Onur Alanbel #İSTSEC'19 Picus Security // Bir macOS APT Senaryosu

1. Bir macOS APT Senaryosu
Onur ALANBEL

2. $id -un
• Product Manager - Picus Security
• Bilgisayar Mühendisliği – İYTE
• Twitter - @onuralanbel
• Github - onura

3. Ajanda
Hedef
olarak
macOS
İlk erişim
Yetki
yükseltme
Kalıcılık
Veri
toplama
Veri
kaçırma

4. Hedef olarak macOS
Üst düzey hedeflerde
yaygın kullanım
Düşük güvenlik önlemleri
(gözden uzak)
Gerçek hayat örnekleri
• Lazarus
• Windtail
• Diğerleri

5. İlk erişim
Exploit (0 to 2-3 days)
• Safari
• MS Office for Mac
• Preview Keynote,
Numbers vb.
Zafiyet değil
özellik
• URL Scheme
Handlers
Diğerleri

6. URL Schemes
• Document Handlers
• URL schemes
• URL scheme kaydeden bir paket oluşturma
• Download + forward ile istismar

7. URL Schemes
• Document Handlers
CFBundleTypeExtensions = (
rtf
);
CFBundleTypeName = "Rich Text Document";
CFBundleTypeRole = Editor;
LSItemContentTypes = (
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/l
sregister -dump |grep -a5 -b5 TypeExtension
Bundle
• Info.plist
• CFBundleTypeExtension
Dosya Diske
Yazılır
macOS
Document
Handler
kaydeder

8. URL Schemes
• URL Schemes
/System/Library/Frameworks/CoreServices.framework/Frameworks/Launc
hServices.framework/Support/lsregister -dump |grep -a5 -b5 -i
CFBundleURLSchemessssh://
CFBundleURLTypes = (
{
CFBundleURLName = "ssh URL";
CFBundleURLSchemes = (
ssh
);
},
{
CFBundleURLName = "x-man-page URL";
ssh
);
}
);

9. URL Schemes
• URL Schemes
videoconf://
Info.plist

10. Implant Seçimi
SSH Backdoor
• Basit ve etkili
Mettle
• Stabil
• Post exploitation kolay
Empire
• Stabil
• Güçlü C2 iletişimi
• Post exploitation kolay
EvilOSXs
• macOS'e özel bir çok post exploitation modülü

11. Empire stager ile paket oluşturma
Http listener
osx/macho
stager
stager >
macosapt.app

12. İstismar Sayfası

13. Gatekeeper
İmzalı app kullanmak
• Windtail kullanıyor
Gatekeeper bypass (0 or 2-3 days)
• Hemen her versiyonda bulunabiliyor
İlk erişimden sonra curl + exec
• Bir çok macOS zararlısı kullanıyor
Homograph
• Genelde GK bypass ile beraber ikna edici
dosya isimleri oluşturmakta kullanılır

14. Yetki Yükseltme
• Local Privilege Escalation Exploit (CVE-2019-8513)
• macOS 10.14.3
• Password Phishing
• macOS 10.14.4

15. Kalıcılık
• Mail
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.proxy.initialize</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/macosapt</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>KeepAlive</key>
<true/>
</dict>
</plist>
<dict>
<key>AllCriteriaMustBeSatisfied</key>
<string>NO</string>
<key>AppleScript</key>
<string>persist.scpt</string>
<key>AutoResponseType</key>
<integer>0</integer>
<key>Criteria</key>
<array>
<dict>
-----
<key>Expression</key>
<string>macosAPT</string>
<key>Header</key>
------
• Launch Daemon

16. Veri Toplama ve Kaçırma
Dump keychain
without root
• CVE-2019-8526
• Keychain Stealer App
Keychain
masterkey in
memory
• Keychaindump
• Keychaindump chainbreaker
macOS’e özel
olmayan diğerleri
• Dump Chrome passwords
• Browser history
• Keylogging
• Screenshots
• Mic recording

17. Sorular
info@picussecurity.com

18. Referanslar
• https://www.sentinelone.com/blog/how-malware-bypass-macos-gatekeeper/
• https://digitasecurity.com/blog/2018/08/30/windshift/
• https://www.n00py.io/2016/10/using-email-for-persistence-on-os-x/
• https://null-byte.wonderhowto.com/how-to/hacking-macos-perform-privilege-escalation-part-2-password-phishing-0186332/
• https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43?sk=3970823f97714fac1d04d75325e3cbac
• https://www.willmaster.com/library/features/download-and-redirect-with-one-click.php