{"@attributes":{"version":"2.0"},"channel":{"title":"Beyonds on theevilbit blog","link":"https:\/\/theevilbit.github.io\/beyond\/","description":"Recent content in Beyonds on theevilbit blog","generator":"Hugo","language":"en","lastBuildDate":"Tue, 15 Oct 2024 00:00:00 +0000","item":[{"title":"Beyond the good ol' LaunchAgents - 35 - Persist through the NVRAM - The 'apple-trusted-trampoline'","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0035\/","pubDate":"Tue, 15 Oct 2024 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0035\/","description":"
\n

This is part 35 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n

TL;DR - This is a practically completely useless persistence, as this can be only set and enabled when SIP is actually disabled. On the other hand I still find it a pretty amazing way to persist, as we can do that by putting a binary into NVRAM and get that executed. Here follows the details of the discovery.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 34 - launchd boot tasks","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0034\/","pubDate":"Thu, 10 Oct 2024 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0034\/","description":"

\n

This is part 34 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n

The all mighty launchd<\/code>, contains an embedded plist file in its __TEXT __config<\/code> section, which contains various settings, BootStrap file locations (like LaunchDaemons<\/code> and LaunchAgents<\/code>) and it has also a Boot<\/code> key, which defines various services, which will be run upon boot. They are called boot tasks. Although this is documented in Jonathan Levin’s *OS Internals Vol I. book, I think this is a not well known, and in fact I also totally forgot about it until Matt<\/a> brought them to my attention recently.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 33 - Widgets","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0033\/","pubDate":"Wed, 12 Jun 2024 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0033\/","description":"

\n

This is part 33 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n

Widgets are application extensions you can place on your desktop to display some key information from your main app. Although Apple says developers shouldn’t implement any functionality there and just use them as a display, they are still apps that run on their own and we can run code inside them. We will explore how we can create them, use them as persistence and also investigate what widgets will automatically run on our system.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 32 - Dock Tile Plugins","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0032\/","pubDate":"Fri, 29 Sep 2023 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0032\/","description":"

\n

This is part 32 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n

When you write a series about something, there are some episodes which are less interesting, many boring stuff, but sometimes there are some true gems. While doing some research yesterday, I run into the Dock Tile Plugin feature in macOS, which turned out to be truly amazing from persistence point of view.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 31 - BSM audit framework","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0031\/","pubDate":"Fri, 26 May 2023 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0031\/","description":"

\n

This is part 31 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n

macOS implements the OpenBSM audit framework created by McAfee, which allows someone to audit system events, like login, file access, etc\u2026 This has been part of the system for very long time. Auditing has several components, the main one being the kernel, which handles all the events. The main user mode process is auditd<\/code>, which is mainly responsible for logging. It\u2019s a huge framework, detailed very well by Jonathan Levin in his *OS Internal Part 3<\/code> book. I suggest reading that part, but you can also find some information here:<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 30 - The man config file - man.conf","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0030\/","pubDate":"Wed, 10 May 2023 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0030\/","description":"

\n

This is part 30 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n

I was watching an old BSidesLuxemburg 2019 talk by Aaron Jewitt, called “Threat Hunting On Linux And Mac With Auditbeat System Module”, it’s up on YouTube<\/a>. Aaron mentioned in one of the slides that you can persist using man.conf<\/code> files. It looked really odd, I tried to quickly Google it, but haven\u2019t found anything about it. So I took a look at the configuration file, and indeed, it turns out you can persist via man\u2019s configuration file, man.conf<\/code>, which can be found at \/private\/etc\/man.conf<\/code>.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 29 - amstoold","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0029\/","pubDate":"Tue, 08 Mar 2022 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0029\/","description":"

\n

This is part 29 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n

When doing some research on macOS I came across the following LaunchAgent: \/System\/Library\/LaunchAgents\/com.apple.amstoold.plist<\/code>. Its content is the following.<\/p>\n

<?xml version="1.0" encoding="UTF-8"?><\/span>\n<\/span><\/span><!DOCTYPE plist PUBLIC "-\/\/Apple\/\/DTD PLIST 1.0\/\/EN" "http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd"><\/span>\n<\/span><\/span><plist<\/span> version=<\/span>"1.0"<\/span>><\/span>\n<\/span><\/span><dict><\/span>\n<\/span><\/span>\t<key><\/span>EnablePressuredExit<\/key><\/span>\n<\/span><\/span>\t<true\/><\/span>\n<\/span><\/span>\t<key><\/span>EnableTransactions<\/key><\/span>\n<\/span><\/span>\t<true\/><\/span>\n<\/span><\/span>\t<key><\/span>Label<\/key><\/span>\n<\/span><\/span>\t<string><\/span>com.apple.amstoold<\/string><\/span>\n<\/span><\/span>\t<key><\/span>LaunchEvents<\/key><\/span>\n<\/span><\/span>\t<dict><\/span>\n<\/span><\/span>\t\t<key><\/span>com.apple.distnoted.matching<\/key><\/span>\n<\/span><\/span>\t\t<dict><\/span>\n<\/span><\/span>\t\t\t<key><\/span>com.apple.nfcd.ams.accessory<\/key><\/span>\n<\/span><\/span>\t\t\t<dict><\/span>\n<\/span><\/span>\t\t\t\t<key><\/span>Name<\/key><\/span>\n<\/span><\/span>\t\t\t\t<string><\/span>com.apple.nfcd.ams.accessory<\/string><\/span>\n<\/span><\/span>\t\t\t<\/dict><\/span>\n<\/span><\/span>\t\t<\/dict><\/span>\n<\/span><\/span>\t\t<key><\/span>com.apple.notifyd.matching<\/key><\/span>\n<\/span><\/span>\t\t<dict><\/span>\n<\/span><\/span>\t\t\t<key><\/span>com.apple.ams.privateListeningChanged<\/key><\/span>\n<\/span><\/span>\t\t\t<dict><\/span>\n<\/span><\/span>\t\t\t\t<key><\/span>Notification<\/key><\/span>\n<\/span><\/span>\t\t\t\t<string><\/span>com.apple.ams.privateListeningChanged<\/string><\/span>\n<\/span><\/span>\t\t\t<\/dict><\/span>\n<\/span><\/span>\t\t<\/dict><\/span>\n<\/span><\/span>\t<\/dict><\/span>\n<\/span><\/span>\t<key><\/span>MachServices<\/key><\/span>\n<\/span><\/span>\t<dict><\/span>\n<\/span><\/span>\t\t<key><\/span>com.apple.xpc.amstoold<\/key><\/span>\n<\/span><\/span>\t\t<true\/><\/span>\n<\/span><\/span>\t<\/dict><\/span>\n<\/span><\/span>\t<key><\/span>ProcessType<\/key><\/span>\n<\/span><\/span>\t<string><\/span>Background<\/string><\/span>\n<\/span><\/span>\t<key><\/span>ProgramArguments<\/key><\/span>\n<\/span><\/span>\t<array><\/span>\n<\/span><\/span>\t\t<string><\/span>\/usr\/local\/bin\/amstoold<\/string><\/span>\n<\/span><\/span>\t<\/array><\/span>\n<\/span><\/span>\t<key><\/span>RunAtLoad<\/key><\/span>\n<\/span><\/span>\t<true\/><\/span>\n<\/span><\/span><\/dict><\/span>\n<\/span><\/span><\/plist><\/span>\n<\/span><\/span><\/code><\/pre><\/div>
If we examine it closely we can notice that the related binary is \/usr\/local\/bin\/amstoold<\/code>. This is very interesting as this file doesn’t exists on default macOS installations. This means that if we create it, it will be started as the user upon login. As the launchd file is SIP protected, we can’t even remove it, and even if we would, it likely would come back at the next OS update.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 28 - Authorization Plugins","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0028\/","pubDate":"Wed, 09 Feb 2022 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0028\/","description":"
\n
This is part 28 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This persistence mechanism was described in very detail by Chris Ross<\/a> in his blogpost: Persistent Credential Theft with Authorization Plugins<\/a>. He also developed sample code, which can be found on his GitHub<\/a>. Thus this blog will only focus on the high level summary, and some changes that happened since he wrote that post.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 27 - Dock shortcuts","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0027\/","pubDate":"Tue, 08 Feb 2022 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0027\/","description":"
\n
This is part 27 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This persistence is another gem I found in Leo Pitt<\/a>’s Modern macOS Persistence<\/a> talk.<\/p>\n
macOS Dock stores shortcuts for applications, that we would like to access through the, well… Dock. It stores all settings in ~\/Library\/Preferences\/com.apple.dock.plist<\/code>. Although we can edit this PLIST directly, we can also use the defaults<\/code> utility to change it. For example adding a new entry:<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 26 - Finder Sync Plugins","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0026\/","pubDate":"Sat, 05 Feb 2022 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0026\/","description":"
\n
This is part 26 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This method was documented very detailed by Patrick Wardle in his blogpost<\/a> back in 2016. It was also covered by Leo Pitt<\/a> in his Modern macOS Persistence<\/a> talk, and he also made a POC, which can be found at his GitHub<\/a>. With there is really nothing to add here, so this post will be only a high level summary, for everything else refer to the above resources.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 25 - Apache2 modules","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0025\/","pubDate":"Wed, 15 Dec 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0025\/","description":"
\n
This is part 25 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
Possibly a less known feature that macOS has a built-in Apache2 web server, which can be enabled anytime. Just as other Apache2 servers, it also supports the load of custom modules, and this is what we will explore here briefly for persistence. For a detailed web server setup, I recommend the following articles:\nSetting up a local web server on a Mac - Apple Community<\/a>\nSetting up a local web server on macOS 12\u2026 - Apple Community<\/a><\/p>"},{"title":"Beyond the good ol' LaunchAgents - 24 - Folder Actions","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0024\/","pubDate":"Thu, 02 Dec 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0024\/","description":"
\n
This is part 24 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
Folder action persistence has been documented by Cody Thomas<\/a> back in 2019 in his blog<\/a>. I think he did an awesome job, and everything he wrote still applies today. I wanted to take it a bit further and see if I can persist without any user prompts, and it turned out it is possible. I will also talk about its TCC implications.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 23 - emond, The Event Monitor Daemon","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0023\/","pubDate":"Sat, 27 Nov 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0023\/","description":"
\n
This is part 23 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This post will be about emond<\/code>, Apple’s Event Monitor daemon.<\/p>\n
I think almost everything has been already told about this method and emond<\/code> in general by James Reynolds here<\/a> and xorrior<\/a> here<\/a> so really not much left for me. There is no point for me replicating their awesome posts, so please just read them. That’s it! Thank you for reading! \u00af\\(\u30c4)<\/em>\/\u00af\n.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 22 - LoginHook and LogoutHook","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0022\/","pubDate":"Wed, 24 Nov 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0022\/","description":"
\n
This is part 22 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This method is considered deprecated by Apple, yet it still works.<\/p>\n
LoginHooks and LogoutHooks have been widely documented by many people, so this post is mostly for completeness. The official, Apple documentation can be found here: Customizing Login and Logout<\/a><\/p>\n
LoginHooks and LogoutHooks are executed, well… at logins and logouts just as the name suggest, and they are run as root. They are set in the preferences of the  com.apple.loginwindow<\/code> process, and so it’s stored in the file \/var\/root\/Library\/Preferences\/com.apple.loginwindow.plist<\/code>.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 21 - Re-opened Applications","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0021\/","pubDate":"Tue, 12 Oct 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0021\/","description":"
\n
This is part 21 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This method was also documented by Patrick Wardle, in his original Methods of Malware Persistence<\/a> white paper and also at MITRE ATT&CK\u00ae<\/a>.<\/p>\n
When we restart macOS, we are presented with the following window:<\/p>\n
\"Re-open<\/p>\n
I guess, most users keep it selected, and then macOS will reopen all apps.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 20 - Terminal Preferences","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0020\/","pubDate":"Wed, 22 Sep 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0020\/","description":"
\n
This is part 20 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This is another application specific persistence method, related to the Terminal application.<\/p>\n
In the Terminal Preferences, under the Profiles tab, we can set a command that will be executed upon Terminal’s startup. This is shown in the screen below.<\/p>\n
\"Terminal<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 19 - Periodic Scripts","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0019\/","pubDate":"Fri, 06 Aug 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0019\/","description":"
\n
This is part 19 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This post has been long due, as it’s one of my favorite persistence tricks. Up until Big Sur 11.5 you could also exploit it for privilege escalation if Homebrew was installed on the system.<\/p>\n
Periodic scripts have a FreeBSD origin. These scripts are doing some maintenance tasks on the system, and scheduled to be run on a daily, weekly and monthly basis.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 18 - X11 and XQuartz","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0018\/","pubDate":"Mon, 28 Jun 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0018\/","description":"
\n
This is part 18 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
I learned about XQuartz<\/a> while reading Armin Briegel’s \u200emacOS Terminal and shell<\/a> book. It’s one of the alternative third party terminals we can install on macOS. As most terminals, this one also offers unique options to persist on the system.<\/p>\n
X11 used to be part of OS X, till 10.7, and it was open source, which we can find here<\/a>.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 17 - Color Pickers","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0017\/","pubDate":"Mon, 31 May 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0017\/","description":"
\n
This is part 17 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
Color pickers??? It’s this menu, where we can select a color:<\/p>\n
\"\"<\/p>\n
To my surprise we can install our own color pickers on the system, and add custom ones. There are quite a few of these, some are even open source, like this: GitHub - viktorstrate\/color-picker-plus: An Improved Color Picker for macOS<\/a>. Github is full of color picker codes, mostly written in Swift. We don’t really need those, unless we want to be stealthy and hide our code inside a legitimate picker.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 16 - Screen Saver","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0016\/","pubDate":"Sun, 30 May 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0016\/","description":"
\n
This is part 16 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
Screen savers have been detailed recently by Leo Pitt<\/a>on his blog post: “Saving Your Access”<\/a>. Considering that he already wrote most of the interesting stuff, I will try to show some new information, but there will be some overlap.<\/p>\n
Screen savers are macOS bundles with the bundle extension of .saver<\/code>. Their Info.plist<\/code> file doesn’t contain anything screen saver specific, so we can really use any bundle with the right extension.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 15 - xsanctl","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0015\/","pubDate":"Wed, 12 May 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0015\/","description":"
\n
This is part 15 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
I run into this not so exciting persistent method when I was investigating xsanctl<\/code> for… other… reasons… xsanctl<\/code> is a “Xsan file system control utility”, which allows us to mount and manage Xsans.<\/p>\n
The xsanctl<\/code> binary can be found at \/System\/Library\/Filesystems\/acfs.fs\/Contents\/bin\/xsanctl<\/code>, however when we simply run the command it is run from \/usr\/sbin\/xsanctl<\/code>. If we check, this is a symbolic link.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 14 - atrun","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0014\/","pubDate":"Tue, 27 Apr 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0014\/","description":"
\n
This is part 14 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
The at<\/code> command set is a heritage *nix job scheduler on macOS. Although it’s slowly being deprecated, it’s still available on Big Sur, although disabled by default.<\/p>\n
\n  Enabling atrun\n  \n    <\/i>\n    Link to heading<\/span>\n  <\/a>\n<\/h2>\n
As described by atrun<\/code>’s man page, the scheduler can be enabled using the following command:<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 13 - Audio Plugins","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0013\/","pubDate":"Mon, 19 Apr 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0013\/","description":"
\n
This is part 13 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This is another one of my favorites for some reason. macOS being a popular audio editing device, supports external audio drivers and plugins. @xorrior<\/a> wrote a very extensive blog post about these at his website, here: Audio Unit Plug-ins. Legitimate Un-signed Code Execution | by Christopher Ross | Posts By SpecterOps Team Members<\/a><\/p>"},{"title":"Beyond the good ol' LaunchAgents - 12 - QuickLook Plugins","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0012\/","pubDate":"Mon, 05 Apr 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0012\/","description":"
\n
This is part 12 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
\n  TL;DR\n  \n    <\/i>\n    Link to heading<\/span>\n  <\/a>\n<\/h2>\n
This technique is very similarly to Spotlight Importers, but heavily sandboxed. It\u2019s even more limited as the user need to specifically want to preview the file.<\/p>\n
\n  Intro\n  \n    <\/i>\n    Link to heading<\/span>\n  <\/a>\n<\/h2>\n
This will be a short post and it goes hand in hand with my previous one<\/a> that detailed the use of Spotlight Importers for persistence. Jonathan\u2019s book also details QuickLook plugins and fG! (@osxreverser) on Twitter<\/a> also said that he used to play with this, so I decided to take a look as well.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 11 - Spotlight Importers","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0011\/","pubDate":"Sat, 03 Apr 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0011\/","description":"
\n
This is part 11 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
\n  TL;DR\n  \n    <\/i>\n    Link to heading<\/span>\n  <\/a>\n<\/h2>\n
It works, but very limited due to heavy sandboxing, you can only read and copy files to your sandbox folder or consume some CPU power. If you have a way to escape sandbox then go for it, or could be used as part of a multi-part malware.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 10 - Application script files","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0010\/","pubDate":"Fri, 02 Apr 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0010\/","description":"
\n
This is part 10 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
I started to explore to possibility of persisting on macOS through script files contained in an application. The basic idea is that if we find a script file, which is being executed by a given application, we can edit that script file, put our code inside, and wait for an execution. Such technique is highly dependent on the applications the user has installed, so I looked through first how rare \/ frequent is having such scripts inside applications. I started with the below searches:<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 9 - Preference Pane","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0009\/","pubDate":"Thu, 25 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0009\/","description":"
\n
This is part 9 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
Preference panes on macOS are plugins to the System Preferences.app<\/code>. These panes can extend the functionality of the app, and typically allow you to modify configuration settings for your app. These admins are loaded when the user selects them, so they are not perfect from persistence point of view, as it requires user interaction, but can still be a thing.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 8 - Hammerspoon","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0008\/","pubDate":"Tue, 23 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0008\/","description":"
\n
This is part 8 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This idea came from my colleague @dejandayoff<\/a>. It’s another application specific persistence option, related to Hammerspoon<\/a>. The app is an automation tool, that allows macOS scripting through LUA scripting language. We can even embed full AppleScript code as well as run shell scripts.<\/p>\n
The app looks for a single file, ~\/.hammerspoon\/init.lua<\/code>, and when started the script will be executed. They have plenty of examples on their Getting Started<\/a> page, and an extensive API documentation<\/a>.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 7 - xbar plugins","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0007\/","pubDate":"Mon, 22 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0007\/","description":"
\n
This is part 7 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
This technique came from @bradleyjkemp<\/a> in one of his Twitter posts<\/a>.<\/p>\n
xbar<\/a> is an application that can put the output of a script into the menubar. The scripts should be placed in ~\/Library\/Application\\ Support\/xbar\/plugins\/<\/code>. Standard shell scripts are supported, and so I tried the one listed on their GitHub page as an example.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 6 - SSHRC","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0006\/","pubDate":"Sun, 21 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0006\/","description":"
\n
This is part 6 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
I learned about this trick from @0xdade<\/a> when he posted<\/a> it on Twitter.<\/p>\n
If we create a file in the user’s HOME directory at ~\/.ssh\/rc<\/code> it will be executed prior to the user’s login shell becomes available. The man page of sshd<\/code> describes this in more detail.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 5 - Pluggable Authentication Modules (PAM)","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0005\/","pubDate":"Sat, 20 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0005\/","description":"
\n
This is part 5 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
PAM<\/a> originated from Red Hat Linux, but made its way to most *nix based system, including macOS. It’s a modular system, that allows third party additions to various authentication related operations. I highly recommend checking out the FreeBSD documentation<\/a> to get a full picture.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 4 - cron jobs","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0004\/","pubDate":"Thu, 18 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0004\/","description":"
\n
This is part 4 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
cron<\/a> is probably one of the most well known persistence mechanisms for macOS and basically any *nix operating system. It was originally developed for Unix back in 1975, and made its way to most platforms, which has Unix origins, like Linux, FreeBSD and thus macOS.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 3 - Login Items","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0003\/","pubDate":"Wed, 17 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0003\/","description":"
\n
This is part 3 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
To clear up some expectations. The below tweet is not about this method, that is deferred for now. :)<\/p>\n
\"Twitter\"<\/p>\n
Login items are probably one of the most well documented methods to persist on macOS. It’s widely used by various application to launch themselves upon user login. These applications show up in the menubar most of the time.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 2 - iTerm2 startup","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0002\/","pubDate":"Tue, 16 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0002\/","description":"
\n
This is part 2 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
If the first part was about Terminal<\/code> and shell profiles, it’s worth to mention iTerm2<\/a>, which is a popular Terminal alternative on macOS. It’s being used by many people, especially power users.<\/p>\n
When we start iTerm2<\/code> it starts the same shell environment as Terminal<\/code>,  and thus the same startup files apply here as well. However this application has an additional way to execute code.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - 1 - shell startup files","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_0001\/","pubDate":"Sun, 14 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_0001\/","description":"
\n
This is part 1 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS. For more background check the introduction<\/a>.<\/p>\n<\/blockquote>\n
Shell startup files are executed when our shell environment like zsh<\/code> or bash<\/code> is starting up. macOS defaults to \/bin\/zsh<\/code>  these days, and whenever we open Terminal<\/code> or SSH into the device, this is the shell environment we are placed into. bash<\/code> and sh<\/code> are still available, however they have to be specifically started.<\/p>"},{"title":"Beyond the good ol' LaunchAgents - Introduction","link":"https:\/\/theevilbit.github.io\/beyond\/beyond_intro\/","pubDate":"Sun, 14 Mar 2021 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/beyond\/beyond_intro\/","description":"
I was always amazed by @Hexacorn<\/a>’s Beyond good ol’ Run key<\/a> blog post series, which collects various persistence<\/a> methods on Windows. It’s an awesome series, which has 133 parts at the time of this writing. I find them pretty cool, and if you are doing either offensive or defensive work on Windows, this is  a must read and follow blog.<\/p>\n
In the past years as my interest in macOS grew, and now that I’m mostly doing only macOS related research and studies I started to came across many - many tricks, which allows someone to do persistence on macOS beyond just the LaunchDaemons<\/code> or LaunchAgents<\/code> directories, which is used to store the launchd<\/code> startup files. This location is probably as classic on macOS as the Run<\/code> registry key on Windows. I did write about two different techniques in my regular posts (here<\/a> and here<\/a>), but it never became a full series. So I started to think about writing posts for each idea I came across, just like Adam does for Windows, but I would do for macOS. With almost the same name, just swapping Run key<\/code> with LaunchAgents<\/code> and name it Beyond the good ol' LaunchAgents<\/code>.<\/p>"}]}}