GITBOOK-3986: change request with no subject merged in GitBook

generic-methodologies-and-resources/pentesting-network/eigrp-attacks.md

@@ -149,7 +149,7 @@ As you can see, the host loses connectivity to host **172.16.100.140/32** due to
 
 To establish EIGRP neighbors, **routers use special K-values.** They must be the same among all EIGRP neighbors. If at least one K-value does not match, the EIGRP domain will crash and the neighborhood will be broken. We will use [**relationshipnightmare.py**](https://github.com/in9uz/EIGRPWN/blob/main/relationshipnightmare.py) \*\*\*\* to perform this attack\*\*.\*\*
 
-<figure><img src="../../.gitbook/assets/image (12) (2).png" alt=""><figcaption></figcaption></figure>
+<figure><img src="../../.gitbook/assets/image (12) (2) (1).png" alt=""><figcaption></figcaption></figure>
 
 Script arguments:
 

macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md

@@ -12,9 +12,9 @@
 
 </details>
 
-## Basic Information
+## Pkg Basic Information
 
-A macOS installer package (also known as a `.pkg` file) is a file format used by macOS to **distribute software**. These files are like a **box that contains everything a piece of software** needs to install and run correctly.
+A macOS **installer package** (also known as a `.pkg` file) is a file format used by macOS to **distribute software**. These files are like a **box that contains everything a piece of software** needs to install and run correctly.
 
 The package file itself is an archive that holds a **hierarchy of files and directories that will be installed on the target** computer. It can also include **scripts** to perform tasks before and after the installation, like setting up configuration files or cleaning up old versions of the software.
 
@@ -44,6 +44,20 @@ cat Scripts | gzip -dc | cpio -i
 cpio -i < Scripts
 ```
 
+## DMG Basic Information
+
+DMG files, or Apple Disk Images, are a file format used by Apple's macOS for disk images. A DMG file is essentially a **mountable disk image** (it contains its own filesystem) that contains raw block data typically compressed and sometimes encrypted. When you open a DMG file, macOS **mounts it as if it were a physical disk**, allowing you to access its contents.
+
+### Hierarchy
+
+<figure><img src="../../../.gitbook/assets/image (12).png" alt=""><figcaption></figcaption></figure>
+
+The hierarchy of a DMG file can be different based on the content. However, for application DMGs, it usually follows this structure:
+
+* Top Level: This is the root of the disk image. It often contains the application and possibly a link to the Applications folder.
+  * Application (.app): This is the actual application. In macOS, an application is typically a package that contains many individual files and folders that make up the application.
+  * Applications Link: This is a shortcut to the Applications folder in macOS. The purpose of this is to make it easy for you to install the application. You can drag the .app file to this shortcut to install the app.
+
 ## Privesc via pkg abuse
 
 ### Execution from public directories
@@ -70,9 +84,22 @@ If an installer writes to `/tmp/fixedname/bla/bla`, it's possible to **create a
 
 An example of this is **CVE-2021-26089** which managed to **overwrite a periodic script** to get execution as root. For more information take a look to the talk: [**OBTS v4.0: "Mount(ain) of Bugs" - Csaba Fitzl**](https://www.youtube.com/watch?v=jSYPazD4VcE)
 
+## pkg as malware
+
+### Empty Payload
+
+It's possible to just generate a **`.pkg`** file with **pre and post-install scripts** without any payload.
+
+### JS in Distribution xml
+
+It's possible to add **`<script>`** tags in the **distribution xml** file of the package and that code will get executed and it can **execute commands** using **`system.run`**:
+
+<figure><img src="../../../.gitbook/assets/image (14).png" alt=""><figcaption></figcaption></figure>
+
 ## References
 
 * [**DEF CON 27 - Unpacking Pkgs A Look Inside Macos Installer Packages And Common Security Flaws**](https://www.youtube.com/watch?v=iASSG0\_zobQ)
+* [**OBTS v4.0: "The Wild World of macOS Installers" - Tony Lambert**](https://www.youtube.com/watch?v=Eow5uNHtmIg)
 
 <details>
 

macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses.md

@@ -40,6 +40,10 @@ Here you can find examples of how some **malwares have been able to bypass this
 
 * [https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/](https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/)
 
+{% hint style="danger" %}
+Note that now, in order to be able to enable SSH you need **Full Disk Access**
+{% endhint %}
+
 ### Handle extensions - CVE-2022-26767
 
 The attribute **`com.apple.macl`** is given to files to give a **certain application permissions to read it.** This attribute is set when **drag\&drop** a file over an app, or when a user **double-clicks** a file to open it with the **default application**.

macos-hardening/macos-useful-commands.md

@@ -140,7 +140,7 @@ launchtl list #Services
 
 ### User Processes
 
-```
+```bash
 # will print all the running services under that particular user domain.
 launchctl print gui/<users UID>
 
@@ -151,6 +151,12 @@ launchctl print system
 launchctl print gui/<user's UID>/com.company.launchagent.label
 ```
 
+### Create a user
+
+Without prompts
+
+<figure><img src="../.gitbook/assets/image (13).png" alt=""><figcaption></figcaption></figure>
+
 <details>
 
 <summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>

windows-hardening/av-bypass.md

@@ -259,7 +259,7 @@ It's important to note that executables signed with a **trusted** signing certif
 
 A very effective way to prevent your payloads from getting the Mark of The Web is by packaging them inside some sort of container like an ISO. This happens because Mark-of-the-Web (MOTW) **cannot** be applied to **non NTFS** volumes.
 
-<figure><img src="../.gitbook/assets/image (12).png" alt=""><figcaption></figcaption></figure>
+<figure><img src="../.gitbook/assets/image (12) (2).png" alt=""><figcaption></figcaption></figure>
 
 [**PackMyPayload**](https://github.com/mgeeky/PackMyPayload/) is a tool that packages payloads into output containers to evade Mark-of-the-Web.