macos-post-exploitation
macOS endpoint post-exploitation — launchd persistence, TCC bypass, Keychain credential access, dylib hijacking, Gatekeeper/quarantine evasion, and discovery on Apple hosts.
معلومات المصدر
- المستودع
- BitterSecurity/Decepticon
- آخر نشاط في المصدر
- ٣٠ مايو ٢٠٢٦ في ٠١:١٧
- لغة SKILL.md المكتشفة
- الإنجليزية
- النجوم
- ٥٬٦١١
- التفرعات
- ١٬٠٦١
خيارات التثبيت
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
مراجعة ملفات المصدر
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
عرض SKILL.md
SKILL.md
تعليمات المصدر · معاينة للقراءة فقط- name
- macos-post-exploitation
- description
- macOS endpoint post-exploitation — launchd persistence, TCC bypass, Keychain credential access, dylib hijacking, Gatekeeper/quarantine evasion, and discovery on Apple hosts.
- allowed-tools
- Bash Read Write
- metadata
- {"subdomain":"post-exploitation","when_to_use":"macOS, mac, osx, apple, launchd, LaunchAgent, LaunchDaemon, TCC, keychain, dylib hijack, Gatekeeper, quarantine, xattr, codesign, dscl, jamf, mdm","tags":"macos, osx, persistence, tcc, keychain, dylib, gatekeeper, launchd, privesc, credential-access","mitre_attack":"T1543.001, T1543.004, T1547.011, T1574.004, T1547.015, T1555.001, T1059.002, T1553.001, T1222.002, T1087.001, T1518, T1647"}
# macOS post-exploitation
Post-compromise operations on Apple/macOS endpoints. Apple's controls
(TCC, Gatekeeper/quarantine, SIP, code signing, AMFI) shape every step, so the
playbook is organized around defeating or living within them. Prefer
on-host built-ins (`launchctl`, `security`, `sqlite3`, `dscl`, `system_profiler`,
`codesign`, `xattr`) over dropped tooling for OPSEC.
> Authorized engagements only. Stay within RoE scope; emulate destructive
> actions as benign proofs unless explicitly authorized.
## Discovery (T1087.001 / T1518 / T1647)
- `system_profiler SPSoftwareDataType SPHardwareDataType` — OS build, model, SIP.
- `csrutil status` — System Integrity Protection on/off.
- `dscl . -list /Users | grep -v '^_'` — local accounts; `id`, `groups`.
- `sw_vers`, `profiles status -type enrollment` — MDM/Jamf managed? (T1647 plist prefs).
- Installed security tooling: `ls /Library/Objective-See`, `pgrep -l 'CrowdStrike|SentinelOne|falcon|Jamf|santad'`.
## Privilege escalation
- **TCC bypass / abuse (T1548 family).** TCC gates access to Documents, Desktop,
Downloads, camera/mic, Full Disk Access. Check `sqlite3
~/Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'`
(user) and `/Library/Application Support/com.apple.TCC/TCC.db` (system, needs root).
Abuse an already-FDA-granted app (e.g. a terminal/Electron app) to read
protected data instead of triggering a prompt.
- **Sudo / admin group.** `sudo -n true` (cached creds), membership in `admin`.
- **Setuid hunting:** `find / -perm -4000 -type f 2>/dev/null`.
## Persistence
- **LaunchAgents / LaunchDaemons (T1543.001 / T1543.004).** Drop a plist in
`~/Library/LaunchAgents` (user, no root) or `/Library/LaunchDaemons` (root,
runs as root at boot); `launchctl bootstrap gui/$(id -u) <plist>`. The classic,
noisy-but-reliable mechanism.
- **Login items (T1547.015)** via `osascript -e 'tell application "System Events"
to make login item ...'` or a Service Management (`SMAppService`) helper.
- **Dylib hijacking / proxying (T1574.004).** Find apps with a writable/missing
`@rpath` or weak-linked dylib (`otool -l <app>`); plant a malicious dylib that
re-exports the original. Survives as the host app's identity.
- **Re-opened apps / cron / emond / at** — lower-signal fallbacks.
## Defense evasion
- **Gatekeeper / quarantine (T1553.001).** Downloaded files carry the
`com.apple.quarantine` xattr; `xattr -d com.apple.quarantine <file>` (or
`xattr -c`) strips it so the binary runs without the Gatekeeper prompt.
- **Code signing (T1553).** `codesign --force --deep --sign - <bundle>` ad-hoc
signs a tampered bundle; check `codesign -dv --verbose=4` and `spctl -a -vv`.
- **File-permission/attribute manipulation (T1222.002):** `chflags`, `chmod`.
- **AppleScript / osascript execution (T1059.002)** for living-off-the-land.
## Credential access (T1555.001)
- **Keychain.** `security find-generic-password -ga <svc>` /
`security find-internet-password`; `security dump-keychain -d
~/Library/Keychains/login.keychain-db` (prompts unless unlocked). Offline:
exfil the `*.keychain-db` + the login password and crack with `chainbreaker`.
- **Browser & app secrets** under `~/Library/Application Support/...` (often
TCC-protected — see TCC abuse above).
- **Sudo/SSH keys** in `~/.ssh`, `~/.aws`, `~/.kube`.
## Collection, C2 & exfil
- Stage under `/tmp` or `~/Library/Caches`; archive with `tar`/`ditto`.
- C2: prefer signed, allow-listed channels; see `post-exploit/c2` and
`post-exploit/c2-sliver` (Sliver has a macOS implant). Beacon over HTTPS to
blend with managed-device telemetry.
## Detection & defense (blue-cell notes)
- Monitor new plists in `*/LaunchAgents` and `*/LaunchDaemons` and `launchctl`
bootstraps; alert on `xattr -d com.apple.quarantine`, ad-hoc `codesign`,
`security dump-keychain`, and TCC.db reads by non-Apple binaries.
- Endpoint Security framework (ES) + tools like santad/Objective-See catch most
of the above; LOTL via `osascript`/`launchctl` is the gap to watch.
## See also
`post-exploit/credential-access`, `post-exploit/lateral-movement`,
`post-exploit/privilege-escalation`, `shared/defense-evasion`, `reverser/ios-static`.
عرض على GitHub