# Local Privilege escalation to root via XPC

MacKeeper's root XPC helper validated clients only by code-signing cert, so DYLD_INSERT_LIBRARIES into an old non-hardened signed binary yielded a root shell.

- Payout: hidden
- Severity: high
- Program: Clario
- Found by: r3ggi-on-h1
- Disclosed: 2020-06-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/750118
- Library page: https://bugbountylibrary.com/r/h1%3A750118
- Tags: area:os domain:desktop impact:privesc impact:rce kind:bounty platform:hackerone sev:high technique:chained vuln:privilege-escalation

**Target:** macOS XPC privileged helper com.mackeeper.MacKeeperPrivilegedHelper
**Root cause:** The privileged helper's shouldAcceptNewConnection: only verified the connecting process was signed with the same Developer Certificate, not its specific identity or hardened runtime, so any signed-but-injectable MacKeeper binary could connect.
**Steps:**
1. Download older MacKeeper 4.6.2 (signed with same cert, no Hardened Runtime).
2. Write malicious dylib implementing MKIKeenowVPN protocol and a constructor that connects to `com.mackeeper.MacKeeperPrivilegedHelperMKIKeenowVPN.mach` with NSXPCConnectionPrivileged.
3. In constructor, call `initializeWithOpenVPNPath:@"/tmp/rootshell.sh"` then `startVPNConnectionWithIP:@"127.0.0.1" protocol:@"TCP" port:@"8888"` on the remote proxy.
4. Compile: `gcc -dynamiclib malicious_library.m -o libMacKeeperMaliciousLibrary.dylib -lobjc -framework Foundation`.
5. Run: `DYLD_INSERT_LIBRARIES=./libMacKeeperMaliciousLibrary.dylib ./MacKeeper_old.app/Contents/MacOS/MacKeeper`.
6. Root shell spawns on 127.0.0.1:31337; if not, kill com.mackeeper.MacKeeperPrivilegedHelper and retry.
**How found:** Noticed the helper's listener:shouldAcceptNewConnection: only checked the Developer Certificate rather than the specific binary identity or hardened runtime, then found an older signed MacKeeper build lacking Hardened Runtime to inject into.
**Exploitation:** Attacker injects a dylib into a validly signed MacKeeper binary via DYLD_INSERT_LIBRARIES; the injected code opens an XPC connection to the root helper, passes the cert check, and invokes initializeWithOpenVPNPath with an attacker script path, which the root helper executes, spawning a root shell.
**Escalation:** Chained code injection into a signed binary with the helper's cert-only trust check to reach root from user context.
**Insight:** When an XPC helper validates clients by code-signing certificate alone, hunt for any older signed build of the same product without Hardened Runtime — DYLD_INSERT_LIBRARIES into it satisfies the cert check and reaches the root service.