Mirrors/hacktricks

Fork 0

mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00

CPol ff4a3d95b7

GITBOOK-3962: change request with no subject merged in GitBook

2023-06-01 20:34:49 +00:00

12 KiB

Raw Blame History

macOS Files, Folders & Binaries

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

File hierarchy layout

/Applications: The installed apps should be here. All the users will be able to access them.
/bin: Command line binaries
/cores: If exists, it's used to store core dumps
/dev: Everything is treated as a file so you may see hardware devices stored here.
/etc: Configuration files
/Library: A lot of subdirectories and files related to preferences, caches and logs can be found here. A Library folder exists in root and on each user's directory.
/private: Undocumented but a lot of the mentioned folders are symbolic links to the private directory.
/sbin: Essential system binaries (related to administration)
/System: File fo making OS X run. You should find mostly only Apple specific files here (not third party).
/tmp: Files are deleted after 3 days (it's a soft link to /private/tmp)
/Users: Home directory for users.
/usr: Config and system binaries
/var: Log files
/Volumes: The mounted drives will apear here.
/.vol: Running stat a.txt you obtain something like 16777223 7545753 -rw-r--r-- 1 username wheel ... where the first number is the id number of the volume where the file exists and the second one is the inode number. You can access the content of this file through /.vol/ with that information running cat /.vol/16777223/7545753

Applications Folders

System applications are located under /System/Applications
Installed applications are usually installed in /Applications or in ~/Applications
Application data can be found in /Library/Application Support for the applications running as root and ~/Library/Application Support for applications running as the user.
Third-party applications daemons that need to run as root as usually located in /Library/PrivilegedHelperTools/
Sandboxed apps are mapped into the ~/Library/Containers folder. Each app has a folder named according to the application’s bundle ID (com.apple.Safari).
The kernel is located in /System/Library/Kernels/kernel
Apple's kernel extensions are located in /System/Library/Extensions
Third-party kernel extensions are stored in /Library/Extensions

Files with Sensitive Information

MacOS stores information such as passwords in several places:

{% content-ref url="broken-reference" %} Broken link {% endcontent-ref %}

OS X Specific Extensions

.dmg: Apple Disk Image files are very frequent for installers.
.kext: It must follow a specific structure and it's the OS X version of a driver. (it's a bundle)
.plist: Also known as property list stores information in XML or binary format.
- Can be XML or binary. Binary ones can be read with:
  - defaults read config.plist
  - /usr/libexec/PlistBuddy -c print config.plsit
  - plutil -p ~/Library/Preferences/com.apple.screensaver.plist
  - plutil -convert xml1 ~/Library/Preferences/com.apple.screensaver.plist -o -
  - plutil -convert json ~/Library/Preferences/com.apple.screensaver.plist -o -
.app: Apple applications that follows directory structure (It's a bundle).
.dylib: Dynamic libraries (like Windows DLL files)
.pkg: Are the same as xar (eXtensible Archive format). The installer command can be use to install the contents of these files.
.DS_Store: This file is on each directory, it saves the attributes and customisations of the directory.
.Spotlight-V100: This folder appears on the root directory of every volume on the system.
.metadata_never_index: If this file is at the root of a volume Spotlight won't index that volume.
.noindex: Files and folder with this extension won't be indexed by Spotlight.

macOS Bundles

Basically, a bundle is a directory structure within the file system. Interestingly, by default this directory looks like a single object in Finder (like .app).

{% content-ref url="macos-bundles.md" %} macos-bundles.md {% endcontent-ref %}

Special File Permissions

Folder permissions

In a folder, read allows to list it, write allows to delete and write files on it, and execute allows to traverse the directory. So, for example, a user with read permission over a file inside a directory where he doesn't have execute permission won't be able to read the file.

Flag modifiers

There are some flags that could be set in the files that will make file behave differently. You can check the flags of the files inside a directory with ls -lO /path/directory

uchg: Known as uchange flag will prevent any action changing or deleting the file. To set it do: chflags uchg file.txt
- The root user could remove the flag and modify the file
restricted: This flag makes the file be protected by SIP (you cannot add this flag to a file).
Sticky bit: If a directory with sticky bit, only the directories owner or root can remane or delete files. Typically this is set on the /tmp directory to prevent ordinary users from deleting or moving other users’ files.

File ACLs

File ACLs contain ACE (Access Control Entries) where more granular permissions can be assigned to different users.

It's possible to grant a directory these permissions: list, search, add_file, add_subdirectory, delete_child, delete_child.
Ans to a file: read, write, append, execute.

When the file contains ACLs you will find a "+" when listing the permissions like in:

ls -ld Movies
drwx------+   7 username  staff     224 15 Apr 19:42 Movies

You can read the ACLs of the file with:

ls -lde Movies
drwx------+ 7 username  staff  224 15 Apr 19:42 Movies
 0: group:everyone deny delete

You can find all the files with ACLs with (this is veeery slow):

ls -RAle / 2>/dev/null | grep -E -B1 "\d: "

Resource Forks | macOS ADS

This is a way to obtain Alternate Data Streams in MacOS machines. You can save content inside an extended attribute called com.apple.ResourceFork inside a file by saving it in file/..namedfork/rsrc.

echo "Hello" > a.txt
echo "Hello Mac ADS" > a.txt/..namedfork/rsrc

xattr -l a.txt #Read extended attributes
com.apple.ResourceFork: Hello Mac ADS

ls -l a.txt #The file length is still q
-rw-r--r--@ 1 username  wheel  6 17 Jul 01:15 a.txt

You can find all the files containing this extended attribute with:

{% code overflow="wrap" %}

find / -type f -exec ls -ld {} \; 2>/dev/null | grep -E "[x\-]@ " | awk '{printf $9; printf "\n"}' | xargs -I {} xattr -lv {} | grep "com.apple.ResourceFork"

{% endcode %}

Universal binaries & Mach-o Format

Mac OS binaries usually are compiled as universal binaries. A universal binary can support multiple architectures in the same file.

{% content-ref url="universal-binaries-and-mach-o-format.md" %} universal-binaries-and-mach-o-format.md {% endcontent-ref %}

macOS memory dumping