# MacOS Red Teaming
πŸŽ™οΈ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) πŸŽ™οΈ - πŸŽ₯ Youtube πŸŽ₯ * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
## Common management methods * JAMF Pro: `jamf checkJSSConnection` * Kandji If you manage to **compromise admin credentials** to access the management platform, you can **potentially compromise all the computers** by distributing your malware in the machines. For red teaming in MacOS environments it's highly recommended to have some understanding of how the MDMs work: {% content-ref url="/pages/VSEXY7GhhBGL8pjglcEM" %} [MacOS MDM](/dashboard/macos-hardening/macos-security-and-privilege-escalation/macos-mdm.md) {% endcontent-ref %} And also about **MacOS** "special" **network** **protocols**: {% content-ref url="/pages/YaHz6YvjH8jpojZW274S" %} [MacOS Protocols](/dashboard/macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md) {% endcontent-ref %} ## Active Directory In some occasions you will find that the **MacOS computer is connected to an AD**. In this scenario you should try to **enumerate** the active directory as you are use to it. Find some **help** in the following pages: {% content-ref url="/pages/JMEvXTEMYEuXlPRpYezT" %} [389, 636, 3268, 3269 - Pentesting LDAP](/dashboard/network-services-pentesting/pentesting-ldap.md) {% endcontent-ref %} {% content-ref url="/pages/dY0rzj3ln7kIKbAVOxW9" %} [Active Directory Methodology](/dashboard/windows-hardening/active-directory-methodology.md) {% endcontent-ref %} {% content-ref url="/pages/rtKhaPkthkHtJQe1lva6" %} [88tcp/udp - Pentesting Kerberos](/dashboard/network-services-pentesting/pentesting-kerberos-88.md) {% endcontent-ref %} Some **local MacOS tool** that may also help you is `dscl`: ```bash dscl "/Active Directory/[Domain]/All Domains" ls / ``` Also there are some tools prepared for MacOS to automatically enumerate the AD and play with kerberos: * [**Machound**](https://github.com/XMCyber/MacHound): MacHound is an extension to the Bloodhound audting tool allowing collecting and ingesting of Active Directory relationships on MacOS hosts. * [**Bifrost**](https://github.com/its-a-feature/bifrost): Bifrost is an Objective-C project designed to interact with the Heimdal krb5 APIs on macOS. The goal of the project is to enable better security testing around Kerberos on macOS devices using native APIs without requiring any other framework or packages on the target. * [**Orchard**](https://github.com/its-a-feature/Orchard): JavaScript for Automation (JXA) tool to do Active Directory enumeration. ### Domain Information ``` echo show com.apple.opendirectoryd.ActiveDirectory | scutil ``` ### Users The three types of MacOS users are: * **Local Users** β€” Managed by the local OpenDirectory service, they aren’t connected in any way to the Active Directory. * **Network Users** β€” Volatile Active Directory users who require a connection to the DC server to authenticate. * **Mobile Users** β€” Active Directory users with a local backup for their credentials and files. The local information about users and groups is stored in in the folder */var/db/dslocal/nodes/Default.*\ \_\_For example, the info about user called *mark* is stored in */var/db/dslocal/nodes/Default/users/mark.plist* and the info about the group *admin* is in */var/db/dslocal/nodes/Default/groups/admin.plist*. In addition to using the HasSession and AdminTo edges, **MacHound adds three new edges** to the Bloodhound database: * **CanSSH** - entity allowed to SSH to host * **CanVNC** - entity allowed to VNC to host * **CanAE** - entity allowed to execute AppleEvent scripts on host ```bash #User enumeration dscl . ls /Users dscl . read /Users/[username] dscl "/Active Directory/TEST/All Domains" ls /Users dscl "/Active Directory/TEST/All Domains" read /Users/[username] dscacheutil -q user #Computer enumeration dscl "/Active Directory/TEST/All Domains" ls /Computers dscl "/Active Directory/TEST/All Domains" read "/Computers/[compname]$" #Group enumeration dscl . ls /Groups dscl . read "/Groups/[groupname]" dscl "/Active Directory/TEST/All Domains" ls /Groups dscl "/Active Directory/TEST/All Domains" read "/Groups/[groupname]" #Domain Information dsconfigad -show ``` More info in ## External Services MacOS Red Teaming is different from a regular Windows Red Teaming as usually **MacOS is integrated with several external platforms directly**. A common configuration of MacOS is to access to the computer using **OneLogin synchronised credentials, and accessing several external services** (like github, aws...) via OneLogin: ![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(563\).png) ### ## References * * *
πŸŽ™οΈ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) πŸŽ™οΈ - πŸŽ₯ Youtube πŸŽ₯ * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://breached.gitbook.io/dashboard/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.