mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 12:43:23 +00:00
102 lines
4.9 KiB
Markdown
102 lines
4.9 KiB
Markdown
# macOS File Extension & URL scheme app handlers
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## LaunchServices Database
|
|
|
|
This is a database of all the installed applications in the macOS that can be queried to get information about each installed application such as URL schemes it support and MIME types.
|
|
|
|
It's possible to dump this datase with:
|
|
|
|
{% code overflow="wrap" %}
|
|
```
|
|
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump
|
|
```
|
|
{% endcode %}
|
|
|
|
Or using the tool [**lsdtrip**](https://newosxbook.com/tools/lsdtrip.html).
|
|
|
|
**`/usr/libexec/lsd`** is the brain of the database. It provides **several XPC services** like `.lsd.installation`, `.lsd.open`, `.lsd.openurl`, and more. But it also **requires some entitlements** to applications to be able to use the exposed XPC functionalities, like `.launchservices.changedefaulthandler` or `.launchservices.changeurlschemehandler` to change default apps for mime types or url schemes and others.
|
|
|
|
**`/System/Library/CoreServices/launchservicesd`** claims the service `com.apple.coreservices.launchservicesd` and can be queried to get information about running applications. It can be queried with the system tool /**`usr/bin/lsappinfo`** or with [**lsdtrip**](https://newosxbook.com/tools/lsdtrip.html).
|
|
|
|
## File Extension & URL scheme app handlers
|
|
|
|
The following line can be useful to find the applications that can open files depending on the extension:
|
|
|
|
{% code overflow="wrap" %}
|
|
```bash
|
|
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -E "path:|bindings:|name:"
|
|
```
|
|
{% endcode %}
|
|
|
|
Or use something like [**SwiftDefaultApps**](https://github.com/Lord-Kamina/SwiftDefaultApps):
|
|
|
|
```bash
|
|
./swda getSchemes #Get all the available schemes
|
|
./swda getApps #Get all the apps declared
|
|
./swda getUTIs #Get all the UTIs
|
|
./swda getHandler --URL ftp #Get ftp handler
|
|
```
|
|
|
|
You can also check the extensions supported by an application doing:
|
|
|
|
```
|
|
cd /Applications/Safari.app/Contents
|
|
grep -A3 CFBundleTypeExtensions Info.plist | grep string
|
|
<string>css</string>
|
|
<string>pdf</string>
|
|
<string>webarchive</string>
|
|
<string>webbookmark</string>
|
|
<string>webhistory</string>
|
|
<string>webloc</string>
|
|
<string>download</string>
|
|
<string>safariextz</string>
|
|
<string>gif</string>
|
|
<string>html</string>
|
|
<string>htm</string>
|
|
<string>js</string>
|
|
<string>jpg</string>
|
|
<string>jpeg</string>
|
|
<string>jp2</string>
|
|
<string>txt</string>
|
|
<string>text</string>
|
|
<string>png</string>
|
|
<string>tiff</string>
|
|
<string>tif</string>
|
|
<string>url</string>
|
|
<string>ico</string>
|
|
<string>xhtml</string>
|
|
<string>xht</string>
|
|
<string>xml</string>
|
|
<string>xbl</string>
|
|
<string>svg</string>
|
|
```
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|