Focusing on bug hunting and fuzzing in Android, IoT, and Apple products
Preface 0. macOS Userland : Based on Old Apple Bug Bounty 0.1 Userland Root LPE 0.2 General / Full TCC Bypass 0.3 SIP : System Integrity Protection 1. Remote Full TCC Bypass And Persistence 1.1 Threat model 1.2 package_script_service 1.3 Data Vault 1.4 Persistence 1.5 Easter Eggs in My Black Hat USA 2024 Presentation 1.6 How Apple Verifies / Protects the Integrity of An App 1.7 Exploit Steps 1.7.1…
0. CVE-2025-24103 : GuluBadInstallAssistant 1. Detail 1.1 What if we could execute the osinstallersetupd command successfully? 1.2 src 1.3 dst 2. Exploit Step 1: Prepare the malicious file on your own macOS Step 2: Download the malicious file malicious-osinstallersetupd.zip to the victim macOS 3. 14 G ? No, it’s 24M or less 4. Demo 5. Patch : macOS 15.3 6. One more thing 0. CVE-2025-24103 :…
Do the research on macOS for around 1 year, share some of my experience in Apple Security Bug Program.
Preface 1. Security Protections on macOS 1.1 System Integrity Protection: Rootless 1.2 Transparency, Consent, and Control : TCC 2. Transforming a Traditionally Useless Bug into a Sandbox Escape: A General Application Sandbox Escape Approach 2.1 Remote Attack Surfaces on macOS 2.2 App Sandbox Escape on macOS 2.3 Quarantine Protection on macOS 2.3.1 Quarantine Protection on macOS: Untrusted App…
Preface
Check out my slides at https://github.com/guluisacat/MySlides.