Apple Screen Sharing Pre-Authentication Root File Access and...

src/macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md

@@ -52,6 +52,36 @@ ARD provides versatile control levels, including observation, shared control, an
 
 From an operator perspective, **Monterey 12.1+ changed remote-enablement workflows** in managed fleets. If you already control the victim's MDM, Apple's `EnableRemoteDesktop` command is often the cleanest way to activate remote desktop functionality on newer systems. If you already have a foothold on the host, `kickstart` is still useful to inspect or reconfigure ARD privileges from the command line.
 
+#### Apple Screen Sharing (RFB 003.889 / security type 36) pre-auth file-copy abuse
+
+Recent `screensharingd` research showed that Apple Screen Sharing is not always just classic VNC auth: newer builds speak **RFB `003.889`** and advertise **security type `36`**, where **SRP** authenticates first and **ChaCha20-Poly1305** is only installed after `ccsrp_server_verify_session` succeeds. The public write-up reports the bug as fixed in **macOS Tahoe 26.6** (**July 27, 2026**).
+
+A useful pattern to remember is the **stale-status parser bypass**: after a successful 4-byte length read, every oversized/error branch must return a fresh error. On affected builds, a big-endian SRP frame length **`>= 32768`** makes the rejection path reuse the previous `NetBufferRead` success (`0`), so the caller sets the session as authenticated even though no password proof ran and no transport crypto was installed. Because unread bytes stay in the shared socket buffer, an attacker can **pipeline malformed SRP data and post-auth RFB messages in the same TCP burst** and get them parsed as **cleartext authenticated traffic**.
+
+After the bypass, Apple's proprietary **file-copy** message **`0x22`** becomes a **root file read/write primitive** because `screensharingd` runs as root:
+
+```text
+[u8 0x22][u8 sub][be32 L]
+[be16 ver][be16 kind][be32 sid][be32 arg]
+[L-12 bytes payload]
+```
+
+- `kind=1` / `StartFileSend`: arbitrary file read
+- `kind=2` / `StartFileReceive`: arbitrary file write
+- Different `sid` values let you pipeline several transactions in one connection
+- In `kind=101` (`NewItem`), set byte `14` / `arg[0]` to `0x01` for a regular file, payload offset `+42` to a **non-zero** big-endian file size, and payload offset `+0x5a` to the desired Unix mode (`0600` if targeting a crontab)
+
+Interesting post-write pivots on writable paths include **`/etc/sudoers.d/`**, **`/etc/zshenv`**, **`/Library/LaunchDaemons/`**, and **`/var/root/.ssh/authorized_keys`**. **SIP does not stop the auth bypass or root file read**, but it does block some write targets such as **`/var/at`**, so cron-based execution only works with SIP disabled. On default SIP-enabled hosts, think in terms of **"root file write into privileged auto-consumed files"** rather than immediate code execution.
+
+Another SRP pitfall from the same research: servers must validate **`A mod N != 0`** (per RFC 5054), not just `A > 0`. Accepting **`A = N`** can force the shared secret to zero and undermine password verification.
+
+**Detection ideas**
+
+- Security type `36` sessions where the first SRP frame length is **`>= 32768`**
+- Sessions that start processing cleartext **`0x22`** file-copy traffic before any successful SRP proof / cipher install
+- Repeated short-lived retries against **TCP/5900** plus multiple file-copy `sid` values in one burst
+- Unexpected creation of **`/etc/zshenv`**, **`/etc/sudoers.d/*`**, **`/Library/LaunchDaemons/*.plist`**, or **`/var/root/.ssh/authorized_keys`** after Screen Sharing exposure
+
 ### Pentesting Remote Apple Events (RAE / EPPC)
 
 Apple calls this feature **Remote Application Scripting** in modern System Settings. Under the hood it exposes the **Apple Event Manager** remotely over **EPPC** on **TCP/3031** via the `com.apple.AEServer` service. Palo Alto Unit 42 highlighted it again as a practical **macOS lateral movement** primitive because valid credentials plus an enabled RAE service allow an operator to drive scriptable applications on a remote Mac.
@@ -251,5 +281,8 @@ sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.p
 - [**NVD – CVE-2024-44183**](https://nvd.nist.gov/vuln/detail/CVE-2024-44183)
 - [**Palo Alto Unit 42 - Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples**](https://unit42.paloaltonetworks.com/unique-popular-techniques-lateral-movement-macos/)
 - [**Apple Support - About the security content of macOS Sonoma 14.7.2**](https://support.apple.com/en-us/121840)
+- [**Apple Screen Sharing Pre-Auth RCE**](https://warez.sl0p.foo/apple-screensharing-rce/)
+- [**Apple Support - About the security content of macOS Tahoe 26.6**](https://support.apple.com/en-us/128067)
+- [**RFC 5054 - Using the Secure Remote Password (SRP) Protocol for TLS Authentication**](https://www.rfc-editor.org/rfc/rfc5054)
 
 {{#include ../../banners/hacktricks-training.md}}