macOS Screen Sharing Improper Authentication

The repository contains a README and one Python entry point, exploit.py. The script is a standalone operational exploit, not a module for Metasploit, Nuclei, or another recognized framework. It connects to an operator-supplied TCP target, performs an RFB 3.889 negotiation, requires the server to advertise SRP security type 36, then sends an SRP step-1 frame concatenated with a deliberately malformed/oversized file-transfer blob. The blob uses a poisoned big-endian length and filler PointerEvent records, apparently intended to win a timing-dependent parser/authentication race. The code implements separate builders for privileged read and write file-transfer operations. Read mode requests an arbitrary UTF-8 path and returns raw bytes, hashes the result with SHA-256, and optionally saves it to a local output file. Write mode packages destination-directory metadata, item information, filename, Unix file mode, and local file contents in 64 KiB transfer chunks. The README describes post-exploitation uses: collecting login, SSH, browser, and other protected data through root-context reads; overwriting privileged helpers or launchd-managed content with writes; and gaining persistence or execution when the replaced program is subsequently launched. It does not embed a reverse shell or a fixed command payload; code-execution outcomes require the operator to supply malicious file content and choose a target executable or launchd path. The exploit is explicitly retry-based because failures are expected from the race condition, with a default VNC port of 5900 and configurable timeout, retry count, username, file mode, output path, and local write source. The supplied content identifies CVE-2026-65400 and claims it affects macOS, but provides no specific macOS release range.

This repository is a small standalone Python proof-of-concept for CVE-2026-65400 affecting Apple macOS Screen Sharing / Apple Remote Management (screensharingd). The repo contains one executable code file (poc_screensharing.py), a README with vulnerability background, usage, affected versions, and mitigation guidance, plus standard LICENSE and .gitignore files. The exploit is a real network-based pre-authentication exploit, not merely a detector. It connects to the target's RFB/VNC-compatible Screen Sharing service on TCP 5900, verifies the server speaks RFB, negotiates protocol version 'RFB 003.889', checks whether the server offers SRP security type 36, and then sends a crafted SRP step-1 message together with a malformed oversized blob. The blob is built by build_read_blob() and contains a poisoned declared length plus a StartFileSend-style request for an attacker-supplied file path. According to the code and README, this abuses a stale-success condition in the authentication state machine so the connection is treated as authenticated before credentials are validated. Once the bypass succeeds, the script reads post-auth file-copy messages from the server and collects file data chunks (kind 102 / DATA) until an end marker (kind 104 / END). It then prints the number of bytes read, a SHA-256 hash, and the raw file contents to stdout. The PoC is intentionally limited to read-only behavior: it does not attempt persistence, command execution, file writes, or shell deployment, although the README states the underlying vulnerability could enable arbitrary file write and eventual RCE. Operationally, the exploit includes retry logic because the bug is described as heap-racy. It stops early if the host appears patched or non-targeted, specifically when SRP type 36 is absent or SecurityResult is non-zero. The user can configure target IP, file path, port, username used in the SRP step-1 frame, retry count, and timeout. Overall, this is an operational PoC demonstrating unauthenticated remote root-level file read against vulnerable macOS Screen Sharing deployments.

Repository contains a standalone Python exploit PoC and one auxiliary Bash helper script. The main file, CVE-2026-65400.py, implements a network exploit against Apple Screen Sharing over the RFB/VNC protocol. It connects to a target on TCP/5900, performs an RFB handshake using version string 'RFB 003.889', selects Apple SRP security type 36, and sends a crafted oversized SRP frame length intended to bypass authentication. After the bypass, the script uses Apple’s file-copy protocol message type 0x22 to perform arbitrary file operations. The exploit supports three practical modes described in the code and README: read arbitrary files from the target, write arbitrary files to the target, and execute code indirectly by writing a shell script plus a root cron entry. The RCE path is operational rather than just demonstrative because it includes a concrete payload and a built-in listener thread for interactive shell handling, but it is constrained by target configuration: SIP must be disabled for the cron-based persistence/execution path to work. Repository structure is minimal: .gitignore, the Python exploit, LICENSE, README, and get-svn.sh. README provides extensive usage examples, including sensitive file targets and persistence-oriented write targets. get-svn.sh is unrelated to exploitation of the CVE itself; it is a utility for sparse-downloading GitHub folders and then piping a remote gist into bash for cleanup. No evidence suggests the repository is fake; it is a real exploit PoC with offensive file read/write and reverse-shell capabilities.