Exploit for Improper Authentication in Apple Macos

## https://sploitus.com/exploit?id=1E99C40C-4AFC-56D3-AA4D-08A333199E02
# CVE-2026-65400 — macOS Screen Sharing pre-auth root file read (read-only PoC)

> **Read-only proof of concept.** It demonstrates the authentication bypass by reading a
> root-only file from a vulnerable host. It writes nothing to the target: no LaunchDaemon,
> no shell startup file, no crontab, no RCE chain.

[![CVE](https://img.shields.io/badge/CVE-2026--65400-red)](https://nvd.nist.gov/vuln/detail/CVE-2026-65400)
[![CVSS](https://img.shields.io/badge/CVSS-9.8_Critical-red)]()
[![CISA KEV](https://img.shields.io/badge/CISA-KEV_listed-orange)]()
[![Python](https://img.shields.io/badge/python-3.x_stdlib_only-blue)]()

![PoC run against my own MacBook Pro](img/poc-run.png)

*Run against a Mac I own (macOS Tahoe 26.5.2, unpatched). Serial number redacted.*

---

## Summary

`screensharingd` — the daemon behind macOS **Screen Sharing / Apple Remote Management**
(TCP **5900**) — can be tricked into treating an unauthenticated connection as
authenticated. No username, no password, no interaction on the target.

The daemon's native authentication path uses **SRP (Secure Remote Password)**. Its
**frame-length validator returns a stale success status**, so the connection is marked
authenticated before any credential has been proven. Apple's advisory language —
*"improved state management"* — matches this: the cryptography was never broken, the
state machine around it was.

Once past that gate the session continues **in cleartext**, and the privileged file-copy
helpers (`SSFileCopySender` / `SSFileCopyReceiver`) hold **Full Disk Access**. That yields
pre-auth **arbitrary file read and write as root**, bypassing TCC — and from there,
remote code execution is one LaunchDaemon or shell startup file away.

**Pre-auth. Remote. Root. Default configuration**, the moment Screen Sharing is enabled.

## Affected versions

| macOS | Vulnerable | Fixed (2026-08-06) |
|---|---|---|
| Tahoe 26 | ≤ 26.6 | **26.6.1** |
| Sequoia 15 | ≤ 15.7.8 | **15.7.9** |
| Sonoma 14 | ≤ 14.8.8 | **14.8.9** |

Requires Screen Sharing / Remote Management to be enabled and reachable. Hardening the
*accounts* does not help — removing users, disabling legacy VNC and rotating passwords
provide **no protection**, because the bug is reached before authentication.

## Exploitation status

This is not theoretical. It is being exploited in the wild.

| Date | Event |
|---|---|
| 2026-07-27 | macOS 26.6 patches CVE-2026-43760 (post-auth confused-context), disturbing the pre-auth path |
| 2026-07-29 | bynar.io publishes the 43760 write-up; Pedro Vilaça (fG!) discloses the pre-auth bug with an obfuscated PoC |
| 2026-08-01/02 | bl4sty reverses the PoC, recovers the wire format, builds read/write + RCE |
| 2026-08-06 | Apple explicitly patches CVE-2026-65400 |
| 2026-08-14 | CISA rescores 7.1 → **9.8 Critical** |
| 2026-08-18 | Added to the **CISA KEV** catalog |

Observed in-the-wild activity against internet-exposed port 5900: SSH public key dropped
for persistence, logs and shell history cleared, packet filter rules modified, and the
**XMRig 6.26.0** Monero miner deployed.

## Usage

Python 3, standard library only. No dependencies.

```bash
python3 poc_screensharing.py                           # reads /etc/sudoers
python3 poc_screensharing.py  /etc/passwd
python3 poc_screensharing.py  /etc/master.passwd -r 50
```

```
-p, --port      target port (default 5900)
-u, --user      username sent in the SRP step-1 frame (default root)
-r, --retries   retry count (default 25) — the bug is heap-racy
-t, --timeout   socket timeout in seconds (default 8.0)
```

### Notes on reliability

- **The bug is racy.** It depends on heap layout and does not land on every attempt; that
  is why the PoC retries. If it does not land in 25–50 tries, try again later.
- **The daemon throttles.** Hammering it gets you rate-limited — wait ~1 minute.
- **Patched hosts are detected, not retried.** A `SecurityResult != 0` or a security-type
  list without SRP (36) stops the loop and reports the host as not vulnerable.

## Detection

Endpoint Security event `ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH`:

- `authentication_type: SRP` **without** an RSA component — legitimate sessions report
  `RSA-SRP`. This is the highest-signal indicator.
- Session username `root` — the account is disabled by default on macOS.
- `SSFileCopySender` running with UID/GID `0 80`, touching system paths via
  `_LOOKUP` / `_OPEN` / `_STAT` / `_CLOSE` during a Screen Sharing session.

## Mitigation

1. **Patch** to 26.6.1 / 15.7.9 / 14.8.9. This is the only real fix.
2. If you cannot patch, **disable Screen Sharing / Remote Management** entirely.
3. **Never expose TCP 5900 to the internet** — with or without this CVE.

## Credits

The research is not mine. This repository is a reproduction and a write-up.

- **Pedro Vilaça (fG!, [@osxreverser](https://x.com/osxreverser))** — original pre-auth bug
- **bl4sty (navi_the_clown)** — wire format and exploitation technique
- **bynar.io** — CVE-2026-43760
- **Huntress** (Bryan Masters, Stuart Ashenbrenner) — detection guidance

## Legal

For authorized security testing, defensive validation and education only. Run it against
systems you own or have **explicit written permission** to test. The screenshot above is
a Mac I own. Using this against systems you do not control is illegal in most
jurisdictions. The author accepts no liability for misuse.

Released only after the vendor patch was publicly available, and deliberately limited to
a read primitive.

---

## Español

`screensharingd`, el demonio de **Compartir Pantalla** de macOS (TCP **5900**), puede darse
por autenticado sin que nadie haya presentado credenciales. Su validador de longitud de
frame en el flujo **SRP** devuelve un estado de éxito obsoleto, así que la conexión se
trata como autenticada antes de tiempo. Apple lo describe como *"improved state
management"*: la criptografía nunca se rompió, se rompió la máquina de estados que la rodea.

A partir de ahí la sesión continúa **en claro** y los helpers privilegiados de copia de
ficheros (`SSFileCopySender` / `SSFileCopyReceiver`) tienen **Full Disk Access**, lo que da
**lectura y escritura arbitraria como root** saltándose TCC — y de ahí a RCE hay un
LaunchDaemon de distancia. **Pre-auth, remoto, root y en configuración por defecto.**

Este PoC es **de solo lectura**: demuestra el bypass leyendo un fichero que solo root puede
leer y no escribe nada en el objetivo.

**Qué hacer:** actualizar a 26.6.1 / 15.7.9 / 14.8.9 — es el único arreglo real. Si no
puedes, desactiva Compartir Pantalla. Rotar contraseñas o eliminar cuentas **no sirve**,
porque el fallo se alcanza antes de la autenticación. Y que el 5900 no esté expuesto a
Internet.

Úsalo solo contra equipos de tu propiedad o con autorización por escrito.