repository·master·Indexed 11 days ago
https://github.com/hacktricks-wiki/hacktricksA comprehensive guide to cybersecurity and penetration testing, covering firmware analysis, binary exploitation, and AI security. Includes detailed methodologies for ROP chains, buffer overflows, and the use of tools like GDB, GEF, Ghidra, Metasploit, and pwntools, as well as frameworks for assessing AI system risks such as OWASP ML Top 10 and Google's SAIF.
This guide provides a roadmap for analyzing macOS security, focusing on attack surfaces, privilege escalation, and system protections. Key areas of study include:
.pkg installers, file extension handlers, and URL scheme app handlers.MDM is used to oversee Apple devices (iOS, macOS, tvOS) via a compatible MDM server that adheres to the MDM Protocol. It allows for centralized control, such as remote data erasure or configuration installation.
DEP is an Apple service that enables zero-touch configuration. It allows brand-new devices (or those being reconfigured) to automatically register with a pre-defined MDM server upon initial activation.
Security Warning: If DEP enrollment is not properly secured, attackers may attempt to register unauthorized devices to an organization's MDM server by masquerading as corporate assets.
DLL Hijacking involves manipulating a trusted application into loading a malicious DLL. This can be used for code execution, persistence, and privilege escalation. Common methods include:
%PATH%, .exe.manifest, or .exe.local files to redirect the application to a malicious DLL.The Simple Mail Transfer Protocol (SMTP) is used to transport email between mail systems. Common mail transfer agents include Postfix, Exim, Sendmail, and Microsoft Exchange.
Standard Ports:
PORT STATE SERVICE REASON VERSION
25/tcp open smtp syn-ack Microsoft ESMTP 6.0.3790.3959MARA (Mobile Application Reverse engineering and Analysis Framework) aggregates multiple tools to assist in testing against OWASP mobile security threats.
Capabilities:
smalisca, ClassyShark, androbugs, androwarn, and APKiD.pyssltest, testssl.sh, and whatweb to analyze found domains.apk-deguard.com.macOS employs several layers of security to protect the system and user privacy. Key components include:
XPC is a macOS and iOS framework designed for safe, asynchronous communication between processes. It is primarily used to implement privilege separation, where an application is split into multiple components, each running with the minimum necessary permissions. This isolation improves security (limiting damage from a compromised process), stability (isolating crashes), and performance (enabling concurrency).
Key components include:
.xpc extension that contain a binary and an Info.plist.launchd to enforce restrictions and spawn services with specific Mach ports and file descriptors.macOS organizes its filesystem into system, local, network, and user domains. Key directories include:
/Applications: User-accessible installed applications./bin: Command line binaries./dev: Hardware device files./etc: Configuration files./Library: System-wide preferences, caches, and logs./private: Many system directories are symbolic links to this directory./sbin: Essential system administration binaries./System: Core macOS components and Apple-provided files./tmp: Temporary files (symlink to /private/tmp)./Users: User home directories./usr: Configuration and system binaries./var: Log files./Volumes: Mount points for external or mounted volumes.Accessing files via Volume ID and Inode:
If you run stat <filename>, the output provides a volume ID and an inode number (e.g., 16777223 7545753). You can access the file directly via the /.vol/ path using these numbers:
cat /.vol/<volume_id>/<inode>
This guide covers methodologies for abusing Access Control Lists (ACLs) and Access Control Entries (ACEs) within Active Directory to achieve persistence or privilege escalation. Key attack vectors include exploiting specific rights such as GenericAll, GenericWrite, WriteProperty, and ForceChangePassword on users, groups, or computer objects.
Common exploitation scenarios include:
member on a group or servicePrincipalName on a computer) to escalate privileges.Return-Oriented Programming (ROP) is an exploitation technique used to bypass security protections like No-Execute (NX) or Data Execution Prevention (DEP). Instead of injecting new code, an attacker chains together existing code snippets called "gadgets" already present in the binary or loaded libraries.
Each gadget typically performs a small operation (like pop eax; ret) and ends with a ret instruction, allowing the attacker to control the execution flow by carefully crafting the stack.