Exploiting Directory Permissions on macOS

Explore the intricacies of exploiting directory permissions on macOS in this 56-minute Hack In The Box Security Conference talk. Delve into the non-intuitive nature of macOS directory and file permissions, uncovering vulnerabilities ranging from arbitrary overwrites to file disclosures and privilege escalation. Learn techniques for controlling file contents without direct write access, applicable to Unix-based systems but focusing on macOS-specific bugs. Examine real-world examples, including CVE-2020-3830, CVE-2020-3763, and CVE-2019-8802, while gaining insights into POSIX models, Access Control Lists, and sandbox environments. Presented by Csaba Fitzl, an experienced computer engineer and red team professional, this talk offers valuable knowledge for both blue and red team security practitioners.