diff --git a/.gitbook/assets/Pasted Graphic 5.png b/.gitbook/assets/Pasted Graphic 5.png new file mode 100644 index 000000000..af32ff864 Binary files /dev/null and b/.gitbook/assets/Pasted Graphic 5.png differ diff --git a/.gitbook/assets/Pasted Graphic.png b/.gitbook/assets/Pasted Graphic.png new file mode 100644 index 000000000..50ee5e9f3 Binary files /dev/null and b/.gitbook/assets/Pasted Graphic.png differ diff --git a/SUMMARY.md b/SUMMARY.md index 6a9ad9019..fc195af92 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -151,6 +151,7 @@ * [macOS File Extension Apps](macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.md) * [macOS Files, Folders, Binaries & Memory](macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md) * [macOS Bundles](macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.md) + * [macOS Installer Packages (pkg)](macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installer-packages-pkg.md) * [macOS Memory Dumping](macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.md) * [macOS Sensitive Locations](macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.md) * [macOS Universal binaries & Mach-O Format](macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md) diff --git a/macos-hardening/macos-security-and-privilege-escalation/README.md b/macos-hardening/macos-security-and-privilege-escalation/README.md index 77934e566..174826cf0 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/README.md @@ -90,6 +90,12 @@ This could occur in the following situations: Being able to **create a file** that is going to be **used by root**, allows a user to **take advantage of its content** or even create **symlinks/hardlinks** to point it to another place. +For this kind of vulnerabilities don't forget to **check vulnerable `.pkg` installers**: + +{% content-ref url="macos-files-folders-and-binaries/macos-installer-packages-pkg.md" %} +[macos-installer-packages-pkg.md](macos-files-folders-and-binaries/macos-installer-packages-pkg.md) +{% endcontent-ref %} + ### Entitlements and Privileges abuse via process abuse If a process can **inject code in another process with better privileges or entitlements** or contact it to perform privileges actions, he could escalate privileges and bypass defensive meassures such as [Sandbox](macos-security-protections/macos-sandbox/) or [TCC](macos-security-protections/macos-tcc/). diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md b/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md index 8800f3608..60e51ae56 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/README.md @@ -49,6 +49,12 @@ MacOS stores information such as passwords in several places: [macos-sensitive-locations.md](macos-sensitive-locations.md) {% endcontent-ref %} +### Vulnerable pkg installers + +{% content-ref url="macos-installer-packages-pkg.md" %} +[macos-installer-packages-pkg.md](macos-installer-packages-pkg.md) +{% endcontent-ref %} + ## OS X Specific Extensions * **`.dmg`**: Apple Disk Image files are very frequent for installers. diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installer-packages-pkg.md b/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installer-packages-pkg.md new file mode 100644 index 000000000..44d747b3e --- /dev/null +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installer-packages-pkg.md @@ -0,0 +1,69 @@ +# macOS Installer Packages (pkg) + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - πŸŽ™οΈ Twitch πŸŽ™οΈ - πŸŽ₯ Youtube πŸŽ₯ + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +
+ +## Basic Information + +A macOS installer package (also known as a `.pkg` file) is a file format used by macOS to **distribute software**. These files are like a **box that contains everything a piece of software** needs to install and run correctly. + +The package file itself is an archive that holds a **hierarchy of files and directories that will be installed on the target** computer. It can also include **scripts** to perform tasks before and after the installation, like setting up configuration files or cleaning up old versions of the software. + +### Hierarchy + +
+ +* **Distribution (xml)**: Customizations (title, welcome text…) and script/installation checks +* **PackageInfo (xml)**: Info, install requirements, install location, paths to scripts to run +* **Bill of materials (bom)**: List of files to install, update or remove with file permissions +* **Payload (CPIO archive gzip compresses)**: Files to install in the `install-location` from PackageInfo +* **Scripts (CPIO archive gzip compressed)**: Pre and post install scripts and more resources extracted to a temp directory for execution. + +### Decompress + +```bash +# Tool to directly get the files inside a package +pkgutil β€”expand "/path/to/package.pkg" "/path/to/out/dir" + +# Get the files ina. more manual way +mkdir -p "/path/to/out/dir" +cd "/path/to/out/dir" +xar -xf "/path/to/package.pkg" + +# Decompress also the CPIO gzip compressed ones +cat Scripts | gzip -dc | cpio -i +cpio -i < Scripts +``` + +## Privesc via pkg abuse + +### Execution from public directories + +If a pre or post installation script is for example executing from **`/var/tmp/Installerutil`**, and attacker could control that script so he escalate privileges whenever it's executed. Or another similar example: + +
+ +## References + +* [https://www.youtube.com/watch?v=iASSG0\_zobQ](https://www.youtube.com/watch?v=iASSG0\_zobQ) + +
+ +☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - πŸŽ™οΈ Twitch πŸŽ™οΈ - πŸŽ₯ Youtube πŸŽ₯ + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud). + +