Apple Screen Sharing Pre-Authentication Root File Access and...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://warez.sl0p.foo/apple-screensharing-rce
• Blog Title: Apple Screen Sharing Pre-Authentication Root File Access and Remote Code Execution
• Suggested Section: macOS Hardening > macOS Security & Privilege Escalation > macOS Network Services & Protocols, with a cross-reference from Network Services Pentesting > 5800/5801/5900/5901 - Pentesting VNC

🎯 Content Summary

Overview

The post describes a critical pre-authentication vulnerability in Apple's root-privileged screensharingd daemon. It affects macOS Tahoe versions up to and including 26.5 when Screen Sharing is enabled and is reported fixed in macOS 26.6, released on July 27, 2026. No CVE identifier is given. The affected service implements Apple Screen Sharing using RFB version 003.889, security type 36, SRP authentication, and ...

🔧 Technical Details

Stale-status authentication bypass: When a parser performs a successful network read and subsequently rejects the parsed value, every rejection path must explicitly return an error. Reusing the read function's return register can turn malformed input into authentication success. In this case, an SRP frame length of at least 32768 reaches an oversized-frame branch that returns the preceding zero from NetBufferRead. The caller interprets zero as completed authentication and marks the session authenticated without validating credentials.

Skipping transport encryption through an early state-machine exit: If encryption is installed only after authentication verification, forcing an earlier function to report success may move the connection directly into the post-authentication state without crypto. The server never derives the SRP key or installs ChaCha20-Poly1305 contexts, so privileged application messages are accep...

🤖 Agent Actions

Using repo inspection workflow first; I’m discovering the available filesystem tool so I can read the relevant HackTricks pages and place any update correctly.
I’ve identified macos-protocols.md as the best single-file fit so far; before editing, I’m verifying the time-sensitive fix/version details with source links.
Done.

Updated:

• src/macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md

Added:

• A new Apple Screen Sharing / security type 36 subsection under Pentesting ARD
• Technical coverage of:
  • stale-status SRP auth bypass
  • cleartext post-auth state due to skipped crypto install
  • cross-state pipelining in one TCP burst
  • Apple file-copy 0x22 root read/write primitive
  • key write fields for NewItem
  • SIP-aware post-write execution ideas
  • SRP A mod N != 0 validation pitfall
  • concise detection ideas
• References for:
  • the blog post
  • Apple’s macOS Tahoe 26.6 security update
  • RFC 5054

Validation:

• git diff --check passed
• mdbook build could not be run because mdbook is not installed in this environment (/bin/sh: 1: mdbook: not found)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://warez.sl0p.foo/apple-screensharing-rce

Content Categories: Based on the analysis, this content was categorized under "macOS Hardening > macOS Security & Privilege Escalation > macOS Network Services & Protocols, with a cross-reference from Network Services Pentesting > 5800/5801/5900/5901 - Pentesting VNC".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0