# Objective-See reverses macOS #IAmRoot flaw

The source gives no date; added 2026-10-13 · Severity: elevated · Sectors: technology
Canonical: https://vorant.io/reports/1828a76c-8fa3-58fc-96f5-a94626a7b1e6/objective-see-reverses-macos-iamroot-flaw

> Objective-See's reverse engineering reveals macOS High Sierra's root authentication bypass stemmed from an unchecked return value in opendirectoryd's credential verification.

This Objective-See blog post provides a technical root-cause analysis of the widely publicized macOS High Sierra root authentication bypass (dubbed #IAmRoot), tracked as CVE-2017-13872. The flaw allowed any local or remote (via screen sharing) user to gain root access by attempting to authenticate to the disabled root account with any password, including a blank one, entered twice.

Through debugging and disassembly of opendirectoryd and the PlistFile.bundle module, the author traced the bug to a logic error: when authenticating to a disabled account lacking shadowhash data, the system falls back to checking a legacy crypt password field (which holds a placeholder '*' value for disabled accounts). The verification function od_verify_crypt_password returns a non-zero value regardless of whether the actual password comparison succeeded, and the calling code only checked this return value rather than the separate 'match' output parameter that correctly reflected verification failure. As a result, any attacker-supplied password was accepted, triggering an 'upgrade' routine that set that password as the new credential for the account (e.g., root), effectively activating and granting access to it.

Apple patched the issue for macOS 10.13 and 10.13.1 shortly after the public disclosure, adding a check on the 'match' variable. The author confirmed via binary diffing that this matched their root-cause analysis. However, the initial patch introduced its own problems, breaking file sharing for some users and being silently dropped when upgrading from patched 10.13 to 10.13.1, reintroducing the vulnerability. Apple subsequently shipped additional fixes (build 17C1003) and recommended a reboot after patching.

## Mentioned in this report

- Vulnerabilities: CVE-2017-13872 (weaponized)

## Detection guidance (public sample)

### macOS Root Account Enabled via dsenableroot

ATT&CK: T1548

Detects execution of dsenableroot to enable the root account on macOS. CVE-2017-13872 (#IAmRoot) ends with the disabled root account being activated, and attackers can do the same deliberately. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS Root Account Enabled via dsenableroot
description: Detects execution of dsenableroot, which enables the disabled root account
  on macOS. The
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1548
- attack.t1078
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /dsenableroot
  filter_disable:
    CommandLine|contains: ' -d'
  condition: selection and not filter_disable
falsepositives:
- Administrators deliberately enabling root for troubleshooting or legacy tooling
- MDM or provisioning scripts that enable root during device setup
level: medium
id: 09344b83-d5c3-5286-9542-6a71654c8e71
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x24.html
```

### macOS dscl Used to Set or Create Root Account Credentials

ATT&CK: T1078

Detects dscl being used to change the password of, or create attributes on, the local root user record. This is how a disabled root account is activated or given attacker-controlled credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS dscl Used to Set or Create Root Account Credentials
description: Detects dscl invoked against the /Users/root record with a password-change
  or create action. This activates the disabled root account or sets attacker-controlled
  credentials, the same end state the
tags:
- attack.privilege-escalation
- attack.t1548
- attack.t1078
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith: /dscl
  selection_target:
    CommandLine|contains: /Users/root
  selection_action:
    CommandLine|contains:
    - ' -passwd'
    - ' passwd'
    - ' -create'
    - ' create'
    - ' -change'
  condition: selection_img and selection_target and selection_action
falsepositives:
- Administrators resetting the root password with dscl during maintenance
- Configuration management scripts managing the root account
level: high
id: 3fbe2806-5ae9-5aed-8df2-436ff34cdfb1
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x24.html
```

### macOS Root User Record Modified in Local Directory Node

ATT&CK: T1548

Detects file writes to the local Open Directory root user plist. The #IAmRoot flaw caused opendirectoryd to write the attacker-supplied password into this record, which activates root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS Root User Record Modified in Local Directory Node
description: Detects file events on the root user plist in the local Open Directory
  node. In CVE-2017-13872 (#IAmRoot) the failed authentication to the disabled root
  account triggered an upgrade routine that wrote the supplied password into this
  record. Correlate with unexpected logins or su/sudo to root.
tags:
- attack.privilege-escalation
- attack.t1548
- attack.t1078
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|endswith: /var/db/dslocal/nodes/Default/users/root.plist
  condition: selection
falsepositives:
- Legitimate enabling or disabling of root through Directory Utility or dsenableroot
- Legitimate root password changes by administrators
level: medium
id: 35abac06-1b1f-5cad-9e6c-cf2d875546ac
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x24.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x24.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1828a76c-8fa3-58fc-96f5-a94626a7b1e6/objective-see-reverses-macos-iamroot-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup