diff --git a/src/macos-hardening/macos-useful-commands.md b/src/macos-hardening/macos-useful-commands.md index 740f8c9195f..ef0cbf215b9 100644 --- a/src/macos-hardening/macos-useful-commands.md +++ b/src/macos-hardening/macos-useful-commands.md @@ -10,6 +10,8 @@ ### Specific MacOS Commands +Use `sw_vers` for the macOS release and build.[[2]](#references) Query hardware values with `sysctl` and memory-page statistics with `vm_stat` instead of the Linux-only `/proc/cpuinfo`, `/proc/meminfo`, and `free` commands.[[3]](#references)[[4]](#references) + ```bash #System info date @@ -18,10 +20,11 @@ uptime #show time from starting w #list users whoami #this user finger username #info about user -uname -a #sysinfo -cat /proc/cpuinfo #processor -cat /proc/meminfo #memory -free #check memory +uname -a #Darwin kernel information +sw_vers #macOS version and build +sysctl -n hw.model #Hardware model identifier +sysctl -n hw.memsize #Physical memory in bytes +vm_stat #Memory statistics in pages df #check disk launchctl list #List services @@ -47,7 +50,7 @@ system_profiler SPAirPortDataType #Airport Info #Searches mdfind password #Show all the files that contains the word password -mfind -name password #List all the files containing the word password in the name +mdfind -name password #Search indexed file names for password #Open any app @@ -60,8 +63,8 @@ caffeinate & #Screenshot -# This will ask for permission to the user -screencapture -x /tmp/ss.jpg #Save screenshot in that file +# May prompt for Screen Recording permission; -x does not bypass it +screencapture -x /tmp/ss.png #Save screenshot; -x only suppresses the sound #Get clipboard info @@ -86,6 +89,9 @@ networksetup -getinfo Wi-Fi #Wi-Fi info networksetup -getautoproxyurl Wi-Fi #Get proxy URL for Wifi networksetup -getwebproxy Wi-Fi #Wifi Web proxy networksetup -getftpproxy Wi-Fi #Wifi ftp proxy +scutil --proxy #Current system proxy configuration +scutil --dns #Current DNS resolver configuration +scutil --nc list #Configured VPN services #Brew @@ -117,6 +123,20 @@ dscacheutil -flushcache sudo killall -HUP mDNSResponder ``` +`mdfind` queries the Spotlight metadata index, so a missing result does not prove a file is absent.[[5]](#references) For a filesystem search of accessible paths, use `find "$HOME" -iname '*password*' 2>/dev/null`.[[11]](#references) TCC-protected directories can still be unavailable to the calling process.[[9]](#references) + +For network reconnaissance, compare a service's stored proxy settings from `networksetup` with the current proxy, DNS, and VPN state from `scutil`.[[6]](#references)[[12]](#references) A VPN can push a proxy configuration that is visible through `scutil --proxy`.[[13]](#references) A network extension can filter traffic without appearing as a conventional proxy.[[10]](#references) See [macOS defensive tooling](macos-security-and-privilege-escalation/macos-defensive-apps.md#quick-triage-of-defensive-tooling) before assuming direct egress is available. + +### Screen capture from an SSH session + +A remote shell is not automatically in the logged-in user's GUI bootstrap. If you have the required privilege and an active GUI session, identify the correct `loginwindow` PID for that session and run `screencapture` in its bootstrap with `launchctl bsexec`.[[7]](#references) This adopts the Mach bootstrap and audit-session context, **not** the process UID or TCC Screen Recording grant.[[8]](#references) A capture can still be denied or prompt for consent; see [screen-capture permissions](macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md#screen-capture-ktccservicescreencapture).[[9]](#references) + +```bash +pgrep -fl loginwindow # Identify the loginwindow PID for the target GUI session +LOGINWINDOW_PID=1234 # Replace with that PID +sudo launchctl bsexec "$LOGINWINDOW_PID" /usr/sbin/screencapture -x /tmp/ss.png +``` + ### Quick anti-analysis / virtualization check Some macOS stealers call `system_profiler` to detect VMs and **abort with a distinct exit code (e.g., 100)** to avoid sandbox detonation[[1]](#references): @@ -157,8 +177,21 @@ Without prompts
+ + ## References - [1] [2025, the year of the Infostealer](https://www.pentestpartners.com/security-blog/2025-the-year-of-the-infostealer/) - +- [2] [Apple sw_vers manual](https://keith.github.io/xcode-man-pages/sw_vers.1.html) +- [3] [Apple sysctl manual](https://keith.github.io/xcode-man-pages/sysctl.8.html) +- [4] [Apple Viewing Virtual Memory Usage](https://developer.apple.com/library/archive/documentation/Performance/Conceptual/ManagingMemory/Articles/VMPages.html) +- [5] [Apple mdfind manual](https://keith.github.io/xcode-man-pages/mdfind.1.html) +- [6] [Apple scutil manual](https://keith.github.io/xcode-man-pages/scutil.8.html) +- [7] [Apple screencapture manual](https://keith.github.io/xcode-man-pages/screencapture.1.html) +- [8] [Apple launchctl manual](https://keith.github.io/xcode-man-pages/launchctl.1.html) +- [9] [Apple Platform Security](https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf) +- [10] [Santa network extension deployment documentation](https://github.com/northpolesec/santa/blob/main/docs/docs/deployment/profile-network-extension.md) +- [11] [Apple find manual](https://keith.github.io/xcode-man-pages/find.1.html) +- [12] [Apple networksetup manual](https://keith.github.io/xcode-man-pages/networksetup.8.html) +- [13] [Cisco Secure Client Administrator Guide](https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/Cisco-Secure-Client-5/admin/guide/b-cisco-secure-client-admin-guide-5-1.pdf) {{#include ../banners/hacktricks-training.md}}