Apple Screen Sharing Pre-Auth RCE

Summary Apple’s Screen Sharing daemon (screensharingd) contains a pre-authentication vulnerability in its SRP (Secure Remote Password) frame-length validation. When the daemon receives an SRP frame whose big-endian 32-bit length has any bit at position ≥ 15 set (i.e., length ≥ 32768), the “frame too large” error path returns the stale success status from the preceding 4-byte read instead of an error code. The caller interprets this zero return as “authentication complete” and enters the post-auth message loop without any key exchange, cipher negotiation, or session crypto.

摘要 苹果的屏幕共享守护进程（screensharingd）在其 SRP（安全远程密码）帧长度验证中存在一个预认证漏洞。当守护进程接收到一个大端序 32 位长度且第 15 位及以上有任何位被置位的 SRP 帧（即长度 ≥ 32768）时，“帧过大”错误路径会返回之前 4 字节读取操作的陈旧成功状态，而不是错误代码。调用者将此零返回值解释为“认证完成”，并进入认证后的消息循环，而无需进行任何密钥交换、密码协商或会话加密。

---

The remaining bytes in the network buffer are then consumed as ordinary RFB messages — including Apple’s proprietary file-copy protocol (message type 0x22), which runs as root and provides arbitrary file read and write. By injecting a reverse shell payload and a root crontab in a single pipelined connection, an unauthenticated attacker achieves remote code execution as root within 60 seconds. No user interaction is required. The only prerequisite is that Screen Sharing is enabled on the target (System Settings → General → Sharing → Screen Sharing). No password, no valid username, and no knowledge of the target configuration is needed.

网络缓冲区中的剩余字节随后会被当作普通的 RFB 消息处理——包括苹果专有的文件复制协议（消息类型 0x22），该协议以 root 权限运行，并提供任意文件的读取和写入功能。通过在单个流水线连接中注入反向 Shell 有效载荷和 root crontab，未经身份验证的攻击者可在 60 秒内以 root 权限实现远程代码执行。此过程无需任何用户交互。唯一的前提条件是目标设备开启了“屏幕共享”（系统设置 → 通用 → 共享 → 屏幕共享）。无需密码、无需有效的用户名，也无需了解目标配置。

---

Root Cause The SRP auth handler in screensharingd reads a 4-byte big-endian frame length from the network buffer, then validates it. The mov x21, x0 on the “frame too large” path captures the return value of the 4-byte read (zero = success), not an error code. The function returns this zero to its caller, which interprets it as “SRP authentication complete”. The entire SRP state machine — ccsrp_server_generate_public_key, ccsrp_server_compute_session, ccsrp_server_verify_session — is never reached. No key is derived, no proof is verified, no ChaCha20-Poly1305 session layer is installed. The connection proceeds in cleartext.

根本原因 screensharingd 中的 SRP 认证处理程序从网络缓冲区读取 4 字节的大端序帧长度，然后对其进行验证。“帧过大”路径上的 mov x21, x0 指令捕获的是 4 字节读取操作的返回值（零代表成功），而非错误代码。该函数将此零值返回给调用者，调用者将其解释为“SRP 认证完成”。整个 SRP 状态机（ccsrp_server_generate_public_key、ccsrp_server_compute_session、ccsrp_server_verify_session）从未被触发。没有密钥被派生，没有证明被验证，也没有安装 ChaCha20-Poly1305 会话层。连接以明文形式继续进行。

---

What the Attacker Gets After the auth bypass, the remaining bytes in the network buffer are processed by the server’s RFB message loop. Apple’s file-copy protocol (message type 0x22) provides:

• Arbitrary file read as root: StartFileSend (kind=1) returns the full contents of any file on the filesystem.
• Arbitrary file write as root: StartFileReceive (kind=2) writes files with attacker-controlled content, path, filename, mode, and permissions.

攻击者能获得什么 在绕过认证后，网络缓冲区中的剩余字节由服务器的 RFB 消息循环处理。苹果的文件复制协议（消息类型 0x22）提供：

• 以 root 权限任意读取文件： StartFileSend（类型 1）可返回文件系统中任何文件的完整内容。
• 以 root 权限任意写入文件： StartFileReceive（类型 2）可写入由攻击者控制内容、路径、文件名、模式和权限的文件。

---

Attack Chain

1. Auth bypass: Client sends RFB version + security type 36 + SRP step-1 + a 24488-byte blob (triggering the length bug).
2. File write #1 (Reverse shell): The blob contains a StartFileReceive transaction writing a Perl reverse shell script to /var/tmp/.r.
3. File write #2 (Crontab): A second StartFileReceive transaction writes * * * * * /bin/bash /var/tmp/.r to /var/at/tabs/root.
4. Execution: Within 60 seconds, cron picks up the new crontab and executes the payload. The Perl script connects back to the attacker with a root shell.

攻击链

1. 绕过认证： 客户端发送 RFB 版本 + 安全类型 36 + SRP 第一步 + 一个 24488 字节的二进制块（触发长度漏洞）。
2. 文件写入 #1（反向 Shell）： 该二进制块包含一个 StartFileReceive 事务，将一个 Perl 反向 Shell 脚本写入 /var/tmp/.r。
3. 文件写入 #2（Crontab）： 第二个 StartFileReceive 事务将 * * * * * /bin/bash /var/tmp/.r 写入 /var/at/tabs/root。
4. 执行： 60 秒内，cron 进程读取新的 crontab 并执行有效载荷。Perl 脚本连接回攻击者，提供一个 root 权限的 Shell。