Macos Postexploit

---
name: macos-postexploit
description: macOS post-exploitation — 46 programs across recon, credential harvesting, privilege escalation, persistence, evasion, monitoring, lateral movement, and exfiltration
category: post-exploitation
tags: [macos, post-exploitation, credential-access, defense-evasion, privilege-escalation, persistence, lateral-movement, discovery, collection, exfiltration, keychain, dtrace, tcc, xprotect, gatekeeper, launchd, dylib, bonjour, airdrop]
tech_stack: [macos, security-cli, dtrace, osascript, sqlite3, xattr, launchctl, dscl, defaults, system_profiler]
cwe_ids: [CWE-200, CWE-269, CWE-426, CWE-522, CWE-547, CWE-693, CWE-732, CWE-1254]
chains_with: [T1082, T1057, T1016, T1087, T1518, T1007, T1555, T1552, T1528, T1114, T1548, T1574, T1543, T1547, T1053, T1546, T1553, T1562, T1070, T1056, T1115, T1113, T1021, T1046, T1074]
prerequisites: [T1068, T1548]
version: "2.0"
---

# macOS Post-Exploitation Methodology

46 programs across 8 categories for comprehensive macOS post-exploitation. Uses native tools (`security`, `dtrace`, `xattr`, `log`, `launchctl`, `dscl`, `defaults`, `osascript`), Python, and direct SQLite access.

## Prerequisites

Before deploying machook tools, verify:

1. **Root access** — most operations require root (recon programs work without root)
2. **SIP status** — DTrace tools require SIP disabled (`csrutil disable` from Recovery Mode)
3. **Native tools only** — all tools use macOS CLI, no third-party dependencies

```bash
csrutil status                           # SIP status (DTrace needs disabled)
sw_vers                                  # macOS version
id                                       # current user/groups
security list-keychains                  # available keychains
```

## Kill Chain Phases

### Phase 1 — Reconnaissance (First 60 seconds)

Understand the target before deploying offensive tools.

| Action | Command | Purpose |
|--------|---------|---------|
| System info | `machook system_info` | Kernel, distro, CPU, memory, disk, hardware model |
| Processes | `machook process_enum` | Running processes, root services, listening ports |
| Network | `machook network_enum` | Interfaces, routing, ARP, DNS, Wi-Fi, firewall |
| Users | `machook user_enum` | Local users, admin group, sudo access, last logins |
| Applications | `machook installed_apps` | Installed apps, Homebrew, pip, npm — check versions via cve-mcp |
| Security posture | `machook security_framework` | SIP, Gatekeeper, FileVault, Firewall, XProtect, EDR, MDM |
| LaunchDaemons | `machook launchd_enum` | LaunchAgents/Daemons, third-party plist detection |

**CVE Integration:** After running `installed_apps` or `security_framework`, check software versions against CVE database via cve-mcp (`cve search_by_product --product <name> --version <ver>`). If cve-mcp is not enabled: `cyberstrike mcp enable cve`.

### Phase 2 — Credential Harvesting

Extract credentials from macOS-specific stores.

| Action | Command | Purpose |
|--------|---------|---------|
| Keychain dump | `machook keychain_dump` | Extract passwords from login/system Keychain |
| Chrome creds | `machook chrome_creds` | Chrome/Safari passwords, cookies, autofill |
| SSH keys | `machook ssh_keys` | Private keys, known_hosts, authorized_keys, SSH config |
| Safari data | `machook safari_creds` | History, bookmarks, downloads, extensions, LocalStorage |
| Cloud creds | `machook cloud_creds` | AWS, GCP, Azure, Docker, Kubernetes credentials |
| GPG keys | `machook gpg_keys` | GPG private keys, keyrings, agent status |
| iCloud tokens | `machook icloud_tokens` | iCloud account tokens, Accounts.sqlite, Keychain DB |
| Mail creds | `machook mail_creds` | Mail.app account credentials and tokens |

### Phase 3 — Privilege Escalation

Escalate from user to root.

| Action | Command | Purpose |
|--------|---------|---------|
| TCC bypass | `machook tcc_bypass` | Access camera, microphone, files without consent |
| Dylib hijack | `machook dylib_hijack` | SUID/SGID binaries with weak dylib paths, DYLD_INSERT |
| LaunchDaemon abuse | `machook launchd_plist_abuse` | Writable plists/binaries in LaunchDaemons |
| Sudo misconfig | `machook sudo_misconfig` | NOPASSWD, env_keep DYLD, sudo version CVEs |
| Auth DB | `machook authorization_db` | Authorization Database rights for privesc vectors |
| Installer abuse | `machook pkg_abuse` | Trojaned .pkg files, writable installer scripts |

### Phase 4 — Persistence

Maintain access across reboots.

| Action | Command | Purpose |
|--------|---------|---------|
| LaunchAgent | `machook launchagent_persist --label NAME --command CMD` | User-level persistence (survives reboot) |
| LaunchDaemon | `machook launchdaemon_persist --label NAME --command CMD` | Root-level persistence (requires root) |
| Login items | `machook login_items --path /path/to/app` | Run on user login via System Events |
| Cron | `machook cron_persist --command CMD` | Scheduled crontab persistence |
| Shell RC | `machook bashrc_persist --command CMD` | Inject into .zshrc/.bashrc (runs on shell open) |
| Periodic | `machook periodic_scripts --command CMD --frequency daily` | /etc/periodic/ scripts (root, daily/weekly/monthly) |

### Phase 5 — Monitoring

Observe target activity for intelligence gathering.

| Action | Command | Purpose |
|--------|---------|---------|
| Keylogging | `machook keylog_mac --duration 120` | Capture keystrokes via osascript with app context |
| Process trace | `machook dtrace_exec --duration 60` | Monitor all process executions (SIP disabled) |
| Network trace | `machook dtrace_net --duration 60` | Monitor network connections (SIP disabled) |
| File trace | `machook dtrace_file --duration 60` | Monitor file access (SIP disabled) |
| Clipboard | `machook clipboard_monitor --duration 60` | Capture clipboard changes (passwords, tokens) |
| Screenshot | `machook screen_capture` | Silent screenshot via screencapture |

### Phase 6 — Lateral Movement

Pivot to other systems on the network.

| Action | Command | Purpose |
|--------|---------|---------|
| SSH pivot | `machook ssh_pivot --target HOST --command CMD` | SSH lateral movement, tunnels, agent forwarding |
| AirDrop recon | `machook airdrop_abuse` | AirDrop discoverability and nearby device scan |
| Bonjour/mDNS | `machook bonjour_enum` | Discover SSH, HTTP, SMB, AFP, VNC services |
| Apple Remote Desktop | `machook apple_remote_desktop` | ARD/Screen Sharing status and access audit |

### Phase 7 — Evasion & Anti-Forensics

Reduce forensic footprint and bypass defenses.

| Action | Command | Purpose |
|--------|---------|---------|
| XProtect check | `machook xprotect_check` | Enumerate detection signatures for evasion planning |
| Gatekeeper bypass | `machook gatekeeper_bypass --path /path` | Remove quarantine xattr for unsigned execution |
| Clear logs | `machook log_clear` | Clear unified logging, audit, crash reports |
| Clear history | `machook history_clear` | Shell, app history, recent items, Spotlight |
| Timestomp | `machook timestomp --path /path --reference /ref` | Modify file timestamps to blend in |
| EDR bypass | `machook endpoint_security_bypass` | Enumerate EDR extensions, check SIP/MDM bypass vectors |

### Phase 8 — Exfiltration & Cleanup (MANDATORY)

Stage data and remove all traces.

| Action | Command | Purpose |
|--------|---------|---------|
| Stage data | `machook data_stage --type keys --output /tmp/out.tar.gz` | Find and archive sensitive files |
| Audit artifacts | `machook artifact_enum` | Pre-cleanup audit of all CyberStrike traces |
| **Cleanup** | **`machook cleanup_mac`** | **ALWAYS run before exiting** |

## Detection Considerations

macOS post-exploitation tools are detectable by:
- **Endpoint Security Framework (ESF)** — EDR agents using `es_new_client()` for process/file/auth events
- **Unified Logging** — `log show --predicate 'process == "security"'` for Keychain access
- **TCC audit** — TCC access logged in Console.app, `tccutil` events visible
- **SIP** — When enabled, blocks DTrace system-wide tracing and TCC.db modification
- **XProtect** — Scans downloaded executables against YARA rules
- **Gatekeeper** — Checks code signing and quarantine attributes
- **MDM/Jamf Protect** — Managed Macs report configuration changes, new LaunchAgents
- **CrowdStrike Falcon / SentinelOne** — macOS EDR detects suspicious `security` command usage, CGEventTap, dylib injection
- **LaunchDaemon monitoring** — New plists in /Library/LaunchDaemons/ trigger alerts
- **Authorization DB changes** — Modifications to system.privilege.* rights are logged
- **SSH audit** — New authorized_keys entries, SSH tunnels visible in `lsof`

## Program Reference

| Program | Technique | MITRE ATT&CK |
|---------|-----------|---------------|
| system_info | System information enumeration | T1082 |
| process_enum | Process and service discovery | T1057 |
| network_enum | Network configuration discovery | T1016 |
| user_enum | Local account and group discovery | T1087.001 |
| installed_apps | Software discovery with cve-mcp CTA | T1518 |
| security_framework | Security software discovery | T1518.001 |
| launchd_enum | Service enumeration | T1007 |
| keychain_dump | macOS Keychain extraction | T1555.001 |
| chrome_creds | Browser credential decryption | T1555.003 |
| ssh_keys | SSH private key discovery | T1552.004 |
| safari_creds | Safari browser data extraction | T1555.003 |
| cloud_creds | Cloud credential harvesting | T1552.001 |
| gpg_keys | GPG private key extraction | T1552.004 |
| icloud_tokens | iCloud token harvesting | T1528 |
| mail_creds | Mail credential extraction | T1114.001 |
| tcc_bypass | TCC database manipulation | T1548 |
| dylib_hijack | Dylib search order hijacking | T1574.004 |
| launchd_plist_abuse | Writable plist/binary abuse | T1574.006 |
| sudo_misconfig | Sudo misconfiguration abuse | T1548.003 |
| authorization_db | Authorization DB rights abuse | T1548 |
| pkg_abuse | Installer package abuse | T1546.016 |
| launchagent_persist | LaunchAgent persistence | T1543.001 |
| launchdaemon_persist | LaunchDaemon persistence | T1543.004 |
| login_items | Login item persistence | T1547.015 |
| cron_persist | Cron job persistence | T1053.003 |
| bashrc_persist | Shell RC file persistence | T1546.004 |
| periodic_scripts | Periodic script persistence | T1053.003 |
| xprotect_check | XProtect/MRT signature enumeration | T1518.001 |
| gatekeeper_bypass | Quarantine xattr removal | T1553.001 |
| log_clear | System log clearing | T1070.002 |
| history_clear | Shell/app history clearing | T1070.003 |
| timestomp | File timestamp modification | T1070.006 |
| endpoint_security_bypass | EDR enumeration and bypass | T1562.001 |
| keylog_mac | Keystroke capture | T1056.001 |
| dtrace_exec | Process execution tracing | T1057 |
| dtrace_net | Network connection tracing | T1049 |
| dtrace_file | File access tracing | T1083 |
| clipboard_monitor | Clipboard data capture | T1115 |
| screen_capture | Screen capture | T1113 |
| ssh_pivot | SSH lateral movement | T1021.004 |
| airdrop_abuse | AirDrop reconnaissance | T1021 |
| bonjour_enum | mDNS service discovery | T1046 |
| apple_remote_desktop | ARD/Screen Sharing abuse | T1021.003 |
| data_stage | Sensitive data staging | T1074.001 |
| artifact_enum | Pre-cleanup artifact audit | T1070 |
| cleanup_mac | Artifact removal and cleanup | T1070 |