mirror of
https://github.com/carlospolop/hacktricks
synced 2025-01-10 12:18:52 +00:00
133 lines
4.8 KiB
Markdown
133 lines
4.8 KiB
Markdown
# Depuración del Sandbox predeterminado de macOS
|
|
|
|
<details>
|
|
|
|
<summary><strong>Aprende a hackear AWS desde cero hasta convertirte en un experto con</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Experto en Red Team de AWS de HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
Otras formas de apoyar a HackTricks:
|
|
|
|
* Si deseas ver tu **empresa anunciada en HackTricks** o **descargar HackTricks en PDF** Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
|
* Obtén la [**merchandising oficial de PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Descubre [**La Familia PEASS**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* **Únete al** 💬 [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **síguenos** en **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Comparte tus trucos de hacking enviando PRs a los** [**HackTricks**](https://github.com/carlospolop/hacktricks) y [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repositorios de github.
|
|
|
|
</details>
|
|
|
|
En esta página puedes encontrar cómo crear una aplicación para lanzar comandos arbitrarios desde dentro del sandbox predeterminado de macOS:
|
|
|
|
1. Compila la aplicación:
|
|
|
|
{% code title="main.m" %}
|
|
```objectivec
|
|
#include <Foundation/Foundation.h>
|
|
|
|
int main(int argc, const char * argv[]) {
|
|
@autoreleasepool {
|
|
while (true) {
|
|
char input[512];
|
|
|
|
printf("Enter command to run (or 'exit' to quit): ");
|
|
if (fgets(input, sizeof(input), stdin) == NULL) {
|
|
break;
|
|
}
|
|
|
|
// Remove newline character
|
|
size_t len = strlen(input);
|
|
if (len > 0 && input[len - 1] == '\n') {
|
|
input[len - 1] = '\0';
|
|
}
|
|
|
|
if (strcmp(input, "exit") == 0) {
|
|
break;
|
|
}
|
|
|
|
system(input);
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
```
|
|
{% endcode %}
|
|
|
|
Compílalo ejecutando: `clang -framework Foundation -o SandboxedShellApp main.m`
|
|
|
|
2. Construye el paquete `.app`
|
|
```bash
|
|
mkdir -p SandboxedShellApp.app/Contents/MacOS
|
|
mv SandboxedShellApp SandboxedShellApp.app/Contents/MacOS/
|
|
|
|
cat << EOF > SandboxedShellApp.app/Contents/Info.plist
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>CFBundleIdentifier</key>
|
|
<string>com.example.SandboxedShellApp</string>
|
|
<key>CFBundleName</key>
|
|
<string>SandboxedShellApp</string>
|
|
<key>CFBundleVersion</key>
|
|
<string>1.0</string>
|
|
<key>CFBundleExecutable</key>
|
|
<string>SandboxedShellApp</string>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
```
|
|
3. Definir los permisos
|
|
|
|
{% tabs %}
|
|
{% tab title="sandbox" %}
|
|
```bash
|
|
cat << EOF > entitlements.plist
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>com.apple.security.app-sandbox</key>
|
|
<true/>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
```
|
|
{% endtab %}
|
|
|
|
{% tab title="sandbox + descargas" %}
|
|
```bash
|
|
cat << EOF > entitlements.plist
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>com.apple.security.app-sandbox</key>
|
|
<true/>
|
|
<key>com.apple.security.files.downloads.read-write</key>
|
|
<true/>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
```
|
|
{% endtab %}
|
|
{% endtabs %}
|
|
|
|
4. Firmar la aplicación (necesitas crear un certificado en el llavero)
|
|
```bash
|
|
codesign --entitlements entitlements.plist -s "YourIdentity" SandboxedShellApp.app
|
|
./SandboxedShellApp.app/Contents/MacOS/SandboxedShellApp
|
|
|
|
# An d in case you need this in the future
|
|
codesign --remove-signature SandboxedShellApp.app
|
|
```
|
|
<details>
|
|
|
|
<summary><strong>Aprende hacking en AWS desde cero hasta experto con</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Otras formas de apoyar a HackTricks:
|
|
|
|
* Si quieres ver tu **empresa anunciada en HackTricks** o **descargar HackTricks en PDF** Consulta los [**PLANES DE SUSCRIPCIÓN**](https://github.com/sponsors/carlospolop)!
|
|
* Obtén el [**oficial PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
* Descubre [**The PEASS Family**](https://opensea.io/collection/the-peass-family), nuestra colección exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* **Únete al** 💬 [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **síguenos** en **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Comparte tus trucos de hacking enviando PRs a los** [**HackTricks**](https://github.com/carlospolop/hacktricks) y [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repositorios de github.
|
|
|
|
</details>
|