mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-24 21:53:54 +00:00
GITBOOK-4090: change request with no subject merged in GitBook
This commit is contained in:
CPol
gitbook-bot
parent
22552ec317
commit
b57b0d67b9
5 changed files with 52 additions and 33 deletions
|
|
@ -163,8 +163,8 @@
|
|||
* [macOS IPC - Inter Process Communication](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/README.md)
|
||||
* [macOS PID Reuse](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-pid-reuse.md)
|
||||
* [macOS Thread Injection via Task port](macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.md)
|
||||
* [macOS XPC Connecting Process Check](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-xpc-connecting-process-check.md)
|
||||
* [macOS XPC Authorization](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-xpc-authorization.md)
|
||||
* [macOS XPC Connecting Process Check](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-xpc-connecting-process-check.md)
|
||||
* [macOS Electron Applications Injection](macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md)
|
||||
* [macOS Function Hooking](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-function-hooking.md)
|
||||
* [macOS .Net Applications Injection](macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md)
|
||||
|
|
|
|||
|
|
@ -12,6 +12,13 @@
|
|||
|
||||
</details>
|
||||
|
||||
## Videos
|
||||
|
||||
In the following videos you can find the techniques mentioned in this page explained more in depth:
|
||||
|
||||
* [**DEF CON 31 - Exploring Linux Memory Manipulation for Stealth and Evasion**](https://www.youtube.com/watch?v=poHirez8jk4)
|
||||
* [**Stealth intrusions with DDexec-ng & in-memory dlopen() - HackTricks Track 2023**](https://www.youtube.com/watch?v=VM\_gjjiARaU)
|
||||
|
||||
## read-only / no-exec scenario
|
||||
|
||||
It's more and more common to find linux machines mounted with **read-only (ro) file system protection**, specially in containers. This is because to run a container with ro file system is as easy as setting **`readOnlyRootFilesystem: true`** in the `securitycontext`:
|
||||
|
|
|
|||
|
|
@ -53,27 +53,6 @@ For these predefined services, the **lookup process differs slightly**. When a s
|
|||
|
||||
However, this process only applies to predefined system tasks. Non-system tasks still operate as described originally, which could potentially allow for impersonation.
|
||||
|
||||
### Mach Services
|
||||
|
||||
The names specified in the applications located in the previous mentioned SIP protected directories cannot be registered by other processes.
|
||||
|
||||
For example, `/System/Library/LaunchAgents/com.apple.xpc.loginitemregisterd.plist` registers the name `com.apple.xpc.loginitemregisterd`:
|
||||
|
||||
```json
|
||||
plutil -p com.apple.xpc.loginitemregisterd.plist
|
||||
{
|
||||
"EnablePressuredExit" => 1
|
||||
"Label" => "com.apple.xpc.loginitemregisterd"
|
||||
"MachServices" => {
|
||||
"com.apple.xpc.loginitemregisterd" => 1
|
||||
}
|
||||
"ProcessType" => "Adaptive"
|
||||
"Program" => "/usr/libexec/loginitemregisterd"
|
||||
}
|
||||
```
|
||||
|
||||
If you try to register it with a code such as the following, you won't be able to.
|
||||
|
||||
### Code example
|
||||
|
||||
Note how the **sender** **allocates** a port, create a **send right** for the name `org.darlinghq.example` and send it to the **bootstrap server** while the sender asked for the **send right** of that name and used it to **send a message**.
|
||||
|
|
@ -799,15 +778,13 @@ The primary benefits of XPC include:
|
|||
2. **Stability**: XPC helps isolate crashes to the component where they occur. If a process crashes, it can be restarted without affecting the rest of the system.
|
||||
3. **Performance**: XPC allows for easy concurrency, as different tasks can be run simultaneously in different processes.
|
||||
|
||||
The only **drawback** is that **separating an application is several processes** making them communicate via XPC is **less efficient**. But in todays systems this isn't almost noticeable and the benefits are much better.
|
||||
|
||||
An example can be seen in QuickTime Player, where a component using XPC is responsible for video decoding. The component is specifically designed to perform computational tasks, thus, in the event of a breach, it wouldn't provide any useful gains to the attacker, such as access to files or the network.
|
||||
The only **drawback** is that **separating an application in several processes** making them communicate via XPC is **less efficient**. But in todays systems this isn't almost noticeable and the benefits are better.
|
||||
|
||||
### Application Specific XPC services
|
||||
|
||||
The XPC components of an applications are **inside the application itself.** For example, in Safari you can find them in **`/Applications/Safari.app/Contents/XPCServices`**. They have extension **`.xpc`** (like **`com.apple.Safari.SandboxBroker.xpc`**) and are **also bundles** with the main binary inside of it: `/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker`
|
||||
The XPC components of an application are **inside the application itself.** For example, in Safari you can find them in **`/Applications/Safari.app/Contents/XPCServices`**. They have extension **`.xpc`** (like **`com.apple.Safari.SandboxBroker.xpc`**) and are **also bundles** with the main binary inside of it: `/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker` and an `Info.plist: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/Info.plist`
|
||||
|
||||
As you might be thinking a **XPC component will have different entitlements and privileges** than the other XPC components or the main app binary. EXCEPT if an XPC service is configured with [**JoinExistingSession**](https://developer.apple.com/documentation/bundleresources/information\_property\_list/xpcservice/joinexistingsession) set to “True” in its **Info.plist** file. In this case, the XPC service will run in the same security session as the application that called it.
|
||||
As you might be thinking a **XPC component will have different entitlements and privileges** than the other XPC components or the main app binary. EXCEPT if a XPC service is configured with [**JoinExistingSession**](https://developer.apple.com/documentation/bundleresources/information\_property\_list/xpcservice/joinexistingsession) set to “True” in its **Info.plist** file. In this case, the XPC service will run in the **same security session as the application** that called it.
|
||||
|
||||
XPC services are **started** by **launchd** when required and **shut down** once all tasks are **complete** to free system resources. **Application-specific XPC components can only be utilized by the application**, thereby reducing the risk associated with potential vulnerabilities.
|
||||
|
||||
|
|
@ -1087,7 +1064,7 @@ int main(void) {
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="Untitled" %}
|
||||
{% tab title="xyz.hacktricks.svcoc.plist" %}
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ Apple also proposes another way to authenticate if the connecting process has **
|
|||
|
||||
When an application needs to **execute actions as a privileged user**, instead of running the app as a privileged user it usually installs as root a HelperTool as an XPC service that could be called from the app to perform those actions. However, the app calling the service should have enough authorization.
|
||||
|
||||
### ShuoldAcceptNewConnection always YES
|
||||
### ShouldAcceptNewConnection always YES
|
||||
|
||||
An example could be found in [EvenBetterAuthorizationSample](https://github.com/brenwell/EvenBetterAuthorizationSample). In `App/AppDelegate.m` it tries to **connect** to the **HelperTool**. And in `HelperTool/HelperTool.m` the function **`shouldAcceptNewConnection`** **won't check** any of the requirements indicated previously. It'll always return YES:
|
||||
|
||||
|
|
@ -268,6 +268,34 @@ Then, you can read who can access the right with:
|
|||
security authorizationdb read com.apple.safaridriver.allow
|
||||
```
|
||||
|
||||
### Permissive rights
|
||||
|
||||
You can find **all the permissions configurations** [**in here**](https://www.dssw.co.uk/reference/authorization-rights/), but the combinations that won't require user interaction would be:
|
||||
|
||||
1. **'authenticate-user': 'false'**
|
||||
* This is the most direct key. If set to `false`, it specifies that a user does not need to provide authentication to gain this right.
|
||||
* Ths is used in **combination with one of the 2 below or indicating a group** the user must belongs to.
|
||||
2. **'allow-root': 'true'**
|
||||
* If a user is operating as the root user (which has elevated permissions), and this key is set to `true`, the root user could potentially gain this right without further authentication. However, typically, getting to a root user status already requires authentication, so this isn't a "no authentication" scenario for most users.
|
||||
3. **'session-owner': 'true'**
|
||||
* If set to `true`, the owner of the session (the currently logged-in user) would automatically get this right. This might bypass additional authentication if the user is already logged in.
|
||||
4. **'shared': 'true'**
|
||||
* This key doesn't grant rights without authentication. Instead, if set to `true`, it means that once the right has been authenticated, it can be shared among multiple processes without each one needing to re-authenticate. But the initial granting of the right would still require authentication unless combined with other keys like `'authenticate-user': 'false'`.
|
||||
|
||||
You can [**use this script**](https://gist.github.com/carlospolop/96ecb9e385a4667b9e40b24e878652f9) to get the interesting rights:
|
||||
|
||||
```
|
||||
Rights with 'authenticate-user': 'false':
|
||||
is-admin (admin), is-admin-nonshared (admin), is-appstore (_appstore), is-developer (_developer), is-lpadmin (_lpadmin), is-root (run as root), is-session-owner (session owner), is-webdeveloper (_webdeveloper), system-identity-write-self (session owner), system-install-iap-software (run as root), system-install-software-iap (run as root)
|
||||
|
||||
Rights with 'allow-root': 'true':
|
||||
com-apple-aosnotification-findmymac-remove, com-apple-diskmanagement-reservekek, com-apple-openscripting-additions-send, com-apple-reportpanic-fixright, com-apple-servicemanagement-blesshelper, com-apple-xtype-fontmover-install, com-apple-xtype-fontmover-remove, com-apple-dt-instruments-process-analysis, com-apple-dt-instruments-process-kill, com-apple-pcastagentconfigd-wildcard, com-apple-trust-settings-admin, com-apple-wifivelocity, com-apple-wireless-diagnostics, is-root, system-install-iap-software, system-install-software, system-install-software-iap, system-preferences, system-preferences-accounts, system-preferences-datetime, system-preferences-energysaver, system-preferences-network, system-preferences-printing, system-preferences-security, system-preferences-sharing, system-preferences-softwareupdate, system-preferences-startupdisk, system-preferences-timemachine, system-print-operator, system-privilege-admin, system-services-networkextension-filtering, system-services-networkextension-vpn, system-services-systemconfiguration-network, system-sharepoints-wildcard
|
||||
|
||||
|
||||
Rights with 'session-owner': 'true':
|
||||
authenticate-session-owner, authenticate-session-owner-or-admin, authenticate-session-user, com-apple-safari-allow-apple-events-to-run-javascript, com-apple-safari-allow-javascript-in-smart-search-field, com-apple-safari-allow-unsigned-app-extensions, com-apple-safari-install-ephemeral-extensions, com-apple-safari-show-credit-card-numbers, com-apple-safari-show-passwords, com-apple-icloud-passwordreset, com-apple-icloud-passwordreset, is-session-owner, system-identity-write-self, use-login-window-ui
|
||||
```
|
||||
|
||||
<details>
|
||||
|
||||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||
|
|
|
|||
|
|
@ -21,10 +21,13 @@ When a connection is stablished to an XPC service, the server will check if the
|
|||
2. Check if the connecting process is signed with the **organization’s certificate**, (team ID verification).
|
||||
* If this **isn't verified**, **any developer certificate** from Apple can be used for signing, and connect to the service.
|
||||
3. Check if the connecting process **contains a proper bundle ID**.
|
||||
4. Check if the connecting process has a **proper software version number**.
|
||||
* If this **isn't verified**, any tool **signed by the same org** could be used to interact with the XPC service.
|
||||
4. (4 or 5) Check if the connecting process has a **proper software version number**.
|
||||
* If this **isn't verified,** an old, insecure clients, vulnerable to process injection could be used to connect to the XPC service even with the other checks in place.
|
||||
5. Check if the connecting process has an **entitlement** that allows it to connect to the service. This is applicable for Apple binaries.
|
||||
6. The **verification** must be **based** on the connecting **client’s audit token** **instead** of its process ID (**PID**) since the former prevents PID reuse attacks.
|
||||
5. (4 or 5) Check if the connecting process has hardened runtime without dangerous entitlements (like the ones that allows to load arbitrary libraries or use DYLD env vars)
|
||||
1. If this **isn't verified,** the client might be **vulnerable to code injection**
|
||||
6. Check if the connecting process has an **entitlement** that allows it to connect to the service. This is applicable for Apple binaries.
|
||||
7. The **verification** must be **based** on the connecting **client’s audit token** **instead** of its process ID (**PID**) since the former prevents PID reuse attacks.
|
||||
* Developers rarely use the audit token API call since it’s **private**, so Apple could **change** at any time. Additionally, private API usage is not allowed in Mac App Store apps.
|
||||
|
||||
For more information about the PID reuse attack check:
|
||||
|
|
@ -66,9 +69,13 @@ NSString requirementString = @"anchor apple generic and identifier \"xyz.hacktri
|
|||
- Check the version used
|
||||
*/
|
||||
|
||||
// Check the requirements
|
||||
// Check the requirements with the PID (vulnerable)
|
||||
SecRequirementCreateWithString(requirementString, kSecCSDefaultFlags, &requirementRef);
|
||||
SecCodeCheckValidity(code, kSecCSDefaultFlags, requirementRef);
|
||||
|
||||
// Check the requirements wuing the auditToken (secure)
|
||||
SecTaskRef taskRef = SecTaskCreateWithAuditToken(NULL, ((ExtendedNSXPCConnection*)newConnection).auditToken);
|
||||
SecTaskValidateForRequirement(taskRef, (__bridge CFStringRef)(requirementString))
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue