POC

POC ¡Solo para fines de investigación! Una colección pública de POCs y Exploits para las vulnerabilidades que descubrí. CVE-2022-22583 PackageKit : Una aplicación podría acceder a archivos restringidos SIP Bypass CVE-2022-26690 PackageKit : Una aplicación maliciosa podría modificar partes...

CVE-2023-42860

CVE-2023-42860 Exploit para CVE-2023-42860 solo con fines de investigación. Este exploit funciona en versiones de macOS anteriores a la 13.3, aunque el changelog de Apple afirma que se corrigió en la versión 14.1. Pasos 1. Descarga el InstallAssistant.pkg 2. Modifica la variable TARGETFILE en el...

CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite

CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite...

hm-surf

HM-Surf evaluator Evaluates susceptibility to CVE-2024-44133 of common macOS browsers. Also contains the HTML that takes a screenshot and downloads it along with location extraction. Usage - evaluator To run the evaluator, which evaluates CVE-2024-44133 on all common macOS browsers, run: python3 ...

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal

CVE-2023-32407-un-macOS-TCC-bypass-en-Metal...

CVE-2023-26818

Descargo de responsabilidad Este exploit ha sido creado únicamente con fines de investigación y para el desarrollo de técnicas defensivas efectivas. No está destinado a ser utilizado para actividades maliciosas o no autorizadas. El autor y el propietario del script rechazan cualquier...

CVE-2020-9934

CVE-2020-9934 Esta Prueba de Concepto es un simple programa Swift que se otorgará a sí mismo y a Terminal todas las autorizaciones kTCCService obtenidas de tccd y luego hará cuatro cosas: Crear un archivo llamado "" en el directorio protegido por TCC Leer los datos de dicho archivo desde dentro d...

CVE-2026-43783

CVE-2026-43783: Repair Permissions - Get Root: LPE via DesktopServicesHelper in macOS 26.5 Originally published on PT SWARM or andrd3v.github.io The daemon that Finder uses to "repair" permissions on iCloud files turned out to be willing to repair permissions on anything - including system...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

CVE-2025-24204

CVE-2025-24204 Acerca de CVE-2025-24204 es una vulnerabilidad que permite leer la memoria de cualquier proceso en sistemas macOS con SIP habilitado. La causa raíz de esta vulnerabilidad se debe a la adición de un entitlement excesivamente potente com.apple.system-task-ports.read al binario gcore...

CVE-2022-26726-POC

CVE-2022-26726 Versiones afectadas Como estudiante, tengo acceso limitado a dispositivos en los que puedo probar esta vulnerabilidad. Las versiones que he probado hasta ahora son MacOS 12.3.1, MacOS 12.3, MacOS 12.0, MacOS 10.15.7 y MacOS 11.6.1. La vulnerabilidad funciona en todas las versiones...

electroniz3r

electroniz3r Toma el control de los permisos de TCC de las aplicaciones Electron de macOS con electroniz3r. La herramienta se presentó por primera vez en DEFCON31 en Las Vegas durante mi charla ELECTRONizing macOS privacy - a new weapon in your red teaming armory. Descripción general $ electroniz...

MSF-screenrecord-on-MacOS

MSF-screenrecord-on-MacOS !!! Esta vulnerabilidad ha sido descubierta o tomada simultáneamente por Sudhakar Muthumani de Primefort Private Limited, Khiem Tran y listada como CVE-2022-22600. Esto a pesar de que ya había enviado un correo a Apple sobre esto en 2021. Versiones afectadas Como...

CVE-2026-89905 LoongArch: BPF: Move arena register slot below TCC context

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

Electron: Parent process code-sign check is spoofable

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypas...

EUVD-2026-53403

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

CVE-2026-70597 Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

CVE-2026-70597: Time-of-check Time-of-use (TOCTOU) Race Condition

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

CVE-2026-9497

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...

TCC-TRANSACTION has an Improper Input Validation vulnerability

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...