macOS High Sierra: Anyone can login as “root” with empty password

Re:macOS High Sierra: Anyone can login as “root” with empty ... by princekolt on Tuesday November 28, 2017 @06:52PM (#15803195)

Bad news: I tried the exploit in my macOS Sierra installation and it didn't seem to work. However, the passwd entry on the output of your first command IS A LONE ASTERISK.

However I still can't login as root. This leads me to believe this behavior has always been there, and maybe the login methods just didn't allow an empty password.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by ybloviator on Tuesday November 28, 2017 @07:11PM (#15803308)

This is very normal in 'nix' systems. '' indicates a locked account. (I've given up figuring out how to escape an asterisk)

ex:

  daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin
  operator:*:2:5::0:0:System &:/:/usr/sbin/nologin
  bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin
  tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin

If the OS is letting you in with a '*'in the encrypted password field, something is very very wrong.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by warent on Wednesday November 29, 2017 @12:43AM (#15804863)

I'm confused, why do you have to escape an asterisk?

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by HarfTarf on Wednesday November 29, 2017 @12:52AM (#15804905)

He's stuck inside

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by vsl on Wednesday November 29, 2017 @02:08AM (#15805179)

Markdown in HN comments.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by royprins on Wednesday November 29, 2017 @08:08AM (#15806447)

Famous last words of a Roman centurion.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by adrianratnapala on Wednesday November 29, 2017 @08:54PM (#15812793)

Nah, I've never seen them do worse than knock people out. Probably the next thing the centurion said was "Ow, what hit me!".

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by kr3wn on Wednesday November 29, 2017 @01:51AM (#15805118)

wildcard.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by dep_b on Wednesday November 29, 2017 @06:59AM (#15806164)

Only High Sierra is affected.

[ Parent | on HN ]