# macOS AUHelperService Full TCC Bypass

AUHelperService XPC accepted all clients and held Full Disk Access, letting any local app read/write TCC-protected paths and replace TCC.db to bypass macOS TCC.

- Payout: $23,000
- Severity: high
- Program: Apple
- Credited: Mickey Jin
- Disclosed: 2024-01-30
- Write-up quality: 7/10
- Original: https://jhftss.github.io/macOS-AUHelperService-Full-TCC-Bypass/
- Library page: https://bugbountylibrary.com/r/blog%3Ajhftss-github-io-macos-auhelperservice-full-tcc-bypass
- Tags: domain:desktop impact:integrity impact:privesc kind:bounty platform:blog sev:high technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** AUHelperService.xpc XPC service in Archive Utility.app
**Root cause:** The XPC service held the com.apple.private.tcc.allow kTCCServiceSystemPolicyAllFiles (Full Disk Access) entitlement and its delegate accepted all XPC clients (returned YES), so any local process could invoke its privileged routines.
**Steps:**
1. Connect to the Mach XPC service /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc
2. Exploit 1: call `validateTargetDirectory:archiveWrapper:withReply:` with an arbitrary TCC-protected path to obtain a sandbox extension granting read/write access
3. Exploit 2: call `moveWithUniquingFrom:into:baseName:sourceWrapper:withReply:` to move/replace the user's TCC.db using the service's FDA privilege
4. Replace TCC.db to grant the attacker's app TCC permissions, achieving full user TCC bypass
**How found:** Noticed the Sonoma beta added the Full Disk Access entitlement to AUHelperService.xpc and that its delegate accepted all XPC clients, then reviewed the 9 protocol routines for abusable primitives.
**Exploitation:** A local unprivileged app connects to the unauthenticated XPC service; validateTargetDirectory yields sandbox extensions for arbitrary paths (but not TCC.db directly), so moveWithUniquing is abused to move/replace the user's TCC.db, granting the attacker's app TCC-protected access.
**Escalation:** Chained two service routines: first to obtain arbitrary path read/write, then to swap TCC.db since the extension could not be issued directly to it.
**Insight:** Audit XPC services that gained TCC/FDA entitlements in beta releases and check whether their listener delegate authenticates clients; enumerate every protocol routine for file-move/replace primitives when direct sandbox extensions to sensitive files are blocked.