Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-26726-POC — TCC Bypass | Kitploit
Tools/GitHubGitHub/acheong08/cve-2022-26726-poc
Privilege EscalationVulnerability AnalysisExploitationPenetration TestingPayload DevelopmentArchived
GitHubacheong08/cve-2022-26726-poc

CVE-2022-26726-POC

TCC Bypass

View Repository
20323 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-26726

Affected Versions

As a student, I have limited access to devices in which I can test this vulnerability. The versions I have tested so far are MacOS 12.3.1, MacOS 12.3, MacOS 12.0, MacOS 10.15.7, and MacOS 11.6.1. The vulnerability works on all the versions tested on.

So what is the bug?

Impact: A malicious application may be able to bypass certain Privacy preferences

Description: When an executable is deleted while running, the process is able to bypass restrictions for Screen Recording as well as certain accessibility settings, namely keystroke injection (using metasploit).

Possible reasons: macOS cannot find the permissions of the parent executable of the process and thus does not prevent screen recording. However, it is confusing that the camera and mic are still properly restricted.

Details:

  • tccutil reset All results in a permission prompt being shown -- Accessing camera or mic also results in permission prompt being shown.
  • The retrieved screenshot includes all visible windows

Prerequisites

It works on a fresh installation of macOS.

POC

Running the POC from src/POC.sh will produce a screenshot without TCC prompt and includes all windows visible to the user. The script must occasionally be run multiple times (max 3) for a screenshot to be produced.

History and additional functions

This exploit was first discovered by me when experimenting with Metasploit's web delivery. I found that by deleting the dropped executable immediately after a meterpreter shell opens, the shell gains capabilities which are normally locked behind a TCC prompt. This vulnerability also allows an attacker to inject keystrokes. However, I am not an Objective-C developer and thus have not been able to create my own POC. This effect can still be achieved through Metasploit.

Source code and credits

src/POC.sh -- Shell script: Copies screenshot, executes it, and deletes it while it is running.

src/screenshot -- Mach-O executable: Takes a screenshot and saves it to src/screenshot.png. Compiled from src/screenshot.m.

src/screenshot.m -- Credits to theevilbit for the basic code. The only modification I made was to add a 3 second sleep before the screenshot to allow for enough time to delete the executable before the screenshot is taken.

Download Tool