Skip to main content
2 of 2
added 166 characters in body

I have not been able to exploit this vulnerability remotely, however I was able to while logged on and trying to escalate my privileges in System Preferences using "root" with no password.

To detect this, scan the logs of the desired machine with the following command in Terminal.

sudo log show --style syslog | fgrep "authenticated as user root (UID 0) for right"

The output of this command will show you the UID of the user that was logged on when this vulnerability was exploited, and the time. Take the time and look for ssh or remote connections around that time frame.

Update, to search for logins via the root account, use the following command in Terminal.

sudo log show --style syslog | fgrep 'loginwindow' | fgrep 'root'