0-Day Up Your Sleeve - Attacking macOS Environments

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

0-day up your sleeve
AT TA C K I N G M A C O S E N V I R O N M E N T S

Whoami?
Wojciech Reguła
Head of Mobile Security at
• Focused on iOS/macOS #appsec
• Blogger – h8ps:/
/wojciechregula.blog
...

Agenda
1. Introduction
2. Macs in corporate environments
3. Setting up a C2 with Mythic
4. Initial access
5. Persistence
6...

🙋‍ Raise your hand if:
There is at least one Mac
in your company

🙋‍ Raise your hand if:
This Mac has access to your
company’s resources like other
Windows machines

Why did I decide to make this talk?
1. Macs are geHng more common in corporate environments (developers,
UX, designers, ma...

What are the problems?
☠ Old, vulnerable macOS versions everywhere
⚙ MacOS system ﬁrewall disabled (default conﬁgura<on)
🤔...

Macs in corporate environments
Mac is directly bound to the AD

Macs in corporate environments
Mac has NoMAD installed that handles Kerberos

Macs in corporate environments
Mac uses SSO, there is no AD

ADFS SSO
NON-SSO
Desktop and other TCC-protected directories
Target for this talk

ü Great red teaming framework with macOS support
ü Created by Cody Thomas @its_a_feature_
ü Open source - hMps:/
/github.c...

h0ps:/
/vimeo.com/751596706

Initial access - problems
1. According to Apple all
the soNware downloaded
directly with your browser
must be notarized

Initial access - problems
2. NotarizaZon will check if the soNware doesn’t contain malicious
components

Initial access - problems
3. If you don’t notarize your
app macOS will block it.

Ini=al access – solu=ons for the problems
1. We can create a legit pkg ﬁle,
notarize it and risk our cer<ﬁcate
to be revok...

Initial access – solutions for the problems
2. We can convince user to right click and open the app. It’s a popular
techni...

Initial access – solutions for the problems
3. We can bypass the GateKeeper using a 0-day

Initial access – solutions for the problems
4. Use Microsoft Office Macro.

Ini=al access with a MicrosoA Word Macro

Ini=al access with a MicrosoA Word Macro

Initial access with a Microsoft Word Macro
• Madhav Bhab shared a cool technique to escape the Word’s sandbox.
However, it...

…but we have our own 0-days 😈
Presenting :
macOS sandbox escape vulnerability

h0ps:/
/vimeo.com/751596839

Persistence
Typical macOS persistence techniques:
• Launch Agents
• Launch Daemons
• Login Items
• Cron Jobs
• Login/Logou...

h0ps:/
/vimeo.com/751596910

h0ps:/
/vimeo.com/751597017

Persistence – macOS Ventura update

ADFS SSO
NON-SSO
Desktop and other TCC-protected directories
Target for this talk

Data Collection
We’re interested in:
• VPN credenZals
• AD credenZals (NoMAD)
• Signal messages
• Browser cookies
• Keycha...

Data Collec=on - OpenVPN

Data Collection - OpenVPN

Data Collec=on – OpenVPN
• You can use my universal app Keylogger
• https://gist.github.com/r3ggi/26f38e6439d9647449143262...

Data Collec=on - OpenVPN

ADFS SSO
NON-SSO
Desktop and other TCC-protected directories
Target for this talk

Data Collection – AD Credentials (NoMAD)
• NoMAD saves your AD credenZals in MacOS Keychain.
• The Keychain has a ﬂaw that...

Data Collection – AD Credentials (NoMAD)
• I open-sourced a NoMADCredenZalsStealer tool as a part of my
#macOSRedTeamingTr...

ADFS SSO
NON-SSO
Desktop and other TCC-protected directories
Target for this talk

Data Collection –
Signal messages

ADFS SSO
NON-SSO
Desktop and other TCC-protected directories
Target for this talk

Data Collection – Firefox saved passwords
• Firefox stores saved logins & passwords in an encrypted form
• If master passw...

h0ps:/
/vimeo.com/751597088

ADFS SSO
NON-SSO
Desktop and other TCC-protected directories
Target for this talk

Data Collection – flat files and problems with TCC

Transparency, Consent and Control (TCC)

h0ps:/
/vimeo.com/751597122

Data Collec=on – ﬂat ﬁles and problems with TCC
• Accessing Desktop/Documents/Microphone and other sensitive
resources wil...

Data Collec=on – ﬂat ﬁles and problems with TCC

…we have our own vulnerabilities #2 😈
Presenting :
a TCC bypass

Data Collec=on – ﬂat ﬁles and problems with TCC

https://vimeo.com/751597193

Data Collection & Lateral Movement
• Another good news for red teamers – cloud credenZals are stored in ~
• Home directory...

ADFS SSO
NON-SSO
Desktop and other TCC-protected directories
Target for this talk

Hardening macOS environments
At least:
1. Enroll your company’s Macs to MDM (eg. JAMF, Intune)
2. Keep them updated
3. Enf...

h"ps://www.securing.pl/en/service/infrastructure-security-tes7ng/mac-
environments-tes7ng/

Summing up

Wojciech Reguła
Head of Mobile Security at SecuRing
@_r3ggi wojciech-regula
Thank you!

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1047773 views
Storytelling For The Web: Integrate... by Chiara Aliotta 961940 views
Artificial Intelligence, Data and C... by OECD Directorate ... 891371 views
How to Leverage AI to Boost Employe... by SocialHRCamp 375955 views
2024 State of Marketing Report – by... by Marius Sescu 213320 views
Everything You Need To Know About C... by Expeed Software 232066 views

View on Slideshare

1 of 58 Ad

View on Slideshare

1 of 58 Ad