performing-macos-red-teaming

name	performing-macos-red-teaming
description	Conducting red team operations against macOS fleets during authorized engagements by abusing MDM platforms (JAMF, Kandji), MDM enrollment trust, Active Directory integration, the macOS Keychain, OneLogin/SSO-linked external services, and Safari auto-open behavior to move laterally and establish command-and-control across managed Macs.
domain	cybersecurity
subdomain	macos-security
tags	["penetration-testing","macos","red-teaming"]
version	1.0
author	xalgorix
license	Apache-2.0

Performing macOS Red Teaming

When to Use

• During authorized red team engagements targeting an enterprise macOS fleet
• When the environment uses an MDM (JAMF Pro, Kandji) for device management and software distribution
• When Macs are bound to Active Directory or use SSO/OneLogin to reach external services (GitHub, AWS)
• When you have a foothold on one Mac and need to pivot, harvest credentials, or reach C2
• macOS red teaming differs from Windows: Macs are often integrated directly with external SaaS platforms

Critical: Techniques Most Often Missed

1. JAMF JSS URL hijack → turn MDM into C2

jamf reads its JSS server URL from /Library/Preferences/com.jamfsoftware.jamf.plist. A malicious package that overwrites this file can repoint the agent at an attacker-controlled listener (e.g., a Mythic/Typhon C2), turning legitimate management traffic into C2.

plutil -convert xml1 -o - /Library/Preferences/com.jamfsoftware.jamf.plist | rg jss_url
# after overwriting the URL, force a check-in:
sudo jamf policy -id 0

How to CONFIRM: read jss_url; verify jamf persists as a LaunchDaemon at /Library/LaunchAgents/com.jamf.management.agent.plist; a forced jamf policy reaches your listener.

2. Impersonating device ↔ JAMF communication

To impersonate a managed device you need the hardware UUID and the JAMF keychain holding the device cert.

ioreg -d2 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformUUID/{print $(NF-1)}'
ls -l /Library/Application\ Support/Jamf/JAMF.keychain

Build a VM with the stolen hardware UUID and SIP disabled, drop the JAMF keychain, hook the agent, and harvest its data. Note the historic jamf binary keychain secret was shared: jk23ucnq91jfu9aj.

How to CONFIRM: the keychain file exists and the UUID extracts cleanly; the cloned device authenticates to the JSS.

3. Custom-script credential leakage

JAMF stages admin "custom scripts" in /Library/Application Support/Jamf/tmp/ — placed, executed, then removed — and may pass credentials as parameters.

# monitor staged scripts (root) and process args (no root needed)
 -l /Library/Application\ Support/Jamf/tmp/
ps aux | grep -i jamf