Privilege Escalation in macOS CUPS cupsd

This repository is a compact standalone Python proof-of-concept for CVE-2026-39875 affecting macOS CUPS on Tahoe, Sequoia, and Sonoma before the patched versions noted in the README. Repository structure is minimal: `README.md` explains the bug chain and usage, `poc.py` contains the exploit logic, and `LICENSE` is MIT. The exploit is a real local privilege-boundary bypass / arbitrary root file write PoC rather than a detector. Its core capability is chaining two CUPS logic flaws: first, it captures a privileged Local authentication token that `cupsd` forwards to an attacker-controlled backend during printer probing; second, it replays that token to perform privileged printer administration and abuses a timing window so `cupsd` writes attacker-controlled print-job content to an attacker-selected `file://` path as root. From the visible code, `poc.py` manually constructs IPP requests, sends raw HTTP POST requests to the local CUPS service on port 631, and uses `/admin/` for privileged operations such as add/modify printer, accept jobs, and resume printer. It defines a local capture listener on `127.0.0.1:9189` to receive the forwarded token, then repeatedly performs printer administration and print-job submission in a loop to hit the vulnerable timing window. The default demonstration target is `/Users/<current_user>/demo`, and the payload content is a simple line of text written as root. The script checks whether CUPS is reachable, may attempt a restart if not, captures the token, runs the exploitation phase, and verifies success by listing the resulting file. Overall, this is an operational local exploit PoC for arbitrary file write as root on vulnerable macOS systems. It does not include a post-exploitation privilege escalation payload beyond the root file write demonstration, and the README explicitly notes that it demonstrates arbitrary file write as root rather than a full root shell or direct privilege escalation.

Small repository containing a single Python PoC (poc.py), a README describing the vulnerability chain, and a license. The exploit targets CVE-2026-39875, a local privilege escalation in macOS CUPS/cupsd. Its purpose is to demonstrate that an unprivileged local user can capture a privileged CUPS Local auth token during printer probing, replay that token to create or modify a printer with a malicious file:// device URI, and then trigger a root-privileged arbitrary file write by submitting a print job. The Python code manually builds IPP requests and sends raw HTTP POST requests to the local CUPS service on 127.0.0.1:631, primarily against /admin/. It defines constants for IPP operations such as CUPS_ADD_MODIFY_PRINTER, CUPS_ACCEPT_JOBS, RESUME_PRINTER, PRINT_JOB, DELETE_PRINTER, and CREATE_LOCAL_PRINTER. The script uses a local listener on 127.0.0.1:9189 to capture the forwarded Local authorization token from cupsd. After token capture, it repeatedly performs administrative printer operations and submits attacker-controlled print content to win the timing window described in the README. The default payload is operational rather than just demonstrative: it targets /etc/sudoers.d/<user> and writes a line granting the current user NOPASSWD sudo access. That yields practical root escalation once the file is successfully written. The exploit is not a scanner or detection script; it is an active local LPE PoC with a hardcoded privilege-escalation payload. The repository is straightforward, with poc.py as the sole entry point and all exploit logic embedded in that file.