GITBOOK-3886: change request with no subject merged in GitBook
This commit is contained in:
CPol
gitbook-bot
parent
504234542f
commit
5318efc1ad
@ -7,7 +7,7 @@
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
@ -63,6 +63,33 @@ First of all, please note that **most of the tricks about privilege escalation a
|
||||
* **/Volumes**: The mounted drives will apear here.
|
||||
* **/.vol**: Running `stat a.txt` you obtain something like `16777223 7545753 -rw-r--r-- 1 username wheel ...` where the first number is the id number of the volume where the file exists and the second one is the inode number. You can access the content of this file through /.vol/ with that information running `cat /.vol/16777223/7545753`
|
||||
|
||||
### Applications Folders
|
||||
|
||||
* **System applications** are located under `/System/Applications`
|
||||
* **Installed** applications are usually installed in `/Applications` or in `~/Applications`
|
||||
* **Application data** can be found in `/Library/Application Support` for the applications running as root and `~/Library/Application Support` for applications running as the user.
|
||||
* Third-party applications **daemons** that **need to run as root** as usually located in `/Library/PrivilegedHelperTools/`
|
||||
* **Sandboxed** apps are mapped into the `~/Library/Containers` folder. Each app has a folder named according to the application’s bundle ID (`com.apple.Safari`).
|
||||
* The **kernel** is located in `/System/Library/Kernels/kernel`
|
||||
* **Apple's kernel extensions** are located in `/System/Library/Extensions`
|
||||
* **Third-party kernel extensions** are stored in `/Library/Extensions`
|
||||
|
||||
### Firmlinks
|
||||
|
||||
The `Data` volume is mounted in **`/System/Volumes/Data`** (you can check this with `diskutil apfs list`).
|
||||
|
||||
The list of firmlinks can be found in the **`/usr/share/firmlinks`** file.
|
||||
|
||||
```bash
|
||||
cat /usr/share/firmlinks
|
||||
/AppleInternal AppleInternal
|
||||
/Applications Applications
|
||||
/Library Library
|
||||
[...]
|
||||
```
|
||||
|
||||
On the **left**, there is the directory path on the **System volume**, and on the **right**, the directory path where it maps on the **Data volume**. So, `/library` --> `/system/Volumes/data/library`
|
||||
|
||||
### Special MacOS files and folders
|
||||
|
||||
* **`.DS_Store`**: This file is on each directory, it saves the attributes and customisations of the directory.
|
||||
@ -87,7 +114,14 @@ First of all, please note that **most of the tricks about privilege escalation a
|
||||
_amavisd, _analyticsd, _appinstalld, _appleevents, _applepay, _appowner, _appserver, _appstore, _ard, _assetcache, _astris, _atsserver, _avbdeviced, _calendar, _captiveagent, _ces, _clamav, _cmiodalassistants, _coreaudiod, _coremediaiod, _coreml, _ctkd, _cvmsroot, _cvs, _cyrus, _datadetectors, _demod, _devdocs, _devicemgr, _diskimagesiod, _displaypolicyd, _distnote, _dovecot, _dovenull, _dpaudio, _driverkit, _eppc, _findmydevice, _fpsd, _ftp, _fud, _gamecontrollerd, _geod, _hidd, _iconservices, _installassistant, _installcoordinationd, _installer, _jabber, _kadmin_admin, _kadmin_changepw, _knowledgegraphd, _krb_anonymous, _krb_changepw, _krb_kadmin, _krb_kerberos, _krb_krbtgt, _krbfast, _krbtgt, _launchservicesd, _lda, _locationd, _logd, _lp, _mailman, _mbsetupuser, _mcxalr, _mdnsresponder, _mobileasset, _mysql, _nearbyd, _netbios, _netstatistics, _networkd, _nsurlsessiond, _nsurlstoraged, _oahd, _ondemand, _postfix, _postgres, _qtss, _reportmemoryexception, _rmd, _sandbox, _screensaver, _scsd, _securityagent, _softwareupdate, _spotlight, _sshd, _svn, _taskgated, _teamsserver, _timed, _timezone, _tokend, _trustd, _trustevaluationagent, _unknown, _update_sharing, _usbmuxd, _uucp, _warmd, _webauthserver, _windowserver, _www, _wwwproxy, _xserverdocs
|
||||
```
|
||||
* **Guest**: Account for guests with very strict permissions
|
||||
* `state=("automaticTime" "afpGuestAccess" "filesystem" "guestAccount" "smbGuestAccess"); for i in "${state[@]}"; do sysadminctl -"${i}" status; done;`
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
state=("automaticTime" "afpGuestAccess" "filesystem" "guestAccount" "smbGuestAccess")
|
||||
for i in "${state[@]}"; do sysadminctl -"${i}" status; done;
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
* **Nobody**: Processes are executed with this user when minimal permissions are required
|
||||
* **Root**
|
||||
|
||||
@ -138,9 +172,11 @@ ls -l a.txt #The file length is still q
|
||||
|
||||
You can **find all the files containing this extended attribute** with:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
find / -type f -exec ls -ld {} \; 2>/dev/null | grep -E "[x\-]@ " | awk '{printf $9; printf "\n"}' | xargs -I {} xattr -lv {} | grep "com.apple.ResourceFork"
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Risk Files Mac OS
|
||||
|
||||
@ -369,10 +405,10 @@ Note that there are **exceptions specified by Apple**: The file **`/System/Libra
|
||||
For example, the config lines:
|
||||
|
||||
```bash
|
||||
/usr
|
||||
* /usr/libexec/cups
|
||||
* /usr/local
|
||||
* /usr/share/man
|
||||
/usr
|
||||
* /usr/libexec/cups
|
||||
* /usr/local
|
||||
* /usr/share/man
|
||||
```
|
||||
|
||||
Means that `/usr` **cannot be modified** **except** for the **3 allowed** folders allowed.
|
||||
@ -381,7 +417,7 @@ The final exception to these rules is that **any installer package signed with t
|
||||
|
||||
Note that if **a file is specified** in the previous config file **but** it **doesn't exist, it can be created**. This might be used by malware to obtain stealth persistence. For example, imagine that a **.plist** in `/System/Library/LaunchDaemons` appears listed but it doesn't exist. A malware may c**reate one and use it as persistence mechanism.**
|
||||
|
||||
Also, note how files and directories specified in **`rootless.conf`** have a **rootless extended attribute**:
|
||||
Also, note how files and directories specified in the previous **`rootless.conf`** file have a **rootless extended attribute**:
|
||||
|
||||
```bash
|
||||
xattr /System/Library/LaunchDaemons/com.apple.UpdateSettings.plist
|
||||
@ -391,6 +427,16 @@ ls -lO /System/Library/LaunchDaemons/com.apple.UpdateSettings.plist
|
||||
-rw-r--r--@ 1 root wheel restricted,compressed 412 1 Jan 2020 /System/Library/LaunchDaemons/com.apple.UpdateSettings.plist
|
||||
```
|
||||
|
||||
Running a `ls -lO` you can find the directories protected by SIP because of the **`restricted`** flag. Moreover, directories with the **`sunlnk`** flag cannot be deleted (although files can be created and deleted inside of it).
|
||||
|
||||
```bash
|
||||
ls -lO /
|
||||
drwxr-xr-x@ 10 root wheel restricted 320 Feb 9 10:39 System
|
||||
|
||||
ls -lO /usr/
|
||||
drwxr-xr-x 8 root wheel sunlnk 256 Apr 8 00:49 local
|
||||
```
|
||||
|
||||
**SIP** handles a number of **other limitations as well**. Like it **doesn't allows for the loading of unsigned kexts**. SIP is also responsible for **ensuring** that no OS X **system processes are debugged**. This also means that Apple put a stop to dtrace inspecting system processes.
|
||||
|
||||
Check if SIP is enabled with:
|
||||
@ -428,6 +474,55 @@ codesign --verify --verbose /Applications/Safari.app
|
||||
spctl --assess --verbose /Applications/Safari.app
|
||||
```
|
||||
|
||||
### Sealed Snapshots
|
||||
|
||||
The command **`diskutil apfs list`** lists the **details of the APFS volumes** and their layout:
|
||||
|
||||
<pre><code>+-- Container disk3 966B902E-EDBA-4775-B743-CF97A0556A13
|
||||
| ====================================================
|
||||
| APFS Container Reference: disk3
|
||||
| Size (Capacity Ceiling): 494384795648 B (494.4 GB)
|
||||
| Capacity In Use By Volumes: 219214536704 B (219.2 GB) (44.3% used)
|
||||
| Capacity Not Allocated: 275170258944 B (275.2 GB) (55.7% free)
|
||||
| |
|
||||
| +-< Physical Store disk0s2 86D4B7EC-6FA5-4042-93A7-D3766A222EBE
|
||||
| | -----------------------------------------------------------
|
||||
| | APFS Physical Store Disk: disk0s2
|
||||
| | Size: 494384795648 B (494.4 GB)
|
||||
| |
|
||||
| +-> Volume disk3s1 7A27E734-880F-4D91-A703-FB55861D49B7
|
||||
| | ---------------------------------------------------
|
||||
| | APFS Volume Disk (Role): disk3s1 (System)
|
||||
| | Name: Macintosh HD (Case-insensitive)
|
||||
| | Mount Point: /System/Volumes/Update/mnt1
|
||||
| | Capacity Consumed: 12819210240 B (12.8 GB)
|
||||
| | Sealed: Broken
|
||||
| | FileVault: Yes (Unlocked)
|
||||
| | Encrypted: No
|
||||
| | |
|
||||
| | Snapshot: FAA23E0C-791C-43FF-B0E7-0E1C0810AC61
|
||||
| | Snapshot Disk: disk3s1s1
|
||||
| | Snapshot Mount Point: /
|
||||
<strong>| | Snapshot Sealed: Yes
|
||||
</strong>[...]
|
||||
</code></pre>
|
||||
|
||||
In the previous output it's possible to see that **macOS System volume snapshot is sealed** (cryptographically signed by the OS). SO, if SIP is bypassed and modifies it, the **OS won't boot anymore**.
|
||||
|
||||
It's also possible to verify that seal is enabled by running:
|
||||
|
||||
```bash
|
||||
csrutil authenticated-root status
|
||||
Authenticated Root status: enabled
|
||||
```
|
||||
|
||||
Moreover, it's mounted as **read-only**:
|
||||
|
||||
```
|
||||
mount
|
||||
/dev/disk3s1s1 on / (apfs, sealed, local, read-only, journaled)
|
||||
```
|
||||
|
||||
## Installed Software & Services
|
||||
|
||||
Check for **suspicious** applications installed and **privileges** over the.installed resources:
|
||||
@ -452,8 +547,6 @@ launchctl print system
|
||||
launchctl print gui/<user's UID>/com.company.launchagent.label
|
||||
```
|
||||
|
||||
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (7).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**Follow HackenProof**](https://bit.ly/3xrrDrL) **to learn more about web3 bugs**
|
||||
@ -1260,8 +1353,6 @@ sudo killall -HUP mDNSResponder
|
||||
* [**https://github.com/NicolasGrimonpont/Cheatsheet**](https://github.com/NicolasGrimonpont/Cheatsheet)
|
||||
* [**https://assets.sentinelone.com/c/sentinal-one-mac-os-?x=FvGtLJ**](https://assets.sentinelone.com/c/sentinal-one-mac-os-?x=FvGtLJ)
|
||||
|
||||
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (7).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**Follow HackenProof**](https://bit.ly/3xrrDrL) **to learn more about web3 bugs**
|
||||
@ -1279,7 +1370,7 @@ sudo killall -HUP mDNSResponder
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
|
||||
@ -9,7 +9,7 @@
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
@ -84,6 +84,25 @@ kextload com.apple.iokit.IOReportFamily
|
||||
kextunload com.apple.iokit.IOReportFamily
|
||||
```
|
||||
|
||||
## Apple Propietary File System (APFS)
|
||||
|
||||
APFS, or Apple File System, is a modern file system developed by Apple Inc. that was designed to replace the older Hierarchical File System Plus (HFS+) with an emphasis on **improved performance, security, and efficiency**.
|
||||
|
||||
Some notable features of APFS include:
|
||||
|
||||
1. **Space Sharing**: APFS allows multiple volumes to **share the same underlying free storage** on a single physical device. This enables more efficient space utilization as the volumes can dynamically grow and shrink without the need for manual resizing or repartitioning.
|
||||
1. This means, compared with traditional partitions in file disks, t**hat in APFS different partitions (volumes) shares all the disk space**, while a regular partition usually had a fixed size.
|
||||
2. **Snapshots**: APFS supports **creating snapshots**, which are **read-only**, point-in-time instances of the file system. Snapshots enable efficient backups and easy system rollbacks, as they consume minimal additional storage and can be quickly created or reverted.
|
||||
3. **Clones**: APFS can **create file or directory clones that share the same storage** as the original until either the clone or the original file is modified. This feature provides an efficient way to create copies of files or directories without duplicating the storage space.
|
||||
4. **Encryption**: APFS **natively supports full-disk encryption** as well as per-file and per-directory encryption, enhancing data security across different use cases.
|
||||
5. **Crash Protection**: APFS uses a **copy-on-write metadata scheme that ensures file system consistency** even in cases of sudden power loss or system crashes, reducing the risk of data corruption.
|
||||
|
||||
Overall, APFS offers a more modern, flexible, and efficient file system for Apple devices, with a focus on improved performance, reliability, and security.
|
||||
|
||||
```bash
|
||||
diskutil list # Get overview of the APFS volumes
|
||||
```
|
||||
|
||||
## Applications
|
||||
|
||||
A kernel without applications isn’t very useful. **Darwin** is the non-Aqua, **open-source core of Mac OS X**. Basically it is all the parts of Mac OS X for which the **source code is available**. The code is made available in the form of a **package that is easy to install**. There are hundreds of **available Darwin packages**, such as X11, GCC, and other GNU tools. Darwin provides many of the applications you may already use in BSD or Linux for Mac OS X. Apple has spent significant time **integrating these packages into their operating system** so that everything behaves nicely and has a consistent look and feel when possible.
|
||||
@ -150,7 +169,7 @@ struct load_command {
|
||||
```
|
||||
|
||||
A **common** type of load command is **LC\_SEGMENT/LC\_SEGMENT\_64**, which **describes** a **segment:**\
|
||||
_A segment defines a **range of bytes** in a Mach-O file and the **addresses** and **memory** **protection** **attributes** at which those bytes are **mapped into** virtual memory when the dynamic linker loads the application._
|
||||
_A segment defines a **range of bytes** in a Mach-O file and the **addresses** and **memory**_ _**protection**_ _**attributes** at which those bytes are **mapped into** virtual memory when the dynamic linker loads the application._
|
||||
|
||||
.png>)
|
||||
|
||||
@ -289,7 +308,7 @@ There are some projects that allow to generate a binary executable by MacOS cont
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user