https://bradleyjkemp.dev/post/launchdaemon-hijacking

launchdaemon_hijacking.go

package main

import (
	"fmt"
	"os"
	"path/filepath"

	"golang.org/x/sys/unix"
	"howett.net/plist"
)

var searchPaths = []string{
	"/Library/LaunchAgents",
	"/Library/LaunchDaemons",
}

type launchAgentDaemon struct {
	Program          string   `plist:"Program"`
	ProgramArguments []string `plist:"ProgramArguments"`
}

func main() {
	for _, path := range searchPaths {
		filepath.Walk(path, func(path string, info os.FileInfo, err error) error {
			switch {
			case err != nil:
				return err
			case info.IsDir():
				return nil
			}

			file, err := os.Open(path)
			if err != nil {
				return err
			}

			launch := launchAgentDaemon{}
			if err := plist.NewDecoder(file).Decode(&launch); err != nil {
				return err
			}

			binaryPath := launch.Program
			if binaryPath == "" {
				binaryPath = launch.ProgramArguments[0]
			}

			if unix.Access(binaryPath, unix.W_OK) == nil {
				fmt.Printf("%s launches a vulnerable binary as root! The target binary (%s) is writeable by current user\n", path, binaryPath)
			}
			if unix.Access(filepath.Dir(binaryPath), unix.W_OK) == nil {
				fmt.Printf("%s launches a vulnerable binary as root! The target binary is in a writeable directory (%s)\n", path, filepath.Dir(binaryPath))
			}
			return nil
		})
	}
}

usage.md

Usage

go run launchdaemon_hijacking.go