macOS Default Sandbox Debug

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

इस पृष्ठ पर आप यह जान सकते हैं कि डिफ़ॉल्ट macOS सैंडबॉक्स के अंदर से मनमाने कमांड लॉन्च करने के लिए एक ऐप कैसे बनाया जाए:

एप्लिकेशन को संकलित करें:

main.m

#include <Foundation/Foundation.h>

int main(int argc, const char * argv[]) {
@autoreleasepool {
while (true) {
char input[512];

printf("Enter command to run (or 'exit' to quit): ");
if (fgets(input, sizeof(input), stdin) == NULL) {
break;
}

// Remove newline character
size_t len = strlen(input);
if (len > 0 && input[len - 1] == '\n') {
input[len - 1] = '\0';
}

if (strcmp(input, "exit") == 0) {
break;
}

system(input);
}
}
return 0;
}

इसे चलाते हुए संकलित करें: clang -framework Foundation -o SandboxedShellApp main.m

.app बंडल बनाएं

mkdir -p SandboxedShellApp.app/Contents/MacOS
mv SandboxedShellApp SandboxedShellApp.app/Contents/MacOS/

cat << EOF > SandboxedShellApp.app/Contents/Info.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleIdentifier</key>
<string>com.example.SandboxedShellApp</string>
<key>CFBundleName</key>
<string>SandboxedShellApp</string>
<key>CFBundleVersion</key>
<string>1.0</string>
<key>CFBundleExecutable</key>
<string>SandboxedShellApp</string>
</dict>
</plist>
EOF

अधिकारों को परिभाषित करें

cat << EOF > entitlements.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
</dict>
</plist>
EOF

cat << EOF > entitlements.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.files.downloads.read-write</key>
<true/>
</dict>
</plist>
EOF

ऐप पर हस्ताक्षर करें (आपको कीचेन में एक प्रमाणपत्र बनाना होगा)

codesign --entitlements entitlements.plist -s "YourIdentity" SandboxedShellApp.app
./SandboxedShellApp.app/Contents/MacOS/SandboxedShellApp

# An d in case you need this in the future
codesign --remove-signature SandboxedShellApp.app

HackTricks का समर्थन करें

सदस्यता योजनाएँ देखें!
हमारे 💬 Discord समूह या telegram समूह में शामिल हों या Twitter 🐦 पर हमें फॉलो करें @hacktricks_live.
हैकिंग ट्रिक्स साझा करें और HackTricks और HackTricks Cloud गिटहब रिपोजिटरी में PRs सबमिट करें।

PreviousmacOS Sandbox NextmacOS Sandbox Debug & Bypass

Last updated 4 months ago

#include <Foundation/Foundation.h> int main(int argc, const char * argv[]) { @autoreleasepool { while (true) { char input[512]; printf("Enter command to run (or 'exit' to quit): "); if (fgets(input, sizeof(input), stdin) == NULL) { break; } // Remove newline character size_t len = strlen(input); if (len > 0 && input[len - 1] == '\n') { input[len - 1] = '\0'; } if (strcmp(input, "exit") == 0) { break; } system(input); } } return 0; }

mkdir -p SandboxedShellApp.app/Contents/MacOS mv SandboxedShellApp SandboxedShellApp.app/Contents/MacOS/ cat << EOF > SandboxedShellApp.app/Contents/Info.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CFBundleIdentifier</key> <string>com.example.SandboxedShellApp</string> <key>CFBundleName</key> <string>SandboxedShellApp</string> <key>CFBundleVersion</key> <string>1.0</string> <key>CFBundleExecutable</key> <string>SandboxedShellApp</string> </dict> </plist> EOF

cat << EOF > entitlements.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.security.app-sandbox</key> <true/> </dict> </plist> EOF

codesign --entitlements entitlements.plist -s "YourIdentity" SandboxedShellApp.app ./SandboxedShellApp.app/Contents/MacOS/SandboxedShellApp # An d in case you need this in the future codesign --remove-signature SandboxedShellApp.app