macOS Installers Abuse
Pkg Basic Information
Kifurushi cha installer cha macOS (pia kinachojulikana kama faili .pkg
) ni muundo wa faili unaotumiwa na macOS ku distribute software. Faili hizi ni kama sanduku ambalo lina kila kitu ambacho kipande cha software kinahitaji ili kufunga na kufanya kazi ipasavyo.
Faili la kifurushi lenyewe ni archive inayoshikilia hierarchy ya faili na directories ambazo zitawekwa kwenye kompyuta ya lengo. Inaweza pia kujumuisha scripts za kutekeleza kazi kabla na baada ya ufungaji, kama vile kuandaa faili za usanidi au kusafisha toleo za zamani za software.
Hierarchy
Distribution (xml): Marekebisho (kichwa, maandiko ya karibisho…) na ukaguzi wa script/ufungaji
PackageInfo (xml): Taarifa, mahitaji ya ufungaji, eneo la ufungaji, njia za scripts za kutekeleza
Bill of materials (bom): Orodha ya faili za kufunga, kuboresha au kuondoa pamoja na ruhusa za faili
Payload (CPIO archive gzip compresses): Faili za kufunga katika
install-location
kutoka PackageInfoScripts (CPIO archive gzip compressed): Scripts za kabla na baada ya ufungaji na rasilimali zaidi zilizotolewa kwenye directory ya muda kwa ajili ya utekelezaji.
Decompress
In order to visualize the contents of the installer without decompressing it manually you can also use the free tool Suspicious Package.
DMG Basic Information
DMG files, or Apple Disk Images, are a file format used by Apple's macOS for disk images. A DMG file is essentially a mountable disk image (it contains its own filesystem) that contains raw block data typically compressed and sometimes encrypted. When you open a DMG file, macOS mounts it as if it were a physical disk, allowing you to access its contents.
Note that .dmg
installers support so many formats that in the past some of them containing vulnerabilities were abused to obtain kernel code execution.
Hierarchy
The hierarchy of a DMG file can be different based on the content. However, for application DMGs, it usually follows this structure:
Top Level: This is the root of the disk image. It often contains the application and possibly a link to the Applications folder.
Application (.app): This is the actual application. In macOS, an application is typically a package that contains many individual files and folders that make up the application.
Applications Link: This is a shortcut to the Applications folder in macOS. The purpose of this is to make it easy for you to install the application. You can drag the .app file to this shortcut to install the app.
Privesc via pkg abuse
Execution from public directories
If a pre or post installation script is for example executing from /var/tmp/Installerutil
, and attacker could control that script so he escalate privileges whenever it's executed. Or another similar example:
AuthorizationExecuteWithPrivileges
This is a public function that several installers and updaters will call to execute something as root. This function accepts the path of the file to execute as parameter, however, if an attacker could modify this file, he will be able to abuse its execution with root to escalate privileges.
For more info check this talk: https://www.youtube.com/watch?v=lTOItyjTTkw
Utekelezaji kwa kupandisha
Ikiwa mfunguo anaandika kwenye /tmp/fixedname/bla/bla
, inawezekana kuunda mount juu ya /tmp/fixedname
bila wamiliki ili uweze kubadilisha faili yoyote wakati wa ufungaji ili kutumia mchakato wa ufungaji.
Mfano wa hili ni CVE-2021-26089 ambayo ilifanikiwa kufuta script ya kawaida ili kupata utekelezaji kama root. Kwa maelezo zaidi angalia hotuba: OBTS v4.0: "Mount(ain) of Bugs" - Csaba Fitzl
pkg kama malware
Payload Tupu
Inawezekana tu kuunda .pkg
faili yenye pre na post-install scripts bila payload halisi isipokuwa malware ndani ya scripts.
JS katika distribution xml
Inawezekana kuongeza <script>
vitambulisho katika distribution xml faili ya kifurushi na hiyo code itatekelezwa na inaweza kutekeleza amri kwa kutumia system.run
:
Mfunguo wa nyuma
Mfunguo mbaya ukitumia script na JS code ndani ya dist.xml
References
Last updated