Image for post
Image for post
I’m a ****ing walking paradox

X Site eScape (Part I): Exploitation of and Old CoreFoundation Sandbox Bug

codecolorist
May 28 · 5 min read


Image for post
Image for post
Dashboard, removed since macOS 10.15
Image for post
Image for post
WebClip
Image for post
Image for post
  • An HTML file
  • An icon in png format
  • Other assets like stylesheets and external scripts
Image for post
Image for post
Amazing widgets!
Image for post
Image for post
  • MainHTML: name of the main user interface
  • AllowNetworkAccess: permission to make cross-domain AJAX
  • AllowSystem: permission to execute a shell command
  • AllowJava: permission to use Java
  • AllowFullAccess: permission to read local files
➜  ~ nm /System/Library/PrivateFrameworks/DashboardClient.framework/DashboardClient | grep webScriptNameForSelector
0000000000007c5b t +[DBCAsyncUNIXScriptJSObject webScriptNameForSelector:]
000000000000540b t +[DBCCalculatorJSObject webScriptNameForSelector:]
0000000000005b93 t +[DBCJSObject webScriptNameForSelector:]
0000000000005fac t +[DBCMenuJSObject webScriptNameForSelector:]
00000000000060e4 t +[DBCScriptingJSObject webScriptNameForSelector:]
0000000000006bbf t +[DBCUNIXScriptJSObject webScriptNameForSelector:]
Image for post
Image for post
I guess it’s born to be misused
➜ ~ nm /System/Library/Frameworks/ApplicationServices.framework/Frameworks/HIServices.framework/HIServices | grep CoreDock | grep \ T\
0000000000019e51 T _CoreDockAddFileToDock
0000000000018dad T _CoreDockBounceAppTile
0000000000018df2 T _CoreDockCompositeProcessImage
0000000000011e62 T _CoreDockCopyPreferences
000000000001a410 T _CoreDockCopyWorkspacesAppBindings
Image for post
Image for post
  • Show desktop: com.apple.showdesktop.awake
  • Show Workspaces: com.apple.workspaces.awake
  • Exposé: com.apple.expose.awake / com.apple.expose.front.awake
  • Show Dashboard: com.apple.dashboard.awake
  • TouchPad Preferences: com.apple.dashboard.touchbar.preference
  1. Safari renderer sandbox has a writable temporary directory, where we can release a widget bundle here. Dashboard does not care about the quarantine flag
  2. Manipulate the preferences domain com.apple.dashboard to install our widget
  3. CoreDockSetPreferences to enable Dashboard forcibly
  4. CoreDockSendNotification to activate Dashboard desktop
  5. Widget activated and game over

CodeColorist

I write random stuff

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch

Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore

Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store