Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-21 20:23:18 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/macos-hardening/macos-red-teaming
History
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00
..
macos-mdm Translated to Klingon 2024-02-10 17:52:19 +00:00
macos-keychain.md Translated to Klingon 2024-02-10 17:52:19 +00:00
README.md Translated to Klingon 2024-02-10 17:52:19 +00:00

README.md

macOS Red Teaming

htARTE (HackTricks AWS Red Team Expert) !HackTricks!

Other ways to support HackTricks:

Abusing MDMs

  • JAMF Pro: jamf checkJSSConnection
  • Kandji

If you manage to compromise admin credentials to access the management platform, you can potentially compromise all the computers by distributing your malware in the machines.

For red teaming in MacOS environments it's highly recommended to have some understanding of how the MDMs work:

{% content-ref url="macos-mdm/" %} macos-mdm {% endcontent-ref %}

Using MDM as a C2

A MDM will have permission to install, query or remove profiles, install applications, create local admin accounts, set firmware password, change the FileVault key...

In order to run your own MDM you need to your CSR signed by a vendor which you could try to get with https://mdmcert.download/. And to run your own MDM for Apple devices you could use MicroMDM.

However, to install an application in an enrolled device, you still need it to be signed by a developer account... however, upon MDM enrolment the device adds the SSL cert of the MDM as a trusted CA, so you can now sign anything.

To enrol the device in a MDM you. need to install a mobileconfig file as root, which could be delivered via a pkg file (you could compress it in zip and when downloaded from safari it will be decompressed).

Mythic agent Orthrus uses this technique.

Abusing JAMF PRO

JAMF can run custom scripts (scripts developed by the sysadmin), native payloads (local account creation, set EFI password, file/process monitoring...) and MDM (device configurations, device certificates...).

JAMF self-enrolment

Go to a page such as https://<company-name>.jamfcloud.com/enroll/ to see if they have self-enrolment enabled. If they have it might ask for credentials to access.

You could use the script JamfSniper.py to perform a password spraying attack.

Moreover, after finding proper credentials you could be able to brute-force other usernames with the next form:

JAMF device Authentication

The jamf binary contained the secret to open the keychain which at the time of the discovery was shared among everybody and it was: jk23ucnq91jfu9aj.
Moreover, jamf persist as a LaunchDaemon in /Library/LaunchAgents/com.jamf.management.agent.plist

JAMF Device Takeover

The JSS (Jamf Software Server) URL that jamf will use is located in /Library/Preferences/com.jamfsoftware.jamf.plist.
This file basically contains the URL:

{% code overflow="wrap" %}

plutil -convert xml1 -o - /Library/Preferences/com.jamfsoftware.jamf.plist

[...]
<key>is_virtual_machine</key>
<false/>
<key>jss_url</key>
<string>https://halbornasd.jamfcloud.com/</string>
<key>last_management_framework_change_id</key>
<integer>4</integer>
[...]

{% endcode %}

So, an attacker could drop a malicious package (pkg) that overwrites this file when installed setting the URL to a Mythic C2 listener from a Typhon agent to now be able to abuse JAMF as C2.

{% code overflow="wrap" %}

# After changing the URL you could wait for it to be reloaded or execute:
sudo jamf policy -id 0

# TODO: There is an ID, maybe it's possible to have the real jamf connection and another one to the C2

{% endcode %}

JAMF Impersonation

QaH Impersonation communication between device JMF need:

  • UUID device: ioreg -d2 -c IOPlatformExpertDevice | awk -F" '/IOPlatformUUID/{print $(NF-1)}'
  • JAMF keychain from: /Library/Application\ Support/Jamf/JAMF.keychain contains device certificate

information, create VM stolen Hardware UUID SIP disabled, drop JAMF keychain, hook Jamf agent steal information.

Secrets stealing

a

could monitor location /Library/Application Support/Jamf/tmp/ custom scripts admins want execute Jamf placed here, executed and removed. scripts might contain credentials.

However, credentials might passed scripts parameters, would need monitor ps aux | grep -i jamf (without even being root).

script JamfExplorer.py listen new files added new process arguments.

macOS Remote Access

And MacOS "special" network protocols:

{% content-ref url="../macos-security-and-privilege-escalation/macos-protocols.md" %} macos-protocols.md {% endcontent-ref %}

Active Directory

occasions find MacOS computer connected AD. scenario try enumerate active directory use it. Find help following pages:

{% content-ref url="../../network-services-pentesting/pentesting-ldap.md" %} pentesting-ldap.md {% endcontent-ref %}

{% content-ref url="../../windows-hardening/active-directory-methodology/" %} active-directory-methodology {% endcontent-ref %}

{% content-ref url="../../network-services-pentesting/pentesting-kerberos-88/" %} pentesting-kerberos-88 {% endcontent-ref %}

local MacOS tool may help dscl:

dscl "/Active Directory/[Domain]/All Domains" ls /

qo'noS Information

  • Machound: MacHound Hoch 'ej Bloodhound audting tool extension 'oH collecting 'ej ingesting of Active Directory relationships on MacOS hosts.
  • Bifrost: Bifrost Hoch Objective-C project designed to interact with the Heimdal krb5 APIs on macOS. The goal of the project is to enable better security testing around Kerberos on macOS devices using native APIs without requiring any other framework or packages on the target.
  • Orchard: JavaScript for Automation (JXA) tool to do Active Directory enumeration.

Domain Information

echo show com.apple.opendirectoryd.ActiveDirectory | scutil

Users

The three types of MacOS users are:

  • Local Users — Managed by the local OpenDirectory service, they aren’t connected in any way to the Active Directory.
  • Network Users — Volatile Active Directory users who require a connection to the DC server to authenticate.
  • Mobile Users — Active Directory users with a local backup for their credentials and files.

The local information about users and groups is stored in in the folder /var/db/dslocal/nodes/Default.
For example, the info about user called mark is stored in /var/db/dslocal/nodes/Default/users/mark.plist and the info about the group admin is in /var/db/dslocal/nodes/Default/groups/admin.plist.

In addition to using the HasSession and AdminTo edges, MacHound adds three new edges to the Bloodhound database:

  • CanSSH - entity allowed to SSH to host
  • CanVNC - entity allowed to VNC to host
  • CanAE - entity allowed to execute AppleEvent scripts on host
#User enumeration
dscl . ls /Users
dscl . read /Users/[username]
dscl "/Active Directory/TEST/All Domains" ls /Users
dscl "/Active Directory/TEST/All Domains" read /Users/[username]
dscacheutil -q user

#Computer enumeration
dscl "/Active Directory/TEST/All Domains" ls /Computers
dscl "/Active Directory/TEST/All Domains" read "/Computers/[compname]$"

#Group enumeration
dscl . ls /Groups
dscl . read "/Groups/[groupname]"
dscl "/Active Directory/TEST/All Domains" ls /Groups
dscl "/Active Directory/TEST/All Domains" read "/Groups/[groupname]"

#Domain Information
dsconfigad -show

More info in https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/

Accessing the Keychain

The Keychain highly probably contains sensitive information that if accessed withuot generating a prompt could help to move forward a red team exercise:

{% content-ref url="macos-keychain.md" %} macos-keychain.md {% endcontent-ref %}

External Services

MacOS Red Teaming is different from a regular Windows Red Teaming as usually MacOS is integrated with several external platforms directly. A common configuration of MacOS is to access to the computer using OneLogin synchronised credentials, and accessing several external services (like github, aws...) via OneLogin.

Misc Red Team techniques

Safari

When a file is downloaded in Safari, if its a "safe" file, it will be automatically opened. So for example, if you download a zip, it will be automatically decompressed:

References

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: