resulting in a root shell. The code is written in Ruby and is structured as a standard Metasploit local exploit module, with functions for checking vulnerability, uploading the payload, and executing the exploit. The main fingerprintable endpoints are the '/etc/sudoers' file (target for privilege escalation), '/.Trashes' (payload drop location), and '/bin/sh' (used for command execution).