Tag: macOS

The daemon that Finder uses to “repair” permissions on iCloud files turned out to be willing to repair permissions on anything – including system directories. In this article we’ll look at how DesktopServicesHelper works under the hood and why a single XPC request was enough to get root. But before we get there, let’s cover some macOS internals.

Introduction

Today, we will try to figure out one mechanism for which there is not much information available on the internet and attempt to use the defect of this mechanism to exploit an LPE vulnerability.

The mechanism we are going to look into is Mac-specific startup process for specialized services, which also known as Agents and Daemons. We will figure out loading mechanism of such services, their work and other subtleties.