macOS Dirty NIB
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
For further detail about the technique check the original post from: https://blog.xpnsec.com/dirtynib/ and the following post by https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/. Here is a summary:
Nib (short for NeXT Interface Builder) files, part of Apple's development ecosystem, are intended for defining UI elements and their interactions in applications. They encompass serialized objects such as windows and buttons, and are loaded at runtime. Despite their ongoing usage, Apple now advocates for Storyboards for more comprehensive UI flow visualization.
The main Nib file is referenced in the value NSMainNibFile inside the Info.plist file of the application and is loaded by the function NSApplicationMain executed in the main function of the application.
Initial Setup:
Create a new NIB file using XCode.
Add an Object to the interface, setting its class to NSAppleScript.
Configure the initial source property via User Defined Runtime Attributes.
Code Execution Gadget:
The setup facilitates running AppleScript on demand.
Integrate a button to activate the Apple Script object, specifically triggering the executeAndReturnError: selector.
Testing:
A simple Apple Script for testing purposes:
Test by running in the XCode debugger and clicking the button.
Preparation:
Copy the target app (e.g., Pages) into a separate directory (e.g., /tmp/).
Initiate the app to sidestep Gatekeeper issues and cache it.
Overwriting NIB File:
Replace an existing NIB file (e.g., About Panel NIB) with the crafted DirtyNIB file.
Execution:
Trigger the execution by interacting with the app (e.g., selecting the About menu item).
Modify the AppleScript to access and extract user data, such as photos, without user consent.
Access and review a sample of a malicious .xib file that demonstrates executing arbitrary code.
In the post https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/ you can find tutorial on how to create a dirty nib.
Launch Constraints hinder app execution from unexpected locations (e.g., /tmp).
It's possible to identify apps not protected by Launch Constraints and target them for NIB file injection.
From macOS Sonoma onwards, modifications inside App bundles are restricted. However, earlier methods involved:
Copying the app to a different location (e.g., /tmp/).
Renaming directories within the app bundle to bypass initial protections.
After running the app to register with Gatekeeper, modifying the app bundle (e.g., replacing MainMenu.nib with Dirty.nib).
Renaming directories back and rerunning the app to execute the injected NIB file.
Note: Recent macOS updates have mitigated this exploit by preventing file modifications within app bundles post Gatekeeper caching, rendering the exploit ineffective.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
