Skip to content

Commit b29dabf

Browse files
carlospolopgitbook-bot
carlospolop
authored and
gitbook-bot
committed
GITBOOK-4414: No subject
1 parent ee60597 commit b29dabf

File tree

5 files changed

+136
-96
lines changed

5 files changed

+136
-96
lines changed

‎macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md

+6-81
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# macOS Kernel & System Extensions
22

33
{% hint style="success" %}
4-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
5-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
4+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
5+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
66

77
<details>
88

@@ -58,87 +58,12 @@ The I/O Kit is an open-source, object-oriented **device-driver framework** in th
5858
[macos-ipc-inter-process-communication](../macos-proces-abuse/macos-ipc-inter-process-communication/)
5959
{% endcontent-ref %}
6060

61-
### Kernelcache
62-
63-
The **kernelcache** is a **pre-compiled and pre-linked version of the XNU kernel**, along with essential device **drivers** and **kernel extensions**. It's stored in a **compressed** format and gets decompressed into memory during the boot-up process. The kernelcache facilitates a **faster boot time** by having a ready-to-run version of the kernel and crucial drivers available, reducing the time and resources that would otherwise be spent on dynamically loading and linking these components at boot time.
64-
65-
In iOS it's located in **`/System/Library/Caches/com.apple.kernelcaches/kernelcache`** in macOS you can find it with **`find / -name kernelcache 2>/dev/null`** or **`mdfind kernelcache | grep kernelcache`**
66-
67-
It's possible to run **`kextstat`** to check the loaded kernel extensions.
68-
69-
#### IMG4
70-
71-
The IMG4 file format is a container format used by Apple in its iOS and macOS devices for securely **storing and verifying firmware** components (like **kernelcache**). The IMG4 format includes a header and several tags which encapsulate different pieces of data including the actual payload (like a kernel or bootloader), a signature, and a set of manifest properties. The format supports cryptographic verification, allowing the device to confirm the authenticity and integrity of the firmware component before executing it.
72-
73-
It's usually composed of the following components:
74-
75-
* **Payload (IM4P)**:
76-
* Often compressed (LZFSE4, LZSS, …)
77-
* Optionally encrypted
78-
* **Manifest (IM4M)**:
79-
* Contains Signature
80-
* Additional Key/Value dictionary
81-
* **Restore Info (IM4R)**:
82-
* Also known as APNonce
83-
* Prevents replaying of some updates
84-
* OPTIONAL: Usually this isn't found
85-
86-
Decompress the Kernelcache:
87-
88-
```bash
89-
# pyimg4 (https://github.com/m1stadev/PyIMG4)
90-
pyimg4 im4p extract -i kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
91-
92-
# img4tool (https://github.com/tihmstar/img4tool
93-
img4tool -e kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
94-
```
95-
96-
#### Kernelcache Symbols
97-
98-
Sometime Apple releases **kernelcache** with **symbols**. You can download some firmwares with symbols by following links on [https://theapplewiki.com](https://theapplewiki.com/).
99-
100-
### IPSW
101-
102-
These are Apple **firmwares** you can download from [**https://ipsw.me/**](https://ipsw.me/). Among other files it will contains the **kernelcache**.\
103-
To **extract** the files you can just **unzip** it.
104-
105-
After extracting the firmware you will get a file like: **`kernelcache.release.iphone14`**. It's in **IMG4** format, you can extract the interesting info with:
106-
107-
* [**pyimg4**](https://github.com/m1stadev/PyIMG4)
108-
109-
{% code overflow="wrap" %}
110-
```bash
111-
pyimg4 im4p extract -i kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
112-
```
113-
{% endcode %}
114-
115-
* [**img4tool**](https://github.com/tihmstar/img4tool)
116-
117-
```bash
118-
img4tool -e kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
119-
```
120-
121-
You can check the extracted kernelcache for symbols with: **`nm -a kernelcache.release.iphone14.e | wc -l`**
122-
123-
With this we can now **extract all the extensions** or the **one you are insterested in:**
124-
125-
```bash
126-
# List all extensions
127-
kextex -l kernelcache.release.iphone14.e
128-
## Extract com.apple.security.sandbox
129-
kextex -e com.apple.security.sandbox kernelcache.release.iphone14.e
130-
131-
# Extract all
132-
kextex_all kernelcache.release.iphone14.e
133-
134-
# Check the extension for symbols
135-
nm -a binaries/com.apple.security.sandbox | wc -l
136-
```
137-
13861
## macOS Kernel Extensions
13962

14063
macOS is **super restrictive to load Kernel Extensions** (.kext) because of the high privileges that code will run with. Actually, by default is virtually impossible (unless a bypass is found).
14164

65+
In the following page you can also see how to recover the `.kext` that macOS loads inside its **kernelcache**:
66+
14267
{% content-ref url="macos-kernel-extensions.md" %}
14368
[macos-kernel-extensions.md](macos-kernel-extensions.md)
14469
{% endcontent-ref %}
@@ -157,8 +82,8 @@ Instead of using Kernel Extensions macOS created the System Extensions, which of
15782
* [**https://taomm.org/vol1/analysis.html**](https://taomm.org/vol1/analysis.html)
15883

15984
{% hint style="success" %}
160-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
161-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
85+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
86+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
16287

16388
<details>
16489

‎macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md

+113-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# macOS Kernel Extensions
22

33
{% hint style="success" %}
4-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
5-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
4+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
5+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
66

77
<details>
88

@@ -47,14 +47,123 @@ In Catalina it was like this: It is interesting to note that the **verification*
4747

4848
If **`kextd`** is not available, **`kextutil`** can perform the same checks.
4949

50+
### Enumeration (loaded kexts)
51+
52+
```bash
53+
# Get loaded kernel extensions
54+
kextstat
55+
56+
# Get dependencies of the kext number 22
57+
kextstat | grep " 22 " | cut -c2-5,50- | cut -d '(' -f1
58+
```
59+
60+
## Kernelcache
61+
62+
{% hint style="danger" %}
63+
Even though the kernel extensions are expected to be in `/System/Library/Extensions/`, if you go to this folder you **won't find any binary**. This is because of the **kernelcache** and in order to reverse one `.kext` you need to find a way to obtain it.
64+
{% endhint %}
65+
66+
The **kernelcache** is a **pre-compiled and pre-linked version of the XNU kernel**, along with essential device **drivers** and **kernel extensions**. It's stored in a **compressed** format and gets decompressed into memory during the boot-up process. The kernelcache facilitates a **faster boot time** by having a ready-to-run version of the kernel and crucial drivers available, reducing the time and resources that would otherwise be spent on dynamically loading and linking these components at boot time.
67+
68+
### Local Kerlnelcache
69+
70+
In iOS it's located in **`/System/Library/Caches/com.apple.kernelcaches/kernelcache`** in macOS you can find it with: **`find / -name "kernelcache" 2>/dev/null`** \
71+
In my case in macOS I found it in:
72+
73+
* `/System/Volumes/Preboot/1BAEB4B5-180B-4C46-BD53-51152B7D92DA/boot/DAD35E7BC0CDA79634C20BD1BD80678DFB510B2AAD3D25C1228BB34BCD0A711529D3D571C93E29E1D0C1264750FA043F/System/Library/Caches/com.apple.kernelcaches/kernelcache`
74+
75+
#### IMG4
76+
77+
The IMG4 file format is a container format used by Apple in its iOS and macOS devices for securely **storing and verifying firmware** components (like **kernelcache**). The IMG4 format includes a header and several tags which encapsulate different pieces of data including the actual payload (like a kernel or bootloader), a signature, and a set of manifest properties. The format supports cryptographic verification, allowing the device to confirm the authenticity and integrity of the firmware component before executing it.
78+
79+
It's usually composed of the following components:
80+
81+
* **Payload (IM4P)**:
82+
* Often compressed (LZFSE4, LZSS, …)
83+
* Optionally encrypted
84+
* **Manifest (IM4M)**:
85+
* Contains Signature
86+
* Additional Key/Value dictionary
87+
* **Restore Info (IM4R)**:
88+
* Also known as APNonce
89+
* Prevents replaying of some updates
90+
* OPTIONAL: Usually this isn't found
91+
92+
Decompress the Kernelcache:
93+
94+
```bash
95+
# img4tool (https://github.com/tihmstar/img4tool
96+
img4tool -e kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
97+
98+
# pyimg4 (https://github.com/m1stadev/PyIMG4)
99+
pyimg4 im4p extract -i kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
100+
```
101+
102+
### Download&#x20;
103+
104+
* [**KernelDebugKit Github**](https://github.com/dortania/KdkSupportPkg/releases)
105+
106+
In [https://github.com/dortania/KdkSupportPkg/releases](https://github.com/dortania/KdkSupportPkg/releases) it's possible to find all the kernel debug kits. You can download it, mount it, open it with [Suspicious Package](https://www.mothersruin.com/software/SuspiciousPackage/get.html) tool, access the **`.kext`** folder and **extract it**.
107+
108+
Check it for symbols with:
109+
110+
```bash
111+
nm -a ~/Downloads/Sandbox.kext/Contents/MacOS/Sandbox | wc -l
112+
```
113+
114+
* [**theapplewiki.com**](https://theapplewiki.com/wiki/Firmware/Mac/14.x)**,** [**ipsw.me**](https://ipsw.me/)**,** [**theiphonewiki.com**](https://www.theiphonewiki.com/)
115+
116+
Sometime Apple releases **kernelcache** with **symbols**. You can download some firmwares with symbols by following links on those pages. The firmwares will contain the **kernelcache** among other files.
117+
118+
To **extract** the files start by changing the extension from `.ipsw` to `.zip` and **unzip** it.
119+
120+
After extracting the firmware you will get a file like: **`kernelcache.release.iphone14`**. It's in **IMG4** format, you can extract the interesting info with:
121+
122+
[**pyimg4**](https://github.com/m1stadev/PyIMG4)**:**
123+
124+
{% code overflow="wrap" %}
125+
```bash
126+
pyimg4 im4p extract -i kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
127+
```
128+
{% endcode %}
129+
130+
[**img4tool**](https://github.com/tihmstar/img4tool)**:**
131+
132+
```bash
133+
img4tool -e kernelcache.release.iphone14 -o kernelcache.release.iphone14.e
134+
```
135+
136+
### Inspecting kernelcache
137+
138+
Check if the kernelcache has symbols with
139+
140+
```bash
141+
nm -a kernelcache.release.iphone14.e | wc -l
142+
```
143+
144+
With this we can now **extract all the extensions** or the **one you are interested in:**
145+
146+
```bash
147+
# List all extensions
148+
kextex -l kernelcache.release.iphone14.e
149+
## Extract com.apple.security.sandbox
150+
kextex -e com.apple.security.sandbox kernelcache.release.iphone14.e
151+
152+
# Extract all
153+
kextex_all kernelcache.release.iphone14.e
154+
155+
# Check the extension for symbols
156+
nm -a binaries/com.apple.security.sandbox | wc -l
157+
```
158+
50159
## Referencias
51160

52161
* [https://www.makeuseof.com/how-to-enable-third-party-kernel-extensions-apple-silicon-mac/](https://www.makeuseof.com/how-to-enable-third-party-kernel-extensions-apple-silicon-mac/)
53162
* [https://www.youtube.com/watch?v=hGKOskSiaQo](https://www.youtube.com/watch?v=hGKOskSiaQo)
54163

55164
{% hint style="success" %}
56-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
57-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
165+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
166+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
58167

59168
<details>
60169

‎macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Introduction to ARM64v8
22

33
{% hint style="success" %}
4-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
5-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
4+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
5+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
66

77
<details>
88

@@ -352,6 +352,8 @@ dyldex -e libsystem_kernel.dylib /System/Library/Caches/com.apple.dyld/dyld_shar
352352
```
353353
{% endcode %}
354354

355+
Note that **Ida** and **Ghidra** can also decompile **specific dylibs** from the cache just by passing the cache.
356+
355357
{% hint style="success" %}
356358
Sometimes it's easier to check the **decompiled** code from **`libsystem_kernel.dylib`** **than** checking the **source code** because the code of several syscalls (BSD and Mach) are generated via scripts (check comments in the source code) while in the dylib you can find what is being called.
357359
{% endhint %}
@@ -808,8 +810,8 @@ call_execve:
808810
```
809811

810812
{% hint style="success" %}
811-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
812-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
813+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
814+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
813815

814816
<details>
815817

‎macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/README.md

+9-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# macOS Security Protections
22

33
{% hint style="success" %}
4-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
5-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
4+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
5+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
66

77
<details>
88

@@ -27,6 +27,10 @@ More information in:
2727

2828
## Processes Limitants
2929

30+
### MACF
31+
32+
33+
3034
### SIP - System Integrity Protection
3135

3236
{% content-ref url="macos-sip.md" %}
@@ -152,9 +156,10 @@ References and **more information about BTM**:
152156
* [https://youtu.be/9hjUmT031tc?t=26481](https://youtu.be/9hjUmT031tc?t=26481)
153157
* [https://www.patreon.com/posts/new-developer-77420730?l=fr](https://www.patreon.com/posts/new-developer-77420730?l=fr)
154158
* [https://support.apple.com/en-gb/guide/deployment/depdca572563/web](https://support.apple.com/en-gb/guide/deployment/depdca572563/web)
159+
155160
{% hint style="success" %}
156-
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
157-
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
161+
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
162+
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
158163

159164
<details>
160165

@@ -166,4 +171,3 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
166171

167172
</details>
168173
{% endhint %}
169-
</details>

0 commit comments

Comments
 (0)