macOS Privilege Escalation
Learn & practice AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
TCC Privilege Escalation
If you came here looking for TCC privilege escalation go to:
macOS TCCLinux Privesc
Please note that most of the tricks about privilege escalation affecting Linux/Unix will affect also MacOS machines. So see:
Linux Privilege EscalationUser Interaction
Sudo Hijacking
You can find the original Sudo Hijacking technique inside the Linux Privilege Escalation post.
However, macOS maintains the user's PATH when he executes sudo. Which means that another way to achieve this attack would be to hijack other binaries that the victim sill execute when running sudo:
Note that a user that uses the terminal will highly probable have Homebrew installed. So it's possible to hijack binaries in /opt/homebrew/bin.
Dock Impersonation
Using some social engineering you could impersonate for example Google Chrome inside the dock and actually execute your own script:
Some suggestions:
Check in the Dock if there is a Chrome, and in that case remove that entry and add the fake Chrome entry in the same position in the Dock array.
Some suggestions:
You cannot remove Finder from the Dock, so if you are going to add it to the Dock, you could put the fake Finder just next to the real one. For this you need to add the fake Finder entry at the beginning of the Dock array.
Another option is to not place it in the Dock and just open it, "Finder asking to control Finder" is not that weird.
Another options to escalate to root without asking the password with a horrible box, is make Finder really ask for the password to perform a privileged action:
Ask Finder to copy to
/etc/pam.da newsudofile (The prompt asking for the password will indicate that "Finder wants to copy sudo")Ask Finder to copy a new Authorization Plugin (You could control the file name so the prompt asking for the password will indicate that "Finder wants to copy Finder.bundle")
TCC - Root Privilege Escalation
CVE-2020-9771 - mount_apfs TCC bypass and privilege escalation
Any user (even unprivileged ones) can create and mount a time machine snapshot an access ALL the files of that snapshot.
The only privileged needed is for the application used (like Terminal) to have Full Disk Access (FDA) access (kTCCServiceSystemPolicyAllfiles) which need to be granted by an admin.
A more detailed explanation can be found in the original report.
Sensitive Information
This can be useful to escalate privileges:
macOS Sensitive Locations & Interesting DaemonsLearn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Last updated