mig_external boolean_t myipc_server
- (mach_msg_header_t *InHeadP, mach_msg_header_t *OutHeadP)
-{
- /*
- * typedef struct {
- * mach_msg_header_t Head;
- * NDR_record_t NDR;
- * kern_return_t RetCode;
- * } mig_reply_error_t;
- */
-
- mig_routine_t routine;
-
- OutHeadP->msgh_bits = MACH_MSGH_BITS(MACH_MSGH_BITS_REPLY(InHeadP->msgh_bits), 0);
- OutHeadP->msgh_remote_port = InHeadP->msgh_reply_port;
- /* Minimal size: routine() will update it if different */
- OutHeadP->msgh_size = (mach_msg_size_t)sizeof(mig_reply_error_t);
- OutHeadP->msgh_local_port = MACH_PORT_NULL;
- OutHeadP->msgh_id = InHeadP->msgh_id + 100;
- OutHeadP->msgh_reserved = 0;
-
- if ((InHeadP->msgh_id > 500) || (InHeadP->msgh_id < 500) ||
- ((routine = SERVERPREFmyipc_subsystem.routine[InHeadP->msgh_id - 500].stub_routine) == 0)) {
- ((mig_reply_error_t *)OutHeadP)->NDR = NDR_record;
- ((mig_reply_error_t *)OutHeadP)->RetCode = MIG_BAD_ID;
- return FALSE;
- }
- (*routine) (InHeadP, OutHeadP);
- return TRUE;
-}
-int _myipc_server(int arg0, int arg1) {
- var_10 = arg0;
- var_18 = arg1;
- // Initial instructions to find the proper function ponters
- *(int32_t *)var_18 = *(int32_t *)var_10 & 0x1f;
- *(int32_t *)(var_18 + 0x8) = *(int32_t *)(var_10 + 0x8);
- *(int32_t *)(var_18 + 0x4) = 0x24;
- *(int32_t *)(var_18 + 0xc) = 0x0;
- *(int32_t *)(var_18 + 0x14) = *(int32_t *)(var_10 + 0x14) + 0x64;
- *(int32_t *)(var_18 + 0x10) = 0x0;
- if (*(int32_t *)(var_10 + 0x14) <= 0x1f4 && *(int32_t *)(var_10 + 0x14) >= 0x1f4) {
- rax = *(int32_t *)(var_10 + 0x14);
- // Call to sign_extend_64 that can help to identifyf this function
- // This stores in rax the pointer to the call that needs to be called
- // Check the used of the address 0x100004040 (functions addresses array)
- // 0x1f4 = 500 (the strating ID)
- rax = *(sign_extend_64(rax - 0x1f4) * 0x28 + 0x100004040);
- var_20 = rax;
- // If - else, the if returns false, while the else call the correct function and returns true
- if (rax == 0x0) {
- *(var_18 + 0x18) = **_NDR_record;
- *(int32_t *)(var_18 + 0x20) = 0xfffffffffffffed1;
- var_4 = 0x0;
- }
- else {
- // Calculated address that calls the proper function with 2 arguments
- (var_20)(var_10, var_18);
- var_4 = 0x1;
- }
- }
- else {
- *(var_18 + 0x18) = **_NDR_record;
- *(int32_t *)(var_18 + 0x20) = 0xfffffffffffffed1;
- var_4 = 0x0;
- }
- rax = var_4;
- return rax;
-}
-int _myipc_server(int arg0, int arg1) {
- r31 = r31 - 0x40;
- saved_fp = r29;
- stack[-8] = r30;
- var_10 = arg0;
- var_18 = arg1;
- // Initial instructions to find the proper function ponters
- *(int32_t *)var_18 = *(int32_t *)var_10 & 0x1f | 0x0;
- *(int32_t *)(var_18 + 0x8) = *(int32_t *)(var_10 + 0x8);
- *(int32_t *)(var_18 + 0x4) = 0x24;
- *(int32_t *)(var_18 + 0xc) = 0x0;
- *(int32_t *)(var_18 + 0x14) = *(int32_t *)(var_10 + 0x14) + 0x64;
- *(int32_t *)(var_18 + 0x10) = 0x0;
- r8 = *(int32_t *)(var_10 + 0x14);
- r8 = r8 - 0x1f4;
- if (r8 > 0x0) {
- if (CPU_FLAGS & G) {
- r8 = 0x1;
- }
- }
- if ((r8 & 0x1) == 0x0) {
- r8 = *(int32_t *)(var_10 + 0x14);
- r8 = r8 - 0x1f4;
- if (r8 < 0x0) {
- if (CPU_FLAGS & L) {
- r8 = 0x1;
- }
- }
- if ((r8 & 0x1) == 0x0) {
- r8 = *(int32_t *)(var_10 + 0x14);
- // 0x1f4 = 500 (the strating ID)
- r8 = r8 - 0x1f4;
- asm { smaddl x8, w8, w9, x10 };
- r8 = *(r8 + 0x8);
- var_20 = r8;
- r8 = r8 - 0x0;
- if (r8 != 0x0) {
- if (CPU_FLAGS & NE) {
- r8 = 0x1;
- }
- }
- // Same if else as in the previous version
- // Check the used of the address 0x100004040 (functions addresses array)
- if ((r8 & 0x1) == 0x0) {
- *(var_18 + 0x18) = **0x100004000;
- *(int32_t *)(var_18 + 0x20) = 0xfffffed1;
- var_4 = 0x0;
- }
- else {
- // Call to the calculated address where the function should be
- (var_20)(var_10, var_18);
- var_4 = 0x1;
- }
- }
- else {
- *(var_18 + 0x18) = **0x100004000;
- *(int32_t *)(var_18 + 0x20) = 0xfffffed1;
- var_4 = 0x0;
- }
- }
- else {
- *(var_18 + 0x18) = **0x100004000;
- *(int32_t *)(var_18 + 0x20) = 0xfffffed1;
- var_4 = 0x0;
- }
- r0 = var_4;
- return r0;
-}
-
-
.png)
+
+
+
+MIG was created to **simplify the process of Mach IPC** code creation. It basically **generates the needed code** for server and client to communicate with a given definition. Even if the generated code is ugly, a developer will just need to import it and his code will be much simpler than before.
+
+### Example
+
+Create a definition file, in this case with a very simple function:
+
+{% code title="myipc.defs" %}
+```cpp
+subsystem myipc 500; // Arbitrary name and id
+
+userprefix USERPREF; // Prefix for created functions in the client
+serverprefix SERVERPREF; // Prefix for created functions in the server
+
+#include ☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
+ +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +mig_external boolean_t myipc_server
+ (mach_msg_header_t *InHeadP, mach_msg_header_t *OutHeadP)
+{
+ /*
+ * typedef struct {
+ * mach_msg_header_t Head;
+ * NDR_record_t NDR;
+ * kern_return_t RetCode;
+ * } mig_reply_error_t;
+ */
+
+ mig_routine_t routine;
+
+ OutHeadP->msgh_bits = MACH_MSGH_BITS(MACH_MSGH_BITS_REPLY(InHeadP->msgh_bits), 0);
+ OutHeadP->msgh_remote_port = InHeadP->msgh_reply_port;
+ /* Minimal size: routine() will update it if different */
+ OutHeadP->msgh_size = (mach_msg_size_t)sizeof(mig_reply_error_t);
+ OutHeadP->msgh_local_port = MACH_PORT_NULL;
+ OutHeadP->msgh_id = InHeadP->msgh_id + 100;
+ OutHeadP->msgh_reserved = 0;
+
+ if ((InHeadP->msgh_id > 500) || (InHeadP->msgh_id < 500) ||
+ ((routine = SERVERPREFmyipc_subsystem.routine[InHeadP->msgh_id - 500].stub_routine) == 0)) {
+ ((mig_reply_error_t *)OutHeadP)->NDR = NDR_record;
+ ((mig_reply_error_t *)OutHeadP)->RetCode = MIG_BAD_ID;
+ return FALSE;
+ }
+ (*routine) (InHeadP, OutHeadP);
+ return TRUE;
+}
+int _myipc_server(int arg0, int arg1) {
+ var_10 = arg0;
+ var_18 = arg1;
+ // Initial instructions to find the proper function ponters
+ *(int32_t *)var_18 = *(int32_t *)var_10 & 0x1f;
+ *(int32_t *)(var_18 + 0x8) = *(int32_t *)(var_10 + 0x8);
+ *(int32_t *)(var_18 + 0x4) = 0x24;
+ *(int32_t *)(var_18 + 0xc) = 0x0;
+ *(int32_t *)(var_18 + 0x14) = *(int32_t *)(var_10 + 0x14) + 0x64;
+ *(int32_t *)(var_18 + 0x10) = 0x0;
+ if (*(int32_t *)(var_10 + 0x14) <= 0x1f4 && *(int32_t *)(var_10 + 0x14) >= 0x1f4) {
+ rax = *(int32_t *)(var_10 + 0x14);
+ // Call to sign_extend_64 that can help to identifyf this function
+ // This stores in rax the pointer to the call that needs to be called
+ // Check the used of the address 0x100004040 (functions addresses array)
+ // 0x1f4 = 500 (the strating ID)
+ rax = *(sign_extend_64(rax - 0x1f4) * 0x28 + 0x100004040);
+ var_20 = rax;
+ // If - else, the if returns false, while the else call the correct function and returns true
+ if (rax == 0x0) {
+ *(var_18 + 0x18) = **_NDR_record;
+ *(int32_t *)(var_18 + 0x20) = 0xfffffffffffffed1;
+ var_4 = 0x0;
+ }
+ else {
+ // Calculated address that calls the proper function with 2 arguments
+ (var_20)(var_10, var_18);
+ var_4 = 0x1;
+ }
+ }
+ else {
+ *(var_18 + 0x18) = **_NDR_record;
+ *(int32_t *)(var_18 + 0x20) = 0xfffffffffffffed1;
+ var_4 = 0x0;
+ }
+ rax = var_4;
+ return rax;
+}
+int _myipc_server(int arg0, int arg1) {
+ r31 = r31 - 0x40;
+ saved_fp = r29;
+ stack[-8] = r30;
+ var_10 = arg0;
+ var_18 = arg1;
+ // Initial instructions to find the proper function ponters
+ *(int32_t *)var_18 = *(int32_t *)var_10 & 0x1f | 0x0;
+ *(int32_t *)(var_18 + 0x8) = *(int32_t *)(var_10 + 0x8);
+ *(int32_t *)(var_18 + 0x4) = 0x24;
+ *(int32_t *)(var_18 + 0xc) = 0x0;
+ *(int32_t *)(var_18 + 0x14) = *(int32_t *)(var_10 + 0x14) + 0x64;
+ *(int32_t *)(var_18 + 0x10) = 0x0;
+ r8 = *(int32_t *)(var_10 + 0x14);
+ r8 = r8 - 0x1f4;
+ if (r8 > 0x0) {
+ if (CPU_FLAGS & G) {
+ r8 = 0x1;
+ }
+ }
+ if ((r8 & 0x1) == 0x0) {
+ r8 = *(int32_t *)(var_10 + 0x14);
+ r8 = r8 - 0x1f4;
+ if (r8 < 0x0) {
+ if (CPU_FLAGS & L) {
+ r8 = 0x1;
+ }
+ }
+ if ((r8 & 0x1) == 0x0) {
+ r8 = *(int32_t *)(var_10 + 0x14);
+ // 0x1f4 = 500 (the strating ID)
+ r8 = r8 - 0x1f4;
+ asm { smaddl x8, w8, w9, x10 };
+ r8 = *(r8 + 0x8);
+ var_20 = r8;
+ r8 = r8 - 0x0;
+ if (r8 != 0x0) {
+ if (CPU_FLAGS & NE) {
+ r8 = 0x1;
+ }
+ }
+ // Same if else as in the previous version
+ // Check the used of the address 0x100004040 (functions addresses array)
+ if ((r8 & 0x1) == 0x0) {
+ *(var_18 + 0x18) = **0x100004000;
+ *(int32_t *)(var_18 + 0x20) = 0xfffffed1;
+ var_4 = 0x0;
+ }
+ else {
+ // Call to the calculated address where the function should be
+ (var_20)(var_10, var_18);
+ var_4 = 0x1;
+ }
+ }
+ else {
+ *(var_18 + 0x18) = **0x100004000;
+ *(int32_t *)(var_18 + 0x20) = 0xfffffed1;
+ var_4 = 0x0;
+ }
+ }
+ else {
+ *(var_18 + 0x18) = **0x100004000;
+ *(int32_t *)(var_18 + 0x20) = 0xfffffed1;
+ var_4 = 0x0;
+ }
+ r0 = var_4;
+ return r0;
+}
+
+
+
+
diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/README.md b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/README.md
new file mode 100644
index 000000000..0a98c7df9
--- /dev/null
+++ b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/README.md
@@ -0,0 +1,403 @@
+# macOS XPC
+
+☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
+ +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +
+
+
+
+## Basic Information
+
+XPC, which stands for XNU (the kernel used by macOS) inter-Process Communication, is a framework for **communication between processes** on macOS and iOS. XPC provides a mechanism for making **safe, asynchronous method calls between different processes** on the system. It's a part of Apple's security paradigm, allowing for the **creation of privilege-separated applications** where each **component** runs with **only the permissions it needs** to do its job, thereby limiting the potential damage from a compromised process.
+
+XPC uses a form of Inter-Process Communication (IPC), which is a set of methods for different programs running on the same system to send data back and forth.
+
+The primary benefits of XPC include:
+
+1. **Security**: By separating work into different processes, each process can be granted only the permissions it needs. This means that even if a process is compromised, it has limited ability to do harm.
+2. **Stability**: XPC helps isolate crashes to the component where they occur. If a process crashes, it can be restarted without affecting the rest of the system.
+3. **Performance**: XPC allows for easy concurrency, as different tasks can be run simultaneously in different processes.
+
+The only **drawback** is that **separating an application in several processes** making them communicate via XPC is **less efficient**. But in todays systems this isn't almost noticeable and the benefits are better.
+
+## Application Specific XPC services
+
+The XPC components of an application are **inside the application itself.** For example, in Safari you can find them in **`/Applications/Safari.app/Contents/XPCServices`**. They have extension **`.xpc`** (like **`com.apple.Safari.SandboxBroker.xpc`**) and are **also bundles** with the main binary inside of it: `/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker` and an `Info.plist: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/Info.plist`
+
+As you might be thinking a **XPC component will have different entitlements and privileges** than the other XPC components or the main app binary. EXCEPT if a XPC service is configured with [**JoinExistingSession**](https://developer.apple.com/documentation/bundleresources/information\_property\_list/xpcservice/joinexistingsession) set to “True” in its **Info.plist** file. In this case, the XPC service will run in the **same security session as the application** that called it.
+
+XPC services are **started** by **launchd** when required and **shut down** once all tasks are **complete** to free system resources. **Application-specific XPC components can only be utilized by the application**, thereby reducing the risk associated with potential vulnerabilities.
+
+## System Wide XPC services
+
+System-wide XPC services are accessible to all users. These services, either launchd or Mach-type, need to be **defined in plist** files located in specified directories such as **`/System/Library/LaunchDaemons`**, **`/Library/LaunchDaemons`**, **`/System/Library/LaunchAgents`**, or **`/Library/LaunchAgents`**.
+
+These plists files will have a key called **`MachServices`** with the name of the service, and a key called **`Program`** with the path to the binary:
+
+```xml
+cat /Library/LaunchDaemons/com.jamf.management.daemon.plist
+
+
+
+☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
+ +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +
+
+
diff --git a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-xpc-authorization.md b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.md
similarity index 98%
rename from macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-xpc-authorization.md
rename to macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.md
index 5e21dcea7..5edc84714 100644
--- a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-xpc-authorization.md
+++ b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.md
@@ -302,7 +302,7 @@ authenticate-session-owner, authenticate-session-owner-or-admin, authenticate-se
If you find the function: **`[HelperTool checkAuthorization:command:]`** it's probably the the process is using the previously mentioned schema for authorization:
-☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
+ +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + + (1) (1).png)
 (1) (1).png)
 (1).png)
 (1).png)
.png)
.png)