macOS Screen Sharing (screensharingd) SRP Pre-Authentication Bypass

#!/bin/bash
# cve-2026-65400-check.sh
# Check for CVE-2026-65400: macOS Screen Sharing pre-auth bypass
# Run on target macOS host. No root required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

VERSION=$(sw_vers -productVersion 2>/dev/null || echo "unknown")
BUILD=$(sw_vers -buildVersion 2>/dev/null || echo "unknown")

if [[ "$VERSION" == "unknown" ]]; then
  echo "UNKNOWN - Not a macOS system or sw_vers unavailable"
  exit 2
fi

# Check if Screen Sharing is enabled
SS_ENABLED=false
if launchctl list 2>/dev/null | grep -q "com.apple.screensharing"; then
  SS_ENABLED=true
fi

# Check if port 5900 is actually listening
PORT_OPEN=false
if lsof -iTCP:5900 -sTCP:LISTEN -P -n 2>/dev/null | grep -q screensharingd; then
  PORT_OPEN=true
fi

# Version comparison function
version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

# Determine vulnerability status
MAJOR=$(echo "$VERSION" | cut -d. -f1)
PATCHED=false

case "$MAJOR" in
  26) # macOS Tahoe
    if version_gte "$VERSION" "26.6.1"; then
      PATCHED=true
    fi
    ;;
  15) # macOS Sequoia
    if version_gte "$VERSION" "15.7.9"; then
      PATCHED=true
    fi
    ;;
  14) # macOS Sonoma
    if version_gte "$VERSION" "14.8.9"; then
      PATCHED=true
    fi
    ;;
  *)
    echo "UNKNOWN - macOS $VERSION (build $BUILD) is not in the affected version range (Sonoma 14.x / Sequoia 15.x / Tahoe 26.x)"
    echo "Screen Sharing enabled: $SS_ENABLED | Port 5900 listening: $PORT_OPEN"
    exit 2
    ;;
esac

if $PATCHED; then
  echo "PATCHED - macOS $VERSION (build $BUILD) includes the fix for CVE-2026-65400"
  echo "Screen Sharing enabled: $SS_ENABLED | Port 5900 listening: $PORT_OPEN"
  exit 0
else
  if $PORT_OPEN; then
    echo "VULNERABLE - macOS $VERSION (build $BUILD) is UNPATCHED and Screen Sharing is ACTIVELY LISTENING on port 5900"
    echo "IMMEDIATE ACTION REQUIRED: This host is exploitable right now."
  elif $SS_ENABLED; then
    echo "VULNERABLE - macOS $VERSION (build $BUILD) is UNPATCHED. Screen Sharing is enabled but port 5900 not confirmed listening."
  else
    echo "VULNERABLE - macOS $VERSION (build $BUILD) is UNPATCHED. Screen Sharing appears disabled (reduced but not zero risk)."
  fi
  echo "Screen Sharing enabled: $SS_ENABLED | Port 5900 listening: $PORT_OPEN"
  exit 1
fi