All right, folks, thank you for attending.
This is Getting a Migraine.
I'm Jonathan, or JBO for short.
This is Mike or Michael, however you want to call him.
And Anurag was unable to come to DEF CON, but still he took an extremely important part
in this research.
We're all Microsoft researchers, which is kind of weird, because, like, Microsoft usually
do Windows stuff and not Apple stuff, however, we work for Microsoft Defender, and the reason
why it's called Microsoft Defender and not Windows Defender is because it runs on platforms
that are not Windows, and we do Mac, Android, iOS, Linux, those kind of stuff.
So this is kind of like a motivation that we have.
This is not a Defender talk, but, I mean, just shows you that, like, where we're coming
from.
The outline for today is talking about some of the macOS mechanisms, specifically SIP and
entitlements.
We're going to talk about how we found a vulnerability by mistake, kind of, how we automated our
exploit by means of reverse engineering.
We'll have a demo.
We'll talk about the implications of what we've done.
We'll talk about Apple's fix and basically fix this, I would say, and then we'll have
some conclusions.
So let's get to it.
Some background.
SIP or rootless is a mechanism in macOS.
If you're just unfamiliar with macOS completely, it's a mechanism that limits the capabilities
of this super user of root.
If you're coming from a traditional POSIX world, root can do anything, and that's not
true anymore.
In macOS, even if you're running as root, you can't do a bunch of stuff, including in
user land.
So if you're running as root, you can't do a bunch of stuff, including in user land, which
is kind of foreign to a lot of folks.
What it does is to leverage something called the Apple Sandbox in order to protect the
entire platform.
By default, you can't turn it off without going into recovery OS.
I won't talk about recovery OS too much today, but generally what it means is that you have
to click to hit a bunch of keys and then reboot.
You have to have a physical machine, you have to solve the Hellraiser puzzle and stuff like
that.
You're not supposed to turn it off at all, and several organizations, including Microsoft,
like in our own internal network, actually monitor and make sure that SIP is always on
as a defense in-depth mechanism.
We'd like to think of it just mentally, that's not accurate at all from a technical perspective,
that it's kind of like SELinux on Linux or protected.
It's kind of like SELinux on Linux or protected processes on Windows, in the fact that you
know you're admin, but you don't own the machine anymore to some extent.
SIP limits certain actions of the root user and all users, really, to, as the name suggests,
to protect the integrity of the system.
That means there are certain files you can't override, there are kernel operations you
can't do and so on, and we'll be talking about that more thoroughly in the next few
slides.
SIP itself, internally, is controlled by NVRAM variables.
There's actually more than one, but we're going to talk about CSR active config on Intel
platform, and in the Apple silicon that runs on ARM, they have a thing called LPSIP0 that
is read from the booted device tree, and interestingly enough, because Mac OS, like XNU specifically,
the kernel is kind of like half-coded.
Half open source, or like 90% open source.
You can find all the flags in the source code under CSR.h, and I name here just a few.
It's not a complete list at all, but you can, again, kind of imagine what SIP does.
So for instance, it won't let you load unrestricted, you know, just any kernel extensions, which
are really drivers.
You can't write to certain file system locations, which we'll be talking about today.
You can't get task ports for a given PID.
A task port is basically like open process in Windows or P-trace in Linux.
You can't really debug processes for what it's worth.
You can't do kernel debugging, you can't do D-trace, you can't write NVRAM variables
for obvious reasons.
If you could, you can just change like SIP altogether, and there are other flags here
as well.
But the issue that I want to talk about is the fact that it has a certain domino effect.
What I mean by that is that if you have, let's say, an NVRAM variable override, a way
to bypass the NVRAM variable write protection by SIP, you can bypass SIP.
Obviously, you can just overwrite like the bit flag in CSR active config.
And similarly, if you can load an untrusted kernel extension, you can just write a rootkit,
but also bypass SIP.
And in fact, any part of SIP you can bypass.
Bypass actually like topples the entire domino of SIP.
So that's important to note.
Generally, if you were able to bypass one mitigation, you were able to bypass all of
them in theory and also not in theory.
A bit about SIP and file system restrictions.
If you're a developer or malware author or whatever it is, that's probably the first
thing that you'd notice when you come across SIP is the fact that you can't really write
to certain paths.
Because SIP actually prevents you from doing that, again, even if you're running as root.
So SIP really prevents you from modifying any files that either have a specific extend
and attribute called com.apple.rootless or are configured in some file system library
sandbox config, rootless.conf.
And that's like a naughty list, I guess, for files that basically a set of files that can't
be overwritten.
But there are also allow lists for these restrictions that override like the rootless.conf.
And they're out of scope for this talk.
But they're well-documented.
Obviously, the rootless.conf file is SIP protected by itself.
Otherwise, again, you'd be able to change it and then do a bunch of stuff.
And also, you can't really add or delete the com.apple.rootless extended attribute
for the same reason, right?
If you could add that extended attribute, you can create, like, you know, you can create
like an undeletable malware, for instance.
If you could remove that, you could bypass SIP because you could modify files that are
protected by SIP.
So just keep that in mind.
And generally, like, Apple has released a modification to the ls command.
If you do ls-lo, that's a capital O, an actual O, not a zero, then all the files that say
restricted are basically files.
Or directories or symlinks or whatever they are that basically can't be modified.
So that's an example of a restricted file, for instance.
So how, I mean, that's obvious, right?
I mean, we have SIP.
We basically have a different kind of layer in the system, if you will.
And how does the thing work?
And how do we enforce things in macOS?
Yeah.
I mean, there's some background about entitlements, really.
In the macOS ecosystem, processes are signed, right?
And they're granted something called entitlements, which are basically capabilities.
So because entitlements are part of the signature of the process, you can't forge them easily,
at least, unless you have, like, a gazillion PS4s and you connect them and, I don't know,
find a collision or something.
And you can think of entitlements of a way to make a process stronger, right, again,
in terms of capability.
And the interesting part is that Apple has private entitlements that they will only grant
to their own processes.
And because they sign everything, they won't sign your processes with those entitlements.
These are known as private entitlements, and that essentially creates, like, a barrier
or a capability-based security layer, if you will, because if you're able to only
run, to only get certain capabilities or entitlements but not the other capabilities.
type of entitlements and apple are the only ones who can have that entitlements and the entitlements
are being um translated into capabilities by the os it basically means that apple has the keys to
the kingdom they control your box you don't control your box uh as much anymore because you
can't get those capabilities you can't get those entitlements and uh that's something very
interesting especially for us again microsoft defender because we don't have those capabilities
either right um and you can think about the implications uh which we will be talking about
later for instance uh you know because because we can't um we can't let's say uh modify the com
apple uh rootless extender attribute if there is a file that is naughty and have that extender
attributes we're kind of like we're kind of screwed because we can't really uh delete that
file that's just an example um and uh there are two very interesting
entitlements for sip file system restrictions there are actually more like sip is very rich
as you could see but there are these there are the two very interesting entitlements that i want to
talk about today which are com apple rootless install and that basically bypasses all the
sip file file system checks so if you have a process that has that entitlement which is a
private entitlement it can basically bypass all sip file system checks which is really powerful
and then you have something even greater which is called com apple rootless
install heritable which inherits to all child processes the com apple rootless install which
means that all of the child processes are going to be able to bypass sip file system enforcements
on their own now if you think about the motivation why why do these things even exist right like why
why punching a hole through that security layer then you have to think about the name com apple
rootless install these things are used for installations and updates for instance when apple
wants to do an os
update they basically have to um they have to write to certain files then those files might
be protected and that's the way they do it they have let's say update an updater that updater has
that uh those capabilities and then it's able to do whatever uh overwrite arbitrary files and so on
so that's that's the motivation that apple has to even having those entitlements if that makes sense
um so this is just this was all just background
now um while performing routine malware hunting we started noticing a process named drop sip
and the name itself like is is suggestive as you can think uh and that seems to be prevalent on
many devices and we were like oh cool we found some malware and probably some zero day in the
wild we were very excited and a closer inspection revealed it's an apple sign binary that runs under
the system migration private framework directory and actually drops capabilities that bypass
uh sip file system checks uh with an api called csops that's a private api that i will be
discussing the next slide and mentally we think that it should have been called drop drop zip
but i mean i mean that's what it is and it's not malware that's the entire reversing
that's the entire file actually so reversing it is not even like a thing
as you can see here basically what it does that's the main function for all means and purposes
uh what it does
is really call uh csops with 12. uh 12 is csops clear installer which uh i i took the uh i took
the liberty of of pasting like the screenshot from the exonu source code which basically uh
removes as you can see like this is a not uh the tilde uh is a not flag basic binary not flag that
removes the cs installer and other stuff as well cs installer is the com apple rootless install and
cs
exec inherit sip is the uh rootless install heritable entitlement by the way um so basically
what it does is to remove the uh installation capabilities or c bypassing capabilities of a
process and if it's successful in doing so it will basically run exec ve on the uh on the
like command line and arguments that it got uh and that's basically a
some mean uh that uh that they have to run a file without having those uh seed bypassing capabilities
so that's just a motivation and we were kind of like uh we were kind of convinced that uh drop
sip is legitimate it's not malware it's it's owned by apple and basically what it does is to drop
those seat bypassing capabilities so this is kind of where our journey begin
um we noticed that uh the drop sip uh process is a child process of system migration d
which is a daemon that's why it has a d in the end of its name
And it has the com.apple.ruthless install heritable entitlement, which, if you remember from three slides ago, basically inherits C-bypassing capabilities to all its child processes.
And that explains why DropSIP assumed that it has C-bypassing capabilities to begin with.
I hope that makes sense.
And after concluding that DropSIP is legitimate, we basically decided to take a closer look at what other child processes system migration D has, right?
Because it's a very powerful process, it's able to give all its child processes C-bypassing capabilities, just for fun.
It depends on your definition of fun.
And then this is a screenshot just showing the entitlements of this system migration D process.
You can use code sign.
That's the binary that Apple gives you to basically look at the signature, and that includes the entitlements.
And as you can see, the set of entitlements.
There are three entitlements that start with com.apple.ruthless, and the second one is com.apple.ruthless install heritable.
I won't talk about the other two, but they're really interesting if you're into that kind of stuff.
Now, this is, again, not a talk about Microsoft and EDR and everything, but any EDR that it's worth its salt, you can basically ask questions like, hey, in my organization, give me all the processes that have so and so, right?
All the processes that have command line blah and so on.
So what we started doing is that, okay, we're Microsoft, we have an EDR, we have tons of data, even from macOS, and then we were like, okay, let's start hunting with EDR data, and that's really good because you have a lot of different environments, a lot of different customers and whatnot, and also internally in Microsoft, we do have folks that run macOS as well, and they also report all the command lines and whatnot internally, right?
So we were like, okay, give us.
Dear EDR, please give us all the child processes of system migration D.
And we immediately noticed two interesting child processes, which are bash and Perl, right?
These are just command lines.
Again, these are child processes of system migration D, so they're very powerful in terms of C bypassing capabilities.
Why are those child processes interesting?
Well, bash and Perl are interesting because they're interpreters.
And interpreters are affected by many things.
Especially environment variable poisonings.
Now, in macOS, I won't talk too much about the security mechanisms in macOS, but injection in macOS is a real drag.
It's not like Windows or Linux when you can just run open process or ptrace.
And especially bash and Perl are still baked into macOS, and therefore Apple signed and actually are protected by SIP.
So you can't get a task port to those processes, and you can't inject into them.
And that's why we needed like a different method of injecting to those processes.
And because they're interpreters, they're more convenient than others.
Now, remember, these are processes that are child processes of system migration D.
So the OS does not enforce SIP file system policy checks on them, which is really helpful.
And then I want to talk about environment variables.
So we found two noteworthy environment variables.
These are just man pages.
Of bash and Perl.
For bash, you have environment variable bash underscore env.
And apparently, if you have that environment variable, you can just like write arbitrary commands there.
And like bash will just run them, which is good and bad.
For Perl, it's not really complicated, but you have Perl 5 opt for options.
And you can also make Perl 5 opt by modifying it.
You can make it run arbitrary Perl commands, which is really good.
And it can be great and bad at the same time.
Now, this is like I'm doing a sidetrack here.
This is a general rant about environment variables.
Shellshock happened in 2014, if you guys remember how bad it was.
Basically, it was like a vulnerability in bash that was related to the parsing of environment variables and how they're eventually executing.
But it's like we haven't learned a lot about the dangers of environment variables.
And it just took like the last couple of years, even this year, like in different platforms, really.
They're not all Mac OS.
Like if you look at it, like the first one from 2023 is in Linux, right?
In a pseudo binary, in a suite binary, no less, which took years to really make secure and apparently not enough.
And you have other cases here as well, including Linux.
Including Mac OS.
And other things as well.
And that doesn't even start like scratching the surface.
Because you have other issues that do not normally get CVEs.
Like UAC bypasses on Windows and you can override like the WinDir directory.
Or cloud credentials that are in environment variables and API keys like literally everywhere.
So environment variables are very dangerous.
And should be, you know, should be taken care of.
And this is where I turn over to Mike to talk about our exploitation strategy.
That man with the flask is a god damn hero.
This is a fantastic tradition.
I just wanted to say that.
So thank you for that.
Yeah, so like JB was talking about, the environment variables were the main thing that we went after.
Environment variable poisoning.
So we went about trying to validate this as a vulnerability that can be exploited.
And we loaded by setting Bash EMV and Perl 5 opt.
And from there we put the payload in the appropriate folder.
And it was just simply a matter of getting system migration D to run one of these two interpreters.
Which is a lot easier said than done.
It felt like every single combination I tried didn't result in Bash or Perl being run at the end.
Which was frustrating.
But eventually was able to find the right combination of just creating like a single dummy user.
And from there was able to get Perl to run.
And that was like 4 a.m.
I was talking to Neurug who's in India.
And he came up with Perl 5 opt exploit.
And yeah.
When I finally got to execute and validate that we got SIP bypass it was an amazing feeling.
And I was also like quite sleep deprived.
So yeah.
While we did prove that this is something that can be exploited.
It wasn't perfect because we required like a physical USB drive to be attached to the device.
Migration.
As you may or may not know will log off all users.
Requires manual clicking through all the windows.
And then of course it reboots at the end.
So that's not ideal for a remote attacker.
So this was a demo that we sent to Apple.
I'm going to spare you all.
I'm not going to make you watch a 15 minute migration demo of me.
Namering on about the migration process.
But I just want to show a snapshot here.
Where.
At the end we're writing over the Apple kex exclude file.
So if you don't know.
Apple kicked everyone out of the kernel.
But there were certain kernel modules that Apple still allowed to be loaded and executed.
And all that's kept in a SIP protected file called Apple kex exclude list.
So in the demo I overwrote that file with just the word migraine.
As like a proof of concept to show that we can control these SIP protected areas.
Okay.
So like I said.
The initial demo and everything was pretty ugly.
So the main challenges here were to obviously get rid of all log off.
Get rid of reboot.
We wanted to automate clicking.
So there's no user interaction needed.
And obviously we don't want to have a USB of physical access for this exploit to run.
So we began reversing and trying to figure out how we can make that happen.
So there's a top down approach and a bottom up.
Top down.
Was a very disgusting approach where we tried patching the system binaries themselves to get the behavior we want.
Obviously and naturally I took the disgusting approach.
Top down.
Bottom up was the more cleaner approach where we took the private framework that the migration daemon uses.
And we tried to bend it to our will.
And call the functionality we need within that private framework directly with our own binary.
Spoiler alert.
Neither of these approaches worked.
And we'll get into why that is.
Okay.
So migration like with most things in Mac is not a simple system.
It's complex.
And it's multiple different processes that communicate through XPC and IPC to make this happen.
We were trying to find some kind of documentation on migration and how it all works.
And of course Apple being Apple didn't offer us any of that documentation.
And we couldn't find anyone who's not doing this and reversing it.
So as far as we could find.
We're the first ones to do it.
So let's get into the high level of migration.
So these blue squares.
These are the key processes involved with migration.
You can kind of think of like migration as like a chain.
And each link in the chain calls into the next.
And the previous link validates that the previous caller has the appropriate private entitlement.
So an example being migration assistant will call into MBCIS administration.
But then MBCIS administration.
Before it goes any further.
Will validate that it has com.apple.private.MBCIS administration entitlement.
And system administration calls in a setup assistant.
And setup assistant calls into the daemon.
All of which validate the previous caller.
Okay.
So migration assistant.
This is the first link in the proverbial chain.
And this is what you all are used to using if you've ever done migration.
It's essentially the setup wizard for migration.
Where you can port PC or Mac devices.
You can do it over hardware.
You can do it over network.
All different options.
So with the top down approach.
I wanted to patch this out.
Because the most annoying thing we had to deal with was the logout issue.
So if you're interested.
The function that migration assistant uses is something called saclo start logout with options.
Patching that out unfortunately didn't work for multiple reasons.
And we'll show you why.
Oh yeah.
So this was a little funny thing that JBO noticed.
So when you go from PC.
To a MacBook.
Apple was kind enough to represent the PC as having a blue screen of death.
So well played Apple.
Good job.
Okay.
So the next link.
So migration assistant will then talk with MBCIS administration.
And like I mentioned.
It'll make sure the XPC caller has the appropriate entitlement.
The MBCIS administration entitlement.
I obviously tried calling MBCIS.
Administration directly.
Thinking oh we can get around the logout.
By just making our own binary.
And at the bottom here.
As you can see.
This is the console output of it.
Telling me to fuck off.
So.
You might be wondering.
How does migration work?
How is a user able to interact with a GUI.
Even though all the users are logged out.
And the answer to that is.
There's a hidden user called MV setup user.
MBCIS administration.
Will essentially.
Use this user for the entire process.
So you're not actually running as your user.
You're running as this hidden user.
There's no password.
So we tried logging into it.
And I thought we could get away with doing some fun trickery.
But.
Those darn entitlements got us again.
Okay.
So setup assistant.
So.
The MBCIS administration process.
Will eventually call into setup assistant.
Setup assistant is like a generic utility.
That can be used.
By a lot of different things.
In the system.
Some examples would be like.
System upgrade.
Or.
Accessibility wizard.
Or of course migration.
And a whole lot of other things.
And MBCIS administration essentially.
Will talk to setup assistant.
And it'll put it into the context of migration.
And eventually it'll transfer.
Migration assistant.
Into.
Setup assistant context.
So that's basically what's being called.
After a certain point.
Instead of migration assistant.
Of course.
When it does that.
It's validating.
That the entitlement.
Is improved.
Approved.
Before it continues to do that.
And then from there.
Setup assistant.
Will talk with the main.
Main honcho.
Which is.
Migration assistant.
Or.
Daemon.
The migration daemon.
And it does this with.
XPC.
And of course.
The system migration D.
Will validate.
That the caller has the.
Right entitlement.
In this case.
It would be.
Private.
System migration.
Daemon client.
By the way.
Setup assistant.
Is like.
Filled.
With entitlement.
So if you're looking.
For an interesting target.
I recommend going.
Setup assistant.
And if not.
Setup assistant.
In their folder.
There's other.
Like just.
Utility.
Binaries.
That are.
Ridiculously.
Entitled.
So.
Just some homework.
To do.
All right.
System migration D.
So this was the.
Bottom approach.
That.
Bottom up approach.
That.
Anurag took.
When starting.
To reverse.
A system.
Binary.
We recommend.
You look.
You start.
With the.
XPC.
Handlers.
For like.
Privilege.
Escalation.
Or.
Max.
Services.
You can.
Usually.
Find.
Those.
By.
Opening.
Up.
The.
Associated.
P.
List.
Shown.
Here.
And.
This.
Object.
The.
Migration.
Object.
That.
Uses.
Along.
With.
The.
Start.
Listener.
For.
Connections.
Function.
Which.
Is.
How.
It.
Handles.
Like.
A.
Callback.
For.
Valid.
XPC.
Requests.
Okay.
So.
When.
It.
Does.
Receive.
A.
Valid.
Migration.
Request.
System.
Migration.
D.
Will.
Create.
A.
File.
In.
The.
Location.
Library.
Slash.
System.
Migration.
Slash.
Q.
And.
In.
There.
Is.
All.
The.
Associated.
Do.
That.
Only.
System.
Migration.
D.
Can.
Modify.
Create.
Or.
Delete.
Files.
At.
That.
Location.
So.
Anyone.
Who.
Has.
Done.
Migration.
Can.
Tell.
You.
That.
There.
Is.
At.
Least.
One.
Reboot.
If.
Not.
Multiple.
Reboots.
And.
The.
Way.
The.
System.
Can.
Keep.
Track.
Of.
What.
The.
Current.
Migration.
Request.
Is.
Is.
It.
Takes.
The.
One.
Of.
Specified.
Files.
And.
It.
Renames.
It.
To.
In.
Dash.
Flight.
At.
The.
Same.
Location.
That's.
Sit.
Protected.
All.
Right.
So.
Why.
Do.
Our.
Approaches.
Fail.
Well.
Like.
I.
Mentioned.
Several.
Times.
The.
Entitlements.
Were.
The.
Big.
Thing.
So.
Any.
Time.
We.
Tried.
Talking.
Directly.
With.
MbSys.
Administration.
Or.
The.
Daemon.
Itself.
We.
Couldn.
Get.
Very.
Far.
Because.
They.
Validate.
That.
Caller.
Has.
The.
Appropriate.
Private.
Entitlement.
Also.
On.
Newer.
Apple.
Silicon.
Devices.
While.
This.
Isn't.
There.
Are.
Workarounds.
For.
This.
If.
You.
Try.
To.
Like.
Patch.
A.
System.
Binary.
The.
We.
Started.
Thinking.
Maybe.
There's.
A.
Way.
That.
We.
Can.
You.
Know.
Cut.
Out.
Migration.
Assistant.
And.
Just.
Talk.
With.
Setup.
Assistant.
Directly.
And.
We.
Had.
An.
In-House.
Tool.
That.
We.
Setup.
Assistant.
Directly.
To.
Create.
The.
Migration.
Behavior.
So.
We.
Can.
Prevent.
The.
Log.
Out.
And.
To.
Begin.
With.
So.
As.
We.
Looked.
Into.
The.
Reversing.
The.
Setup.
Assistant.
We.
Did.
Realize.
There.
Were.
Other.
Parameters.
Being.
Used.
And.
We'll.
Show.
That.
Right.
Here.
So.
This.
Is.
The.
Main.
Handler.
From.
Anybody.
Us.
So.
We.
Figured.
Okay.
There.
Might.
Be.
Something.
To.
This.
Passing.
Setup.
Assistant.
Parameter.
To.
Get.
This.
To.
Run.
Migration.
So.
While.
The.
Main.
Function.
Didn't.
Have.
What.
We.
Wanted.
We.
Looked.
Further.
And.
We.
Found.
A.
Function.
Called.
Use.
Debug.
Parameters.
And.
In.
There.
Is.
A.
Parameter.
It.
Handles.
Called.
Dash.
MB.
Debug.
And.
When.
We.
Use.
That.
We.
Were.
Super.
Excited.
To.
See.
That.
The.
Old.
Familiar.
Migration.
Windows.
Were.
Up.
In.
Yeah.
That.
Means.
No.
Log.
Out.
Needed.
If.
You.
Bypass.
Migration.
Assistant.
You.
Bypass.
Logging.
Out.
So.
Yeah.
While.
It.
Was.
Great.
To.
See.
Migration.
It.
Still.
Was.
A.
Bit.
Of.
A.
Problem.
With.
Automating.
Because.
There.
Were.
So.
Many.
Frivolous.
Windows.
And.
Extra.
Things.
That.
Made.
Difficult.
To.
Use.
Apple.
Script.
To.
Click.
Through.
So.
We.
Found.
That.
If.
You.
Use.
MB.
Debug.
In.
Conjunction.
With.
Resume.
Buddy.
Yes.
It.
Has.
A.
Lean.
Migration.
Process.
That.
We.
Were.
Able.
To.
Pretty.
Trivially.
Automate.
With.
Apple.
Script.
And.
For.
People.
Who.
Don't.
Know.
Apple.
Scripts.
Can.
Click.
Through.
Various.
Windows.
As.
One.
Gigabyte.
Time.
Machine.
Backup.
Like.
A.
Partition.
On.
The.
Hard.
Drive.
You.
Might.
Be.
Thinking.
One.
Gigabyte.
Doesn't.
Sound.
Small.
But.
Anyone.
Who's.
Done.
Time.
Machine.
Can.
Tell.
There.
It's.
The.
Same.
Steps.
We.
Talked.
About.
Where.
We're.
Poisoning.
The.
Environment.
Variable.
Setting.
The.
Payload.
And.
We.
Just.
Run.
Apple.
Script.
An.
Apple.
Script.
Will.
Then.
Run.
Setup.
Assistant.
With.
The.
Appropriate.
Parameters.
All.
Right.
So.
This.
Is.
The.
A.
Demo.
We.
Want.
To.
Show.
You.
Guys.
So.
This.
Is.
All.
Real.
Time.
I.
Just.
Showed.
Like.
The.
First.
Five.
Lines.
Of.
The.
Apple.
Text.
Exclude.
File.
And.
We're.
Going.
To.
Run.
It.
And.
Then.
At.
The.
End.
You'll.
See.
That.
The.
Apple.
Text.
Exclude.
P.
List.
File.
Which.
Is.
Protected.
Will.
Be.
Overwritten.
With.
The.
Word.
Migraine.
All.
Right.
So.
I'm.
Just.
Showing.
This.
Is.
Restricted.
Which.
Means.
Is.
Protected.
And.
We're.
Calling.
Osa.
Script.
Which.
Is.
Apple.
Scripts.
And.
From.
Here.
It's.
Calling.
Setup.
Assistant.
This.
Is.
The.
Machine.
Backup.
We.
Talked.
About.
The.
One.
Gigabyte.
Time.
Machine.
Backup.
And.
Yeah.
It's.
It's.
Going.
To.
Find.
The.
Right.
Window.
And.
Click.
Through.
Everything.
Automatically.
Kind.
Hard.
To.
Tell.
But.
It.
Basically.
Deselected.
Everything.
Except.
For.
The.
Dummy.
User.
I.
Created.
And.
From.
Here.
My.
Exploits.
Gonna.
Run.
And.
Then.
We.
Kill.
The.
Migration.
Daemon.
Before.
It.
Can.
Reboot.
And.
As.
You.
See.
Migraine.
Is.
Now.
Overwritten.
The.
Capital.
Apple.
Text.
Exclude.
And.
It.
Is.
Protected.
All.
Right.
So.
You.
Might.
Be.
Asking.
Well.
Who.
Cares.
Well.
Sip.
Is.
Like.
Most.
Security.
Mitigations.
It's.
A.
Double.
Edge.
It's.
Also.
Great.
For.
Preventing.
Current.
Access.
Or.
Root.
Kits.
But.
The.
Problem.
Is.
Once.
An.
Attacker.
Gets.
Past.
That.
Layer.
They.
Can.
Do.
Things.
That.
Are.
Extremely.
Difficult.
In.
Execution.
Like.
I.
Talked.
About.
Which.
Which.
Is.
Essentially.
Is.
Going.
To.
Be.
Root.
Kit.
In.
This.
Scenario.
And.
It.
Can.
Even.
Bypass.
Other.
Security.
Layers.
In.
Mac.
OS.
An.
Example.
Being.
Like.
TCC.
So.
That.
Means.
An.
Attacker.
Could.
Listen.
On.
Your.
Microphone.
Or.
Watch.
Your.
Camera.
And.
You.
Aren't.
Notified.
You.
Have.
No.
Idea.
All.
Right.
So.
I'm.
Gonna.
This.
Back.
Over.
To.
B.
O.
To.
Talk.
About.
Their.
Fix.
And.
Our.
Attempts.
To.
Forward.
It.
All.
Right.
Thanks.
Mike.
So.
We.
Disclosed.
That.
Bug.
To.
Apple.
Back.
In.
May.
2023.
And.
You.
Know.
There.
Was.
A.
Bit.
Of.
Like.
Back.
And.
Forth.
Because.
It's.
Not.
A.
Very.
Trivial.
Exploit.
But.
Eventually.
They.
They.
Kind.
Of.
Were.
Able.
To.
Reproduce.
It.
And.
They.
Fixed.
It.
In.
Their.
Beta.
And.
We.
Were.
Asked.
To.
Assess.
Their.
Fixed.
Their.
Beta.
Version.
So.
We.
Like.
Okay.
Let's.
Like.
Run.
The.
Beta.
Version.
And.
See.
What's.
Up.
And.
The.
First.
Thing.
That.
We.
Noticed.
Was.
Something.
That.
I.
Like.
To.
Call.
And.
Which.
Is.
The.
Proper.
Way.
Of.
Setting.
An.
Environment.
Variable.
In.
Lunch.
D.
And.
Basically.
Telling.
Me.
Like.
We.
Couldn't.
Set.
The.
Environment.
Variable.
Yeah.
Because.
And.
It's.
Not.
Permitted.
Because.
Of.
Sip.
So.
Now.
You.
Know.
With.
All.
The.
Things.
That.
Sip.
Enforces.
It.
Also.
Now.
Enforces.
The.
Fact.
That.
We.
Can't.
Really.
Touch.
Environment.
Variables.
Which.
Kind.
Of.
Like.
Socks.
And.
Rocks.
At.
Same.
Time.
Note.
That.
This.
Kind.
Of.
Enforcement.
Happens.
At.
Lunch.
D.
It.
Doesn't.
Happen.
It's.
At.
Lunch.
Ctl.
For.
Obvious.
Reasons.
Otherwise.
Anyone.
Would.
Be.
Able.
To.
Bypass.
It.
So.
That's.
Fixed.
Number.
One.
And.
Then.
We.
Were.
Like.
Okay.
We.
Don't.
Really.
Need.
To.
Affect.
All.
Of.
The.
Environment.
Variables.
In.
The.
System.
We.
Just.
Need.
To.
Affect.
A.
System.
Migration.
D.
Which.
Is.
Like.
One.
Process.
In.
The.
In.
The.
System.
Yes.
It.
Is.
A.
Demons.
So.
It's.
A.
It's.
A.
Process.
Of.
Launch.
D.
That's.
Why.
Setting.
The.
Environment.
Variables.
To.
Launch.
D.
Works.
To.
Begin.
With.
But.
Then.
Can.
We.
Do.
Something.
Else.
And.
Launch.
Demons.
In.
Mac.
O.
S.
Are.
Described.
As.
You.
Could.
See.
Earlier.
By.
A.
P.
List.
File.
That's.
The.
Thing.
That.
Mike.
Showed.
With.
All.
The.
Demons.
And.
You.
We.
Don't.
Have.
To.
Put.
It.
In.
A.
C.
Protected.
Directory.
And.
Basically.
Run.
The.
Thing.
And.
It.
Supports.
And.
Variables.
So.
That's.
Good.
And.
I.
To.
Too.
Much.
About.
It.
But.
Basically.
There.
Is.
A.
Technology.
Called.
Launch.
Constraints.
Which.
Makes.
Sure.
That.
Things.
Run.
Things.
That.
Are.
Supposed.
To.
Run.
By.
Apple.
Or.
Only.
Run.
By.
Apple.
In.
This.
Case.
Why.
It.
Enforces.
Is.
That.
The.
Mac.
Services.
That.
You.
Guys.
Saw.
Those.
Six.
Mac.
Services.
Are.
Actually.
Owned.
By.
By.
A.
File.
That.
Was.
Launched.
From.
The.
SIP.
Bypass.
The.
SIP.
Protected.
Directory.
So.
Launch.
Constraints.
Make.
Sure.
That.
We.
Can't.
Hijack.
Any.
System.
Launch.
Demons.
Definitions.
Original.
System.
Aggression.
D.
The.
Only.
Difference.
Is.
That.
I.
Had.
To.
Name.
It.
A.
Bit.
Different.
So.
Now.
It's.
Named.
Com.
Dot.
J.
B.
O.
Dot.
Apple.
And.
Doesn't.
Really.
Shouldn't.
Really.
Affect.
Anything.
And.
The.
Other.
Part.
Is.
Is.
This.
Part.
Where.
I.
Basically.
Try.
To.
Set.
The.
Invite.
Variables.
Specifically.
Part.
Of.
Five.
Opt.
Now.
Again.
This.
Works.
But.
Doesn't.
Work.
Really.
Because.
The.
Really.
The.
System.
Aggression.
D.
Basically.
Gets.
Killed.
By.
The.
O.
S.
Because.
Of.
That.
Thing.
So.
No.
No.
Dice.
And.
Then.
The.
Third.
Fix.
Which.
Or.
The.
Third.
Attempt.
That.
We.
Had.
Really.
Is.
That.
We.
Were.
Like.
Okay.
Can.
We.
Do.
Something.
That.
Doesn't.
Have.
Invite.
Variables.
Because.
We.
Noticed.
Again.
Those.
Are.
Perl.
Scripts.
And.
Perl.
Scripts.
Sometimes.
Have.
Dependencies.
Can.
We.
Find.
A.
Strong.
Dependency.
In.
The.
Perl.
Scripts.
And.
As.
You.
Can.
See.
In.
The.
Part.
Whoops.
As.
You.
Can.
See.
In.
The.
Right.
Part.
You.
Have.
Used.
Strict.
And.
Then.
Use.
File.
Base.
Name.
Those.
Are.
Basically.
Imports.
Just.
Like.
Imports.
In.
I.
Don't.
Know.
In.
Python.
Or.
Whatever.
And.
The.
File.
Base.
Name.
File.
Is.
Really.
Translated.
To.
A.
Directory.
In.
The.
File.
System.
And.
Base.
Name.
Is.
Going.
To.
Be.
Looked.
After.
Base.
Name.
Dot.
P.
M.
Specifically.
Which.
Is.
The.
Pearl.
Module.
And.
Pearl.
Has.
Dependencies.
And.
The.
Lookup.
Order.
And.
The.
Lookup.
Order.
You.
Can.
Print.
It.
With.
The.
At.
I.
N.
C.
Pearl.
Variable.
As.
You.
Can.
See.
Here.
And.
These.
Are.
This.
Is.
The.
Search.
Order.
The.
Interesting.
Part.
Is.
That.
The.
Slash.
Library.
Pearl.
Five.
Point.
Thirty.
File.
Base.
Name.
Dot.
P.
M.
With.
Arbitrary.
Content.
And.
You.
Know.
Trigger.
Pearl.
Without.
Poisoning.
Any.
Variables.
And.
Have.
It.
Basically.
Run.
Our.
Arbitrary.
Commands.
Which.
Works.
And.
Doesn't.
Work.
It.
Works.
But.
We.
Were.
Able.
To.
Infect.
Pearl.
But.
Not.
For.
C.
Bypassing.
Purposes.
The.
Reason.
For.
That.
Is.
Because.
Apple.
Also.
Had.
A.
Tactical.
Fix.
If.
You.
Remember.
That.
Drop.
Sip.
Binary.
That.
We.
Started.
The.
Talk.
With.
Well.
What.
Apple.
Is.
Now.
Doing.
Is.
Basically.
Dropping.
C.
Bypassing.
Capabilities.
Before.
Launching.
Those.
Crits.
Which.
Is.
Kind.
Of.
Like.
A.
Tactical.
Fix.
But.
It.
Works.
Because.
You.
Can't.
Do.
Anything.
Even.
If.
You.
Affect.
Pearl.
It.
Doesn't.
Have.
The.
Bypassing.
Capabilities.
Anymore.
So.
You.
Can't.
Use.
That.
For.
Bypassing.
Sip.
It's.
A.
Cool.
Way.
To.
Persist.
In.
An.
Pearl.
Intensive.
Environment.
But.
Not.
Good.
For.
This.
Exploit.
At.
Least.
So.
That's.
That's.
The.
End.
Really.
The.
Vulnerability.
Was.
Assigned.
With.
CV.
2023.
32369.
Apple.
Has.
Really.
Made.
An.
Amazing.
Impression.
On.
Us.
Those.
Are.
Solid.
Fixes.
And.
You.
Know.
Besides.
The.
Tactical.
Fix.
Which.
Is.
Good.
Like.
The.
Other.
Two.
Fixes.
The.
Launch.
Constraints.
And.
The.
Fact.
That.
There.
Are.
No.
More.
And.
Poisoning.
And.
Stuff.
Like.
That.
Besides.
That.
Apple.
Has.
Granted.
A.
Really.
Nice.
Bounty.
Money.
Which.
We.
Donated.
To.
Charity.
If.
You.
Don't.
Know.
That.
By.
The.
Way.
And.
You.
Get.
Bounty.
From.
One.
Of.
These.
Big.
Companies.
You.
Can.
Ask.
Them.
To.
Donate.
To.
Charity.
And.
They.
Will.
Usually.
Double.
That.
Amount.
So.
Donate.
To.
Charity.
If.
You.
I.
Mean.
If.
You.
Into.
That.
And.
We.
Wish.
To.
Thank.
Apple.
For.
Everything.
Here.
And.
It.
Is.
Our.
Point.
Of.
View.
That.
With.
Apple.
Moving.
Everything.
To.
User.
Land.
And.
Creating.
Separate.
Security.
Layers.
As.
You.
Could.
Have.
Seen.
With.
All.
The.
Entitlements.
And.
Stuff.
Like.
That.
And.
They're.
Basically.
Killing.
Kernel.
Extensions.
And.
Not.
So.
You.
Know.
There.
Are.
Like.
The.
Peasants.
And.
And.
Apple.
And.
In.
The.
O.S.
At.
Least.
And.
Because.
They.
The.
Keys.
To.
The.
Kingdom.
We.
Believe.
That.
Similar.
Bypasses.
Will.
Basically.
Shake.
The.
Mac.
O.S.
Ecosystem.
Because.
Again.
In.
This.
Case.
We.
Were.
Lucky.
That.
We.
Are.
The.
Ones.
Who.
Found.
It.
But.
If.
You.
Know.
There.
Is.
Some.
Malware.
Author.
That.
Finds.
Something.
Like.
That.
They.
Can.
Create.
Under.
Little.
Untitled.
Malware.
And.
Stuff.
Like.
That.
And.
No.
One.
Will.
Be.
Able.
To.
Anything.
Besides.
Apple.
Which.
Might.
Be.
Too.
Late.
So.
I.
Think.
That's.
Pretty.
Much.
It.
Well.
Thank.
You.
So.
Much.