Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-12-02 17:41:04 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.md
Carlos Polop 04b35add2c arte
2024-01-04 10:09:21 +01:00

4.4 KiB
Raw Blame History

macOS Bundles

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Basic Information

Basically, a bundle is a directory structure within the file system. Interestingly, by default this directory looks like a single object in Finder.

The common frequent bundle we will encounter is the .app bundle, but many other executables are also packaged as bundles, such as .framework and .systemextension or .kext.

The types of resources contained within a bundle may consist of applications, libraries, images, documentation, header files, etc. All these files are inside <application>.app/Contents/

ls -lR /Applications/Safari.app/Contents
  • Contents/_CodeSignature -> Contains code-signing information about the application (i.e., hashes, etc.).
    • openssl dgst -binary -sha1 /Applications/Safari.app/Contents/Resources/Assets.car | openssl base64
  • Contents/MacOS -> Contains the application’s binary (which is executed when the user double-clicks the application icon in the UI).
  • Contents/Resources -> Contains UI elements of the application, such as images, documents, and nib/xib files (that describe various user interfaces).
  • Contents/Info.plist -> The application’s main “configuration file.” Apple notes that “the system relies on the presence of this file to identify relevant information about [the] application and any related files”.

    • Plist files contains configuration information. You can find find information about the meaning of they plist keys in https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Introduction/Introduction.html

    • Pairs that may be of interest when analyzing an application include:\

      • CFBundleExecutable

      Contains the name of the application’s binary (found in Contents/MacOS).

      • CFBundleIdentifier

      Contains the application’s bundle identifier (often used by the system to globally identify the application).

      • LSMinimumSystemVersion

      Contains the oldest version of macOS that the application is compatible with.

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: