macos-post-exploitation

# macOS post-exploitation Post-compromise operations on Apple/macOS endpoints. Apple's controls (TCC, Gatekeeper/quarantine, SIP, code signing, AMFI) shape every step, so the playbook is organized around defeating or living within them. Prefer on-host built-ins (`launchctl`, `security`, `sqlite3`, `dscl`, `system_profiler`, `codesign`, `xattr`) over dropped tooling for OPSEC. > Authorized engagements only. Stay within RoE scope; emulate destructive > actions as benign proofs unless explicitly authorized. ## Discovery (T1087.001 / T1518 / T1647) - `system_profiler SPSoftwareDataType SPHardwareDataType` — OS build, model, SIP. - `csrutil status` — System Integrity Protection on/off. - `dscl . -list /Users | grep -v '^_'` — local accounts; `id`, `groups`. - `sw_vers`, `profiles status -type enrollment` — MDM/Jamf managed? (T1647 plist prefs). - Installed security tooling: `ls /Library/Objective-See`, `pgrep -l 'CrowdStrike|SentinelOne|falcon|Jamf|santad'`. ## Privilege escalation - **TCC bypass / abuse (T1548 family).** TCC gates access to Documents, Desktop, Downloads, camera/mic, Full Disk Access. Check `sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'` (user) and `/Library/Application Support/com.apple.TCC/TCC.db` (system, needs root). Abuse an already-FDA-granted app (e.g. a terminal/Electron app) to read protected data instead of triggering a prompt. - **Sudo / admin group.** `sudo -n true` (cached creds), membership in `admin`. - **Setuid hunting:** `find / -perm -4000 -type f 2>/dev/null`. ## Persistence - **LaunchAgents / LaunchDaemons (T1543.001 / T1543.004).** Drop a plist in `~/Library/LaunchAgents` (user, no root) or `/Library/LaunchDaemons` (root, runs as root at boot); `launchctl bootstrap gui/$(id -u) <plist>`. The classic, noisy-but-reliable mechanism. - **Login items (T1547.015)** via `osascript -e 'tell application "System Events" to make login item ...'` or a Service Management (`SMAppService`) helper. - **Dylib hijacking / proxying (T1574.004).** Find apps with a writable/missing `@rpath` or weak-linked dylib (`otool -l <app>`); plant a malicious dylib that re-exports the original. Survives as the host app's identity. - **Re-opened apps / cron / emond / at** — lower-signal fallbacks. ## Defense evasion - **Gatekeeper / quarantine (T1553.001).** Downloaded files carry the `com.apple.quarantine` xattr; `xattr -d com.apple.quarantine <file>` (or `xattr -c`) strips it so the binary runs without the Gatekeeper prompt. - **Code signing (T1553).** `codesign --force --deep --sign - <bundle>` ad-hoc signs a tampered bundle; check `codesign -dv --verbose=4` and `spctl -a -vv`. - **File-permission/attribute manipulation (T1222.002):** `chflags`, `chmod`. - **AppleScript / osascript execution (T1059.002)** for living-off-the-land. ## Credential access (T1555.001) - **Keychain.** `security find-generic-password -ga <svc>` / `security find-internet-password`; `security dump-keychain -d ~/Library/Keychains/login.keychain-db` (prompts unless unlocked). Offline: exfil the `*.keychain-db` + the login password and crack with `chainbreaker`. - **Browser & app secrets** under `~/Library/Application Support/...` (often TCC-protected — see TCC abuse above). - **Sudo/SSH keys** in `~/.ssh`, `~/.aws`, `~/.kube`. ## Collection, C2 & exfil - Stage under `/tmp` or `~/Library/Caches`; archive with `tar`/`ditto`. - C2: prefer signed, allow-listed channels; see `post-exploit/c2` and `post-exploit/c2-sliver` (Sliver has a macOS implant). Beacon over HTTPS to blend with managed-device telemetry. ## Detection & defense (blue-cell notes) - Monitor new plists in `*/LaunchAgents` and `*/LaunchDaemons` and `launchctl` bootstraps; alert on `xattr -d com.apple.quarantine`, ad-hoc `codesign`, `security dump-keychain`, and TCC.db reads by non-Apple binaries. - Endpoint Security framework (ES) + tools like santad/Objective-See catch most of the above; LOTL via `osascript`/`launchctl` is the gap to watch. ## See also `post-exploit/credential-access`, `post-exploit/lateral-movement`, `post-exploit/privilege-escalation`, `shared/defense-evasion`, `reverser/ios-static`.