From the comments on that, it seems like you need to do the exploit in the UI first. According the the analysis of the bug, "Upon receiving a mach XPC message,

From the comments on that, it seems like you need to do the exploit in the UI first. According the the analysis of the bug, "Upon receiving a mach XPC message, opendirectoryd invokes..." but what happens on the client end of the XPC message isn't mentioned. I'm just wondering if a low privileged user can initiate that programmatically, and whether they could do it from code that doesn't need to be signed, like a shell script.