{"id":4159,"date":"2026-08-19T01:24:34","date_gmt":"2026-08-18T16:24:34","guid":{"rendered":"https:\/\/h4ck.kr\/?p=4159"},"modified":"2026-08-19T01:24:35","modified_gmt":"2026-08-18T16:24:35","slug":"1day-cve-2026-20610-setup-assistantmbsystemadministration-root-%ec%86%8c%ec%9c%a0%ec%9e%90-%ed%8c%8c%ec%9d%bc%ec%9d%84-%ec%86%90%ec%83%81%ec%8b%9c%ed%82%ac-%ec%88%98-%ec%9e%88%eb%8a%94-%ec%8b%ac","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=4159","title":{"rendered":"[1day] CVE-2026-20610: Setup Assistant(mbsystemadministration): root \uc18c\uc720\uc790 \ud30c\uc77c\uc744 \uc190\uc0c1\uc2dc\ud0ac \uc218 \uc788\ub294 \uc2ec\ubcfc\ub9ad \ucd94\uc885 \ucde8\uc57d\uc810"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">\uac1c\uc694<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\ud574\ub2f9 \ucde8\uc57d\uc810\uc740 \ub2e4\uc74c \ubc84\uc804\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>macOS Tahoe 26.3<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"270\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.49.01-PM-1024x270.png\" alt=\"\" class=\"wp-image-4160\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.49.01-PM-1024x270.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.49.01-PM-300x79.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.49.01-PM-768x202.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.49.01-PM-1536x404.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.49.01-PM.png 1770w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">\ubb34\uc5c7\uc774 \ubc14\uaf08\ub098?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\uc5ec\ub7ec \ud30c\uc77c\ub4e4\uc744 \ubd10\uc654\uc9c0\ub9cc, \ubb38\uc790\uc5f4 \uacbd\ub85c\ub9cc \ubc14\uaf08\uc73c\uba70, \ucf54\ub4dc \ub85c\uc9c1\uc740 \uac70\uc758 \ubcc0\ud568\uc774 \uc5c6\uc5c8\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"838\" height=\"312\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.52.08-PM.png\" alt=\"\" class=\"wp-image-4161\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.52.08-PM.png 838w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.52.08-PM-300x112.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.52.08-PM-768x286.png 768w\" sizes=\"auto, (max-width: 838px) 100vw, 838px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc911\uc5d0\uc11c \uc77c\ubc18 \uc0ac\uc6a9\uc790\uac00 \uc0dd\uc131\ud560 \uc218 \uc788\uc744\ub9cc\ud55c <code>\/private\/tmp\/.AppleMiniSetupDidRun<\/code> \ud30c\uc77c\uc744 \uc8fc\ubaa9\ud574\uc11c \ud55c\ubc88 \ubd24\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"511\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.53.09-PM-1024x511.png\" alt=\"\" class=\"wp-image-4162\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.53.09-PM-1024x511.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.53.09-PM-300x150.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.53.09-PM-768x384.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.53.09-PM-1536x767.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.53.09-PM-2048x1023.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">\ud2b8\ub9ac\uac70 \ubc29\ubc95?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">System Settings \uc571\uc5d0\uc11c \uc0c8\ub85c\uc6b4 \ubd80\uacc4\uc815\uc744 \uc0dd\uc131\ud55c \ub2e4\uc74c\uc5d0<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"904\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.13.40-PM-1024x904.png\" alt=\"\" class=\"wp-image-4163\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.13.40-PM-1024x904.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.13.40-PM-300x265.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.13.40-PM-768x678.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.13.40-PM-1536x1356.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.13.40-PM.png 1670w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><code>fs_usage<\/code>\ub85c \ud30c\uc77c \uc0ac\uc6a9\uc744 \ucd94\uc801\ud574\ubcf4\uba74,<br>\ucd5c\ucd08 \ubd80\uacc4\uc815 \ub85c\uadf8\uc778 \ud560\uc2dc\uc5d0 <code>mbsystemadministration<\/code> \ud504\ub85c\uc138\uc2a4\uc5d0\uc11c <code>\/private\/tmp\/.AppleMiniSetupDidRun<\/code> \ud30c\uc77c\uc744 \uc0dd\uc131\ud558\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>seo@seos-Virtual-Machine ~ % sudo fs_usage -w -f filesys | grep -iE \"DidRunFLO|\/tmp|var\/run\"\n...\n16:18:10.774192  stat64                 &#91;  2]           private\/tmp\/.AppleMiniSetupDidRun                                                                                                                                     0.000035   mbsystemadministration.48270\n16:18:10.774455  open              F=3        (_WC_T__________)  private\/tmp\/.AppleMiniSetupDidRun                                                                                                                            0.000160   mbsystemadministration.48270\n16:18:10.774983    WrData&#91;A]       D=0x008799c7  B=0x1000   \/dev\/disk3s5  private\/tmp\/.AppleMiniSetupDidRun                                                                                                                   0.000486 W mbsystemadminist.48270\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>mbsystemadministration<\/code>\uc5d0\uc11c <code>\/tmp\/.AppleMiniSetupDidRun<\/code> \ubb38\uc790\uc5f4\uc744 xref\ud574\ubd24\uc744\ub54c, <code>-[MBSAServer writeMiniBuddyCookieForUser:completion:]<\/code> \uc5d0\uc11c \ud574\ub2f9 \ud30c\uc77c\uc744 \uc0dd\uc131\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>\/tmp\/.AppleMiniSetupDidRun<\/code> \ud574\ub2f9 \ud30c\uc77c\uc774 \uc5c6\ub354\ub77c\ub3c4 \uc0c1\uad00\uc5c6\uc774 \uc0dd\uc131 \uac00\ub2a5\ud558\uba70,<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>void __cdecl -&#91;MBSAServer writeMiniBuddyCookieForUser:completion:](MBSAServer *self, SEL a2, unsigned int a3, id a4)\n{\n  __int64 v4; \/\/ x19\n  void (__fastcall **v5)(id, __int64); \/\/ x20\n  __int64 _18; \/\/ &#91;xsp+18h] &#91;xbp+8h]\n\n  v4 = *(_QWORD *)&amp;a3;\n  v5 = (void (__fastcall **)(id, __int64))objc_retain(a4);\n  sub_100019048(v4);\n  v5&#91;2](v5, 1);\n  if ( ((_18 ^ (2 * _18)) &amp; 0x4000000000000000LL) != 0 )\n    __break(0xC471u);\n  objc_release(v5);\n}\n\nvoid __fastcall sub_100019048(__int64 a1)\n{\n  NSNumber *v1; \/\/ x20\n  NSArray *v2; \/\/ x21\n  void *v3; \/\/ x19\n  id v4; \/\/ x20\n  NSDictionary *v5; \/\/ x21\n  const __CFString *v6; \/\/ &#91;xsp+0h] &#91;xbp-40h] BYREF\n  void *v7; \/\/ &#91;xsp+8h] &#91;xbp-38h] BYREF\n  NSNumber *v8; \/\/ &#91;xsp+10h] &#91;xbp-30h] BYREF\n\n  v1 = objc_retainAutoreleasedReturnValue(+&#91;NSNumber numberWithUnsignedInt:](&amp;OBJC_CLASS___NSNumber, \"numberWithUnsignedInt:\", a1));\n  v8 = v1;\n  v2 = objc_retainAutoreleasedReturnValue(+&#91;NSArray arrayWithObjects:count:](&amp;OBJC_CLASS___NSArray, \"arrayWithObjects:count:\", &amp;v8, 1));\n  v3 = -&#91;NSArray mutableCopy](v2, \"mutableCopy\");\n  objc_release(v2);\n  objc_release(v1);\n  v4 = objc_retainAutoreleasedReturnValue(sub_100019170());\n  if ( v4 )\n    objc_msgSend(v3, \"addObjectsFromArray:\", v4);\n  v6 = CFSTR(\"uids\");\n  v7 = v3;\n  v5 = objc_retainAutoreleasedReturnValue(\n         +&#91;NSDictionary dictionaryWithObjects:forKeys:count:](\n           &amp;OBJC_CLASS___NSDictionary,\n           \"dictionaryWithObjects:forKeys:count:\",\n           &amp;v7,\n           &amp;v6,\n           1));\n  -&#91;NSDictionary writeToFile:atomically:](v5, \"writeToFile:atomically:\", CFSTR(\"\/tmp\/.AppleMiniSetupDidRun\"), 0);\n  objc_release(v5);\n  objc_release(v4);\n  objc_release(v3);\n}\n\nid sub_100019170()\n{\n  NSFileManager *v0; \/\/ x19\n  unsigned int v1; \/\/ w20\n  NSDictionary *v2; \/\/ x19\n  id v3; \/\/ x20\n  __int64 v4; \/\/ x0\n  id v5; \/\/ x21\n  __int64 _28; \/\/ &#91;xsp+28h] &#91;xbp+8h]\n\n  v0 = objc_retainAutoreleasedReturnValue(+&#91;NSFileManager defaultManager](&amp;OBJC_CLASS___NSFileManager, \"defaultManager\"));\n  v1 = -&#91;NSFileManager fileExistsAtPath:](v0, \"fileExistsAtPath:\", CFSTR(\"\/tmp\/.AppleMiniSetupDidRun\"));\n  objc_release(v0);\n  if ( v1 )\n  {\n    v2 = objc_retainAutoreleasedReturnValue(\n           +&#91;NSDictionary dictionaryWithContentsOfFile:](\n             &amp;OBJC_CLASS___NSDictionary,\n             \"dictionaryWithContentsOfFile:\",\n             CFSTR(\"\/tmp\/.AppleMiniSetupDidRun\")));\n    v3 = objc_retainAutoreleasedReturnValue(-&#91;NSDictionary objectForKey:](v2, \"objectForKey:\", CFSTR(\"uids\")));\n    v4 = objc_opt_class(&amp;OBJC_CLASS___NSArray);\n    if ( (objc_opt_isKindOfClass(v3, v4) &amp; 1) != 0 )\n      v5 = objc_retain(v3);\n    else\n      v5 = nullptr;\n    objc_release(v3);\n    objc_release(v2);\n  }\n  else\n  {\n    v5 = nullptr;\n  }\n  if ( ((_28 ^ (2 * _28)) &amp; 0x4000000000000000LL) != 0 )\n    __break(0xC471u);\n  return objc_autoreleaseReturnValue(v5);\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>-[NSDictionary writeToFile:atomically:]<\/code> \uba54\uc18c\ub4dc\ub97c \ud638\ucd9c\ud558\uc5ec \uc544\ub798\uc640 \uac19\uc774 UID \ud0a4\uac12\uc774 \uc788\ub294 \ub370\uc774\ud130\ub97c \uc4f8 \uac83\uc774\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;\n&lt;!DOCTYPE plist PUBLIC \"-\/\/Apple\/\/DTD PLIST 1.0\/\/EN\" \"&lt;http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd&gt;\"&gt;\n&lt;plist version=\"1.0\"&gt;\n    &lt;dict&gt;\n        &lt;key&gt;uids&lt;\/key&gt;\n        &lt;array&gt;\n            &lt;integer&gt;501&lt;\/integer&gt;\n        &lt;\/array&gt;\n    &lt;\/dict&gt;\n&lt;\/plist&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ud558\uc9c0\ub9cc <code>mbsystemadministration<\/code> \uc5d0\uc11c \uc218\ub77d\ubc1b\uc744 \uc218 \uc788\ub294 XPC \ud074\ub77c\uc774\uc5b8\ud2b8\ub294 <code>com.apple.private.mbsystemadministration<\/code> \uc790\uaca9\uc744 \ud544\uc694\ub85c \ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bool __cdecl -&#91;MBSAServer listener:shouldAcceptNewConnection:](MBSAServer *self, SEL a2, id a3, id a4)\n{\n  id v6; \/\/ x19\n  id v7; \/\/ x20\n  char v8; \/\/ w21\n  id v9; \/\/ x23\n  NSString *v10; \/\/ x24\n  id v11; \/\/ x23\n  id v12; \/\/ x23\n  OS_dispatch_queue *v13; \/\/ x24\n  id v14; \/\/ x23\n  void *v15; \/\/ x0\n  NSString *v16; \/\/ x22\n  _QWORD v18&#91;5]; \/\/ &#91;xsp+8h] &#91;xbp-A8h] BYREF\n  id v19; \/\/ &#91;xsp+30h] &#91;xbp-80h] BYREF\n  id location; \/\/ &#91;xsp+38h] &#91;xbp-78h] BYREF\n  _QWORD block&#91;5]; \/\/ &#91;xsp+40h] &#91;xbp-70h] BYREF\n  id v22; \/\/ &#91;xsp+68h] &#91;xbp-48h]\n\n  v6 = objc_retain(a3);\n  v7 = objc_retain(a4);\n  v8 = sub_100003FAC(CFSTR(\"com.apple.private.mbsystemadministration\"), v7);\n  v9 = objc_retainAutoreleasedReturnValue(+&#91;MBLogManager sharedManager](&amp;OBJC_CLASS___MBLogManager, \"sharedManager\"));\n  if ( (v8 &amp; 1) != 0 )\n  {\n    ...\n  }\n  else\n  {\n    v16 = objc_retainAutoreleasedReturnValue(\n            +&#91;NSString stringWithFormat:](\n              &amp;OBJC_CLASS___NSString,\n              \"stringWithFormat:\",\n              CFSTR(\"&lt;Security&gt; Rejecting connection due to lack of entitlement\")));\n    objc_msgSend(\n      v9,\n      \"logType:inFunction:atLine:withString:\",\n      1,\n      \"-&#91;MBSAServer listener:shouldAcceptNewConnection:]\",\n      238,\n      v16);\n    objc_release(v16);\n    v15 = v9;\n  }\n  objc_release(v15);\n  objc_release(v7);\n  objc_release(v6);\n  return v8;\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc544\ub798 \ub9c1\ud06c\ub97c \ud1b5\ud574 \uc790\uaca9\uc744 \ud655\uc778\ud574\ubd24\uc744\ub54c <code>com.apple.private.mbsystemadministration<\/code> \uc790\uaca9\uc744 \uac00\uc9c4 \ud504\ub85c\uc138\uc2a4\ub294 \ub531 4\uac1c\uac00 \uc874\uc7ac\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/codecolor.ist\/entdb\/os\/find?key=com.apple.private.mbsystemadministration&amp;os=mac%2F26.2_25C56\">https:\/\/codecolor.ist\/entdb\/os\/find?key=com.apple.private.mbsystemadministration&amp;os=mac%2F26.2_25C56<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"355\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.33.42-PM-1024x355.png\" alt=\"\" class=\"wp-image-4164\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.33.42-PM-1024x355.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.33.42-PM-300x104.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.33.42-PM-768x267.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.33.42-PM-1536x533.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.33.42-PM-2048x711.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><code>mbsystemadministration<\/code> \ud504\ub85c\uc138\uc2a4\ub97c \ub514\ubc84\uae45\ud558\uc5ec <code>-[MBSAServer writeMiniBuddyCookieForUser:completion:]<\/code> \uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uc7a1\uc73c\uba74, XPC\ud1b5\uc2e0\uc73c\ub85c \ud0c0 \ud504\ub85c\uc138\uc2a4\uc5d0 \uc640 \ud1b5\uc2e0\ud558\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\uace0<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>seo@seos-Virtual-Machine ~ % sudo lldb\n(lldb) process attach --name mbsystemadministration --waitfor\nProcess 1126 stopped\n* thread #1, stop reason = signal SIGSTOP\n    frame #0: 0x000000019ae7932c dyld`metadata_visitor::Visitor::resolveRebase(metadata_visitor::ResolvedValue const&amp;) const + 4\ndyld`metadata_visitor::Visitor::resolveRebase:\n-&gt;  0x19ae7932c &lt;+4&gt;:  ldr    x9, &#91;x9]\n    0x19ae79330 &lt;+8&gt;:  cbz    x9, 0x19ae7935c ; &lt;+52&gt;\n    0x19ae79334 &lt;+12&gt;: ldrb   w10, &#91;x0, #0x18]\n    0x19ae79338 &lt;+16&gt;: tbz    w10, #0x0, 0x19ae79368 ; &lt;+64&gt;\nTarget 0: (mbsystemadministration) stopped.\nExecutable binary set to \"\/System\/Library\/CoreServices\/Setup Assistant.app\/Contents\/Resources\/mbsystemadministration\".\nArchitecture set to: arm64e-apple-macosx-.\n\n(lldb) c\nProcess 1126 resuming\nProcess 1126 stopped\n* thread #2, queue = 'com.apple.NSXPCConnection.user.com.apple.mbsystemadministration.1113', stop reason = breakpoint 1.1\n    frame #0: 0x0000000100e60ed8 mbsystemadministration`___lldb_unnamed_symbol_10000ced8\nmbsystemadministration`___lldb_unnamed_symbol_10000ced8:\n-&gt;  0x100e60ed8 &lt;+0&gt;:  pacibsp\n    0x100e60edc &lt;+4&gt;:  stp    x20, x19, &#91;sp, #-0x20]!\n    0x100e60ee0 &lt;+8&gt;:  stp    x29, x30, &#91;sp, #0x10]\n    0x100e60ee4 &lt;+12&gt;: add    x29, sp, #0x10\nTarget 0: (mbsystemadministration) stopped.\n(lldb) bt\n* thread #2, queue = 'com.apple.NSXPCConnection.user.com.apple.mbsystemadministration.1113', stop reason = breakpoint 1.1\n  * frame #0: 0x0000000100e60ed8 mbsystemadministration`___lldb_unnamed_symbol_10000ced8\n    frame #1: 0x000000019b26bdc4 CoreFoundation`__invoking___ + 148\n    frame #2: 0x000000019b26bc4c CoreFoundation`-&#91;NSInvocation invoke] + 424\n    frame #3: 0x000000019cabd4d0 Foundation`__NSXPCCONNECTION_IS_CALLING_OUT_TO_EXPORTED_OBJECT__ + 16\n    frame #4: 0x000000019d5ee460 Foundation`-&#91;NSXPCConnection _decodeAndInvokeMessageWithEvent:reply:flags:] + 1208\n    frame #5: 0x000000019d5efde0 Foundation`message_handler_message + 88\n    frame #6: 0x000000019ca833ac Foundation`message_handler + 152\n    frame #7: 0x000000019aec26f0 libxpc.dylib`_xpc_connection_call_event_handler + 112\n    frame #8: 0x000000019aec0f80 libxpc.dylib`_xpc_connection_mach_event + 1488\n    frame #9: 0x000000019b03eb1c libdispatch.dylib`_dispatch_client_callout4 + 16\n    frame #10: 0x000000019b04139c libdispatch.dylib`_dispatch_mach_msg_invoke + 464\n    frame #11: 0x000000019b02d350 libdispatch.dylib`_dispatch_lane_serial_drain + 332\n    frame #12: 0x000000019b042104 libdispatch.dylib`_dispatch_mach_invoke + 472\n    frame #13: 0x000000019b02d350 libdispatch.dylib`_dispatch_lane_serial_drain + 332\n    frame #14: 0x000000019b02dff8 libdispatch.dylib`_dispatch_lane_invoke + 440\n    frame #15: 0x000000019b038474 libdispatch.dylib`_dispatch_root_queue_drain_deferred_wlh + 292\n    frame #16: 0x000000019b037d6c libdispatch.dylib`_dispatch_workloop_worker_thread + 692\n    frame #17: 0x000000019b1dde4c libsystem_pthread.dylib`_pthread_wqthread + 292\n(lldb)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>\/System\/Library\/CoreServices\/Setup Assistant.app\/Contents\/MacOS\/Setup Assistant<\/code> \uc5d0\uc11c XPC \uc5f0\uacb0\uc744 \uc2dc\ub3c4\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(lldb) po &#91;NSXPCConnection currentConnection]\n&lt;NSXPCConnection: 0xc44c4c280&gt; connection from pid 1113 on mach service named com.apple.mbsystemadministration\n\n(lldb) shell ps -A | grep 1113\n 1113 ??         0:01.67 \/System\/Library\/CoreServices\/Setup Assistant.app\/Contents\/MacOS\/Setup Assistant -MiniBuddyYes\n 1380 ttys001    0:00.01 \/bin\/sh -c  ps -A | grep 1113\n 1382 ttys001    0:00.00 grep 111\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc815\ub9ac\ud558\uc790\uba74, XPC \uc5f0\uacb0\uc744 \ud558\ub294\ub370\uc5d0 \uc55e\uc11c \ud074\ub77c\uc774\uc5b8\ud2b8\ub294 <code>\/System\/Library\/CoreServices\/Setup Assistant.app\/Contents\/MacOS\/Setup Assistant<\/code>, \uc11c\ubc84\ub294 <code>\/System\/Library\/CoreServices\/Setup Assistant.app\/Contents\/Resources\/mbsystemadministration<\/code>\uc774 \ub418\uaca0\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud574\ub2f9 XPC \uc11c\ubc84\ub294 <code>com.apple.private.mbsystemadministration<\/code> \uc790\uaca9\uc744 \uac16\ucd98 \ud074\ub77c\uc774\uc5b8\ud2b8\ub9cc \uc218\uc6a9\ud558\uace0 \uc788\uace0, \ubcf4\ud1b5\uc740 <code>listener:shouldAcceptNewConnection:<\/code> \uba54\uc18c\ub4dc\uc5d0\uc11c \uc790\uaca9\uc774 \ud544\uc694\ud55c\uc9c0 \uc548\ud55c\uc9c0 \ud655\uc778\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc81c \ud074\ub77c\uc774\uc5b8\ud2b8 \ud504\ub85c\uc138\uc2a4\uc778 <code>Setup Assistant<\/code> \ub97c \ud655\uc778\ud574\ubcf4\uc790.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc77c\ubc18 \uc0ac\uc6a9\uc790\uac00 \ud130\ubbf8\ub110\uc5d0\uc11c <code>Setup Assistant<\/code> \ub97c \uc2e4\ud589\ub9cc\ud558\uba74, <code>applicationDidFinishLaunching:<\/code> \u2192 <code>writeMiniBuddyCookieForUser:completion:<\/code> \uba54\uc18c\ub4dc\uac00 \uc21c\uc11c\ub300\ub85c \ud638\ucd9c\ub418\uc5b4 <code>mbsystemadministration<\/code> XPC \uc11c\ubc84\uc5d0\uac8c <code>\/tmp\/.AppleMiniSetupDidRun<\/code> \ud30c\uc77c \uc0dd\uc131\uc744 \uc694\uccad\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>void __cdecl -&#91;MacBuddyAppDelegate applicationDidFinishLaunching:](MacBuddyAppDelegate *self, SEL a2, id a3)\n{\n  \/\/...\n  {\n    v48 = objc_retainAutoreleasedReturnValue(+&#91;MBSAConnection sharedConnection](&amp;OBJC_CLASS___MBSAConnection, \"sharedConnection\"));\n    objc_msgSend(\n      v48,\n      \"writeMiniBuddyCookieForUser:completion:\",\n      -&#91;MacBuddyAppDelegate miniBuddyTargetUID](self, \"miniBuddyTargetUID\"),\n      &amp;stru_100283028);\n    objc_release(v48);\n  }\n  objc_release(v8);\n  objc_release(v7);\n  if ( ((_58 ^ (2 * _58)) &amp; 0x4000000000000000LL) != 0 )\n    __break(0xC471u);\n  objc_release(v6);\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc2e4\uc81c\ub85c \uc2e4\ud589\ud574\uc11c \ud655\uc778\ud574\ubcf4\uba74, <code>\/private\/tmp<\/code> \uacbd\ub85c\uc5d0 <code>.AppleMiniSetupDidRun<\/code> \ud30c\uc77c\uc774 \uc0dd\uc131\ub418\uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>seo@seos-Virtual-Machine ~ % open \/System\/Library\/CoreServices\/Setup\\ Assistant.app\n\nseo@seos-Virtual-Machine ~ % ls -la \/private\/tmp\ntotal 8\ndrwxrwxrwt  10 root          wheel  320  7\uc6d4 12 20:44 .\ndrwxr-xr-x   6 root          wheel  192  7\uc6d4 12 18:47 ..\n-rw-r--r--   1 root          wheel  374  7\uc6d4 12 20:44 .AppleMiniSetupDidRun\n...\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"814\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.44.29-PM-1024x814.png\" alt=\"\" class=\"wp-image-4165\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.44.29-PM-1024x814.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.44.29-PM-300x239.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.44.29-PM-768x611.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.44.29-PM-1536x1222.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Screenshot-2026-07-12-at-8.44.29-PM-2048x1629.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">\uc545\uc6a9 \uac00\ub2a5\uc131<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">root \uad8c\ud55c \uc18c\uc720\uc758 \ud30c\uc77c\uc744 <code>\/private\/tmp\/.AppleMiniSetupDidRun<\/code> \uc5d0 \uc2ec\ubcfc\ub9ad \ub9c1\ud06c\ub85c \uac78\uc5b4\ub454\ub2e4\uba74, \ud574\ub2f9 \ud30c\uc77c\uc744 \uc544\ub798 \ub0b4\uc6a9\uacfc \uac19\uc740 \ud615\uc2dd\uc73c\ub85c \ubcc0\uc870\ud560 \uc218 \uc788\ub2e4. uid \uac12\uc744 \uc81c\uc678\ud558\uace0\ub294 \uc644\uc804\ud788 \ud30c\uc77c \ub0b4\uc6a9\uc744 \uc81c\uc5b4\ud560 \uc218\ub294 \uc5c6\uae30 \ub54c\ubb38\uc5d0 \ud30c\uae09\ub825\uc774 \ud06c\uc9c4 \uc54a\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;\n&lt;!DOCTYPE plist PUBLIC \"-\/\/Apple\/\/DTD PLIST 1.0\/\/EN\" \"&lt;http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd&gt;\"&gt;\n&lt;plist version=\"1.0\"&gt;\n    &lt;dict&gt;\n        &lt;key&gt;uids&lt;\/key&gt;\n        &lt;array&gt;\n            &lt;integer&gt;(UID)&lt;\/integer&gt;\n        &lt;\/array&gt;\n    &lt;\/dict&gt;\n&lt;\/plist&gt;\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Demo<\/h1>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-4-3 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"nv-iframe-embed\"><iframe loading=\"lazy\" title=\"CVE-2026-20610\" width=\"1200\" height=\"900\" src=\"https:\/\/www.youtube.com\/embed\/D89SRa4NVxs?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/div>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>\uac1c\uc694 \ud574\ub2f9 \ucde8\uc57d\uc810\uc740 \ub2e4\uc74c \ubc84\uc804\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\ub2e4. \ubb34\uc5c7\uc774 \ubc14\uaf08\ub098? \uc5ec\ub7ec \ud30c\uc77c\ub4e4\uc744 \ubd10\uc654\uc9c0\ub9cc, \ubb38\uc790\uc5f4 \uacbd\ub85c\ub9cc \ubc14\uaf08\uc73c\uba70, \ucf54\ub4dc \ub85c\uc9c1\uc740 \uac70\uc758 \ubcc0\ud568\uc774 \uc5c6\uc5c8\ub2e4. \uc774\uc911\uc5d0\uc11c \uc77c\ubc18 \uc0ac\uc6a9\uc790\uac00 \uc0dd\uc131\ud560 \uc218 \uc788\uc744\ub9cc\ud55c \/private\/tmp\/.AppleMiniSetupDidRun \ud30c\uc77c\uc744 \uc8fc\ubaa9\ud574\uc11c \ud55c\ubc88 \ubd24\ub2e4. \ud2b8\ub9ac\uac70 \ubc29\ubc95? System Settings \uc571\uc5d0\uc11c \uc0c8\ub85c\uc6b4 \ubd80\uacc4\uc815\uc744 \uc0dd\uc131\ud55c \ub2e4\uc74c\uc5d0 fs_usage\ub85c \ud30c\uc77c \uc0ac\uc6a9\uc744 \ucd94\uc801\ud574\ubcf4\uba74,\ucd5c\ucd08 \ubd80\uacc4\uc815 \ub85c\uadf8\uc778 \ud560\uc2dc\uc5d0 mbsystemadministration \ud504\ub85c\uc138\uc2a4\uc5d0\uc11c \/private\/tmp\/.AppleMiniSetupDidRun \ud30c\uc77c\uc744 \uc0dd\uc131\ud558\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=4159\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">[1day] CVE-2026-20610: Setup Assistant(mbsystemadministration): root \uc18c\uc720\uc790 \ud30c\uc77c\uc744 \uc190\uc0c1\uc2dc\ud0ac \uc218 \uc788\ub294 \uc2ec\ubcfc\ub9ad \ucd94\uc885 \ucde8\uc57d\uc810<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[72],"tags":[13,25],"class_list":["post-4159","post","type-post","status-publish","format-standard","hentry","category-realworld","tag-macos","tag-pwnable"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/4159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4159"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/4159\/revisions"}],"predecessor-version":[{"id":4166,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/4159\/revisions\/4166"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}