Need help with Keysteal?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

LinusHenze
214 Stars 42 Forks MIT License 7 Commits 0 Opened issues

Description

A macOS <= 10.14.3 Keychain exploit

Services available

!
?

Need anything else?

Contributors list

# 139,289
Swift
C
Shell
3 commits
# 312,351
Shell
Docker
text-an...
python3
1 commit
# 5,230
Python
finder
brute-f...
penetra...
1 commit

KeySteal

KeySteal is a macOS <= 10.14.3 Keychain exploit that allows you to access passwords inside the Keychain without a user prompt. The vulnerability has been assigned CVE-2019-8526 number.
KeySteal consists of two parts: 1. KeySteal Daemon: This is a daemon that exploits securityd to get a session that is allowed to access the Keychain without a password prompt. 2. KeySteal Client: This is a library that can be injected into Apps. It will automatically apply a patch that forces the Security Framework to use the session of our keysteal daemon.

Building and Running

  1. Open the KeySteal Xcode Project
  2. Build the keystealDaemon and keystealClient
  3. Open the directory which contains the built daemon and client (right cick on keystealDaemon -> Open in Finder)
  4. Run dump-keychain.sh

TODO

Add a link to my talk about this vulnerability at Objective by the Sea

License

For most files, see LICENSE.txt.
The following files were taken (or generated) from Security-58286.220.15 and are under the Apple Public Source License: * handletypes.h * sstypes.h * ucsptypes.h * ucsp.hpp * ucspUser.cpp

A copy of the Apple Public Source License can be found here.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.