all right hello nuncom today's talk is
zero day up to your sleeve attacking
Marcus environments
my name is and I'm a head of mobile
security at securing where I'm mostly
focused on iOS and Mac OS application
Security in my free time I run a Blog on
voice record.blog which is about of
course Apple security so if you are
interested in this topic feel free
um to visit my blog somebody of you may
also know me from IOS Security Suite
that I'm a creator of it's a free Swift
open source library that helps
developers and security teams making
sure that their mobile application is
compliant with OAS mobile application
security verification framework checks
and recently we also started in securing
a new service that is macros environment
security testing
so let's go to the agenda and before
I'll introduce you to this talk
um I had an idea in my mind before I
started creating the stock that I'd like
to give uh like typical red theming talk
but red team in talks are usually about
Windows or Linux but I wanted to give a
Mac OS related doc to share with that
all these techniques that you know from
attacking windows or Linux are also
possible on Max that Max can also be
successfully attacked
all right so uh we'll start from a quick
introduction
um then we'll compare some different use
cases of marks in corporate environments
and then we'll start with setting up a
C2 with mafic and then the standard red
teaming procedure that is initial access
persistence data collection lateral
movement and because I don't like living
people without the recommendations uh
I'll talk a bit about hardening markers
environments and of course the
conclusion
all right so I have one question to you
or two questions but that's the first
one uh please raise your hand if there
is at least one mark in your company
all right so it's like 90 percent of the
audience I think that's good
so the second question please raise your
hand if that Mark has access to your
company resources like other windows
machines
okay like I think like almost everybody
who raised throughout their hand during
the first question was if their hand
during the second question what's good
but because it it proves that my
assumptions were correct
all right so why did I decide to make
this dog because marks are getting more
common in corporate environments uh that
are widely used by developers ux
designers managers
Etc
um and small companies or software
houses or ID companies in general
those companies have large percent of
Max in their environments
and those marks are not symmetrically
secured comparing them to Windows
machine I spoke some time ago with with
a person that works for a big
International Bank
and and he told me waiting but we don't
have any marks in in our environment and
I asked do you really you I I saw you
have a mobile banking application for
iOS so how do your developers uh
program it and build it and then deploy
it
and uh he said okay I will return uh
return to you of the answer on that and
after a couple of days he told me yes
actually we have a team an iOS team that
that makes that application and you know
what our Macs are not even a Max of that
developers are not even enrolled to MDM
or anything yeah you know they bring
their own devices that are a blind spot
for their socks so that's that was an
interesting conversation
so what are the problems that we
identified uh during many Marcus
environments assessments so there were
old and vulnerable macros and versions
everywhere like everywhere
um
we had one assessment uh when I
um
audit all the marks because it was a
small company and it turned out that the
person responsible for Finance in that
company used Max use Mac not updated for
three or four years
and you know Max also have
vulnerabilities right
um by default Marcus system firewall is
disabled so if there is nobody who uh
force people to turn on their firewalls
especially non-technical people uh the
max probably will be left with the
firewall disabled and anti-mother do
marks even have viruses unfortunately
yes we have to care about it
um not even saying about standard users
working on admin accounts
um and I think that this uh common and
some hardened Windows environments like
this is lack of hardening white listing
like
white listing of an application is of
course in the most hardened Windows
environment but I didn't see in all
assessment that we did we I didn't see
at least once
um corporate environment with the white
listing on max
and and mid-sized companies uh marks are
not even enrolled to enrolled in mdms so
that that's really bad there is no
Central mechanism to to manage those
marks in mid-size companies usually
okay so let's compare now uh three
situations where marks are present in
corporate environments so the first
scenario is that marks are directly
banned to the ID so there's a classic
active directory environment with
Windows machines there are most Windows
machines and some of the developers
managers Etc use Max and those Macs are
natively bound to the ad but that's the
most rare situation to be honest from
from my experience
uh the second one uh a bit more common
is that all right so this company has an
active directory environment
um those Macs are not bound to the ad
but they have some how to access uh
resources using the care girls so there
is an application an extension called
Nomad that handles kerberries for you so
the user provides user or the admin
provides the ID credentials to Kerber to
to Nomad and it generates the whole uh
caregivers communication
foreign
observed in in modern companies is that
there is no active directory just one
SSO like for example OCTA and uh we had
this SSO that the person gets access to
all these Services used by by the
company that are of course in the cloud
so there is ID is not necessary in this
scenario
okay but for this talk uh we will focus
on such an environment so we will be
attacking a Mac
um that the Via openvpn
has access to internal company resources
it uses Nomad to
um to talk to active directory and then
via active directory gets access to
Google workspace or jira software
um this uh this this Mac also uses AWS
there are token stored
um has a browser in this case Firefox
that connects you to Twitter Facebook or
other social media and that's usually a
common case especially for marketing
teams because usually marketing
department works on their private
account linked to the company account
and it's you know not really good to uh
to bend your private accounts to the
company's SSO so usually the
connection to social media as out of
Kerberos it's our out of SSO it's it's a
like typical connection to to Social
Media Services not via the company
infrastructure uh so there will be uh
for example stored password for social
media accounts on such a machine
and that company heard that signal is a
secure messenger so we'll be attacking
signal on those Macs and of course there
will be some secret data certain desktop
or other TCC protected directors
all right so in order to uh to perform
this attack
um we will be using methic that's a
really great red steaming framework with
an extensive macro support uh it's open
source it's created by Cody Thomas I
really love mavic because as I told you
it's open source it has really extensive
docks so it's really easy to set up not
not really common so
it's not really detected for now
okay so let me show you a quick demo so
we have the metric set up already we'll
log into Mythic
that's the main dashboard uh we have one
payload that is up fill the standard one
and C2 profile uh HD that is http
so let's create a new payload it's
really simple generate new payload we
select the operating system of the
target of course Mac OS in our case
upfell the the default one
we select all the commands that will be
accessible
and we decided to use the simplest
connection that's HTTP not developed SSL
we provide them the Callback host
[Music]
we click next
create payload
and now
we can download it and and use it to to
attack the victim
all right but uh there are there are
some problems on how can we get the
initial access
so according to Apple all the software
downloaded directly with your browser or
in general from the internet must be
notarized and it's the case for macros
applications non-up bundles disk images
flat installer packages so most of the
car come on
um
stuff that executes your code on your
machines right
and what's that notarization so
notarization requires uh developers to
have a developer ID
the paid one and to distribute their
application
but before they they can distribute
their applications they have to upload
it to Apple their application has to
meet some requirements the security
policies and it's verifying against
against the malicious code if there is
there is some malicious code in in those
applications
but you may ask me all right but what
happens if I don't notarize my my
application or my payload
um so unfortunately Mac OS will block it
there will be a prompt that uh no
notarized app cannot be opened because
the developer cannot be verified so we
have to somehow
may pass it
so this is the talk this is what the
talk is this talk is about
um so let's find some solutions we can
of course buy a proper developer
certificate create a legit per PKG file
and now it arise it but we are risking
our certificate to be revoked right
so there is there is the second solution
uh commonly used by by current malware
so
we can provide our payload uh bundled in
a DMG file and DMG file as a disk image
where we can set the background of so as
you can see here that's that's an
example of real malware uh there is a
background with an instruction to the
victim on how to bypass their uh how to
make the victim bypass their own
security mechanisms right so the the
malware asked the user to right click on
the on the package unsigned package and
click open and there will be a prompt
that the application was downloaded from
the internet it wasn't verified by Apple
so please click OK and and you know risk
your Mac hacked and so that's that's the
second idea
uh the third idea uh because this talk
is about zero days
um we can find a gatekeeper bypass a
gatekeeper is the mechanism that on Mac
OS side verifies if the application was
indeed notarized
um so we can bypass it with a zero day I
even find one uh one year ago uh but
it's fixed
and we have the fourth technique and
that's the technique you probably know
from attacking Windows that's a
technique that involves Microsoft Word
on Microsoft Word uh there is also uh
macros macro possibility attack so we
have a Visual Basic and how to open
subroutine which will be executed after
user opens that document file and allows
macros
um and and that subroutine we can call
Max script
that in the end will will execute our
bash commands so in that case I just
download the uh our payload created with
mavic and I run it with also script
all right so
let's assume that that user downloaded
it and and clicked
enable macros the code has been executed
but the problem is that
Microsoft Word is a Sandbox so even if
we use that trick with macros our
our remote cell will be not that cool
because it will still run in a sandbox
process context so we can do
you know unlimited stuff on that machine
however there is there is another bypass
for it uh made by madhubat that shared a
really cool technique uh that allows us
to escape World sandbox however it
requires the user to reboot their Max
so
it's it's good technique especially when
you know for example that Apple will
push some updates and you can infect the
machines right before that update so
you'll be sure that most of the users
maybe if it's enforced for example will
reboot their Max but you know it's not
like 100 effective we'd like to see
something more effective
so we have our own zero days and I now
present a marker sandbox SK
vulnerability
unfortunately is not fixed so I won't
show you the the actual code so you have
to trust me that the the the this demo
is real
all right so this this zero day is for
um the whole standard macros unboxing
um
mechanism it's not only for escaping the
word but it's for the whole standard
sandboxing mechanism so let's see how it
works so the user clicks on the document
file clicks enable macros
and as you can see we have now an active
callback
we can now use it we I wrote shell I
come on to the mafic and now we can
execute any shell command we want
so let's start with qmi
regula that is my user
and now let's try with alas uh the
user's directory which if succeeds means
that we have unsun boxed code execution
yeah so we can see two users which means
that our code is now
unsigned and unsun boxed run by the
victim that's good
we have the initial access now let's
talk about the persistence so on Mac OS
uh there are a bunch of typical
persistence techniques like launch
agents lunch demons login items Crown
jobs and tons of others my friend
chapafields documented it on his block
so it's now like 27 or something uh
persistence techniques the document and
so it's quite a lot
but in this talk we'll use the standard
one so we pass the persist uh launch to
the command to the Mythic and now with
the Osa script the very same command
that I used in the word macros we will
be running the
the payload created by math right
we can change the label to look more
stealthy
and click task
Let's Wait a While
for the method to uh to create the
launch agent it's as you can see the
file has been written
so
now the Second Step because now we we
registered the the launch agent but now
we'd like to load it
and that's simple we just take the
um
the path again shell
land CTL
load and Dot path
click task
and in a while you will see that we will
have the second active callback
yeah
the second one so now we have answered
boxed unassigned code execution on Mac
web persistence right so even if the
victim reboots the computer it will be
still able to connect to that reverse
shell
all right
um
a quick update
um
in Macos Ventura that will be released
this fall
um
there will be a new tab and in general
settings that will show all the launch
agents and lunch demons registered in in
Macos so this technique is will be not
that stealthy anymore however as I told
you there are plenty of different
techniques and apple covers maybe three
or four of them in that pencil just
switched another personal technique it's
it's really easy to do so
great so we have uh taken over the uh
the Mac now let's focus on the data
collection right so we are interested
mostly in VPN credentials ad credentials
signal messages browser cookies keychain
entries AWS or other Cloud keys and
desktop and document files
let's start with
openvpn so openvpn
starts and stores its profiles and
application support directory that can
be accessed without any additional
privileges like standard markers user
can access it without providing any
password it's not encrypted so if the
all the credentials required to
establish a VPN connection are there
you
that's it
but usually uh the the profiles don't
store uh user login and password so we
have profile but we still need to uh to
steal the user's login and password
right
um
because of the notarization applications
have to have the hardened runtime there
on so we cannot easily inject to those
applications however on purpose
developers can disable some of the
security mechanisms for their
applications
and that's the openvpn does it's another
kind of zero day
it has the two uh problematic
entitlements the first one is allow
build environment variables and the
second one is disabled Library
validation
so with that knowledge of those two
entitlements we can now inject our
Dynamic library inside of the of the
openvpn context
and
yeah
we can for example steel keychain
entries uh that openvpn stores are
launch a key logger inside of the of the
of the openvpn so
why couldn't I use a global keylogger
because on new Mac OS versions uh if
you'd like to register a system-wide
keylogger it requires a special
permission from the user there will be a
prompt that the application wants to
record all user input and we'd like to
avoid it but you know if you are in the
context of an application you can get
all the keystroke that user passes to
the application without any additional
privileges because it would you know
don't have any sense to to to do so it's
it's
um expected Behavior right so the
application may catch the user
keystrokes right so I created an open
source keylogger uh that you can
download from my GitHub uh it's on guest
it's a really short code
and we have the adult insert libraries
we can inject to to the openvpn
and wait for the user login since
password and that's how we can instill
the VPN credentials from from user again
it didn't require from us any additional
privileges like just standard user
nice so we have openvpn uh taken over
now let's go to to nomad
and Nomad saves your active directory
credentials in Macos keychain and the
keychain has a flow that allows getting
entries from it without any prompt root
access or user passwords I documented it
and my blog post so if you are
interested how did it work uh feel
invited to to read that post
however I also open sourced a Nomas
credential Steeler tool
um that will do all the job for you so
it's it's pretty simple you just run the
Nomad Nomad credential stereo
application and it will dump
the active directory credentials right
from the kitchen without basically any
problem again no additional privileges
standard user so
because we were able to get all of the
credentials from the Marcus keychain
we are now able to access all the
company's resources that are hidden
um after behind the adaf SSO right
okay now let's torture signal who thinks
that signal is secure
raise your hand
[Music]
all right
um I hope so as well that signal is
secure but the thing with signal is that
signal claims that they protect your
data only in transit they don't care
about your endpoint security
so
all your messages on Mac from signal are
encrypted there is a database in sqlite
free database that's encrypted however
what about the key
the key is not stored in the keychain
it's stored in a flat file accessible by
a standard user so you go to the library
application support signal config.json
you grab the key pass to the sqlite
database and we have all your messages
unencrypted
yeah
so the next Target is is Firefox
so Firefox starts saved logins and
passwords in an encrypted form that's
good
but if the master password is not set
that is a default configuration the safe
credentials can be done again without
root
and personally
whoever uses Firefox
okay
and do you have the master password set
no Nobody Does it
uh so yeah there is a tool uh on GitHub
made by you note that's called Firefox
decorate and I will show you a quick
demo on how it works
so I run it with python select profile
and we're done
no additional privileges again
foreign
so
AWS and desktop and other projector
resources are left so let's now focus on
the TCC
so whenever you're install a new
application on Mac and that will require
your camera access or screen share so
for example maybe Microsoft teams or or
Google meet or anything
when the application tries to access
those resources those protective results
of the camera etc for the first time
there will be a prompt
um and that that prompt uh is is a
protection of your uh privacy sensitive
data uh and the the mechanism behind of
that prompt is called TCC
and now uh TCC protects a lot of
sensitive resources like camera calendar
Bluetooth automation contacts Network
shares uh photos music and many many
more
foreign
have that Mythic shell
and you will try to for example do the
list of desktop
and click task
you will see that there will be a prompt
and if the user clicks don't allow the
operation will be not allowed
um
and the case is also for for a root so
even if you if you have root you cannot
bypass this prompt uh Apple decided to
make this prompts to be clicked by user
with a clear intention so it has to be
done by user even if there is a root
account on Mac
it's still that that doesn't mean
anything you can bypass this problem you
can you can't do this
however
uh there are tons of TCC bypasses
um I was called speaking last year ago
on blackhead in the US about 20 plus
ways to bypass your Marcus privacy
mechanisms
um but yeah that will re that would
require zero that is that those
vulnerabilities are not are all now
fixed
so we can try abusing other applications
that are installed already on Mac OS
but applications that
have the already permissions granted
so there is a problem with electron apps
uh yesterday there was a wonderful talk
about abusing electron remotely now
that's a technique that allows abusing
electron locally
so if you are interested feel free to
read it
however as
I promised you to to show some zero days
uh
that there was as the the this was a
zero day but it was recently fixed by
Apple which is good
um so there was a back-end launch
services that allowed us to bypass the
TCC
and I wanted to give you
um some insight on how this exploit
worked when unfortunately I found a
bypass for for that fixed stuff I'm
sorry maybe next time I will show the
the full exploit with the
with the bypassport effects
but I will show you a demo
to not leave you without
anything right
so
let's verify if this Mac OS is com is
updated and securing that times it was
the newest markers the system Integrity
protection is enabled
um
when I would verify that the application
that bypass this C by me uh
has no TCC permissions granted so
there's nothing for the bypass DC by me
apps
now let's open it
and there are two buttons
made for the proof of concept reasons we
click still address book and as you can
see it's stolen
and still iMessage chat as you can see
it's stolen
now let's verify if everything succeeded
so we go to TMP and the file will verify
if it's work yeah file was able to
allow the both of the data databases
that means that we have bypassed the TC
okay so we have our DC bypass
um but there is one more thing
with the TCC bypass we were able to
allow desktop
documents downloads and other protected
resources but what about the cloud keys
the cloud credentials
good good news for retimers there are
stored in home directory which is not
TCC protected so if you'd like to steal
uh AWS or SSH keys or Azure or gcloud or
or anything that stores uh their secrets
in in home directory you don't even have
to uh use any TCC bypasses it's a
directory that's not protected by the
TCC
all right so uh with all that knowledge
we were able to fully compromise the Mac
OS machine
and because as I told you I don't want
you to live without any recommendations
um there are six points the very minimum
you have to implement in in your max
micros infrastructure the first one is
enroll your company's Max to MDM Maybe
jump or into any md12 you like keep them
updated because as I approved on the on
the presentation that our
vulnerabilities for Mac OS so please
keep the keep them updated and for
security policies like system Integrity
protection without system Integrity
protection TCC is not even in place
there there are no ver there are no
checks with SIP disabled uh you can
elevate your privileges to root without
providing even a user's password so make
sure that there are policies that are
enforced
there is a
um
an interesting story because
you know for the last few years when I
was you know Googling for finding some
uh example calls on Macos or something
stopped working I of course Google for
stacked overflow right and in stack
Overflow there are a lot of
recommendations that claim all right so
you can't run this application because
there is notarization
so let's try disabling Sip and maybe
that will work and there are so many
answers on stack Overflow uh that Miss
guide users to disable system Integrity
protection so you really want to be sure
that your organization have
um security policies enforced
um disabled offices office macros
um I can bet that in most cases if you
have modern infrastructure and you have
mac users they don't even use word word
macros uh on Mac OS of course on our
Windows the finance department
will probably use them but most of Mac
users they don't use word macros so I
bet you can disable it
install an anti-mado resolution EDR or
whatever Max have viral system they have
that they need to be protected
and monitor your marks because there is
always a something that may go wrong
right
um
if you'd like to verify if you're a Mac
OS infrastructure or environment is
secure you can always hire us to do this
we can perform a red teaming for you or
or just assess your your environment so
you have a contact to me
and to sum up that will be the shortest
sum up ever
please remember that Max like any other
machines have viruses can be attacked
have to be updated so please do it and
stay safe thank you very much
[Music]
does anyone have any questions
hey uh great talk so for the uh Word
document that gets downloaded with the
macro uh would it get quarantined with
the extended attribute flag and I know
there's bypass for that as well but at
least it's an initial difference
so where documents are not quarantined
even if they have the tag applied
because that would have no sense right
because you want to have apps
quarantined like images like of course
disk images like
um packages like applications Etc that's
what you want to have quarantined but
for example PNG images or you know text
files you you don't want to have them
signed you know in order to open so
there are there is an allo list of
extensions uh that don't have quarantine
and Word Documents are one of those
non-quarantined extensions
uh one more question about the TCC uh
bypass
uh I noticed uh terminal had access to
contacts so I think it's relying on the
attribution change of the parent process
in the demo the the term the terminal
hacked by the world which one uh had
access to the contacts in the demo so is
it relying on like the parent process uh
attribution chain
and no
uh it's the the story behind this back
is really interesting because I found it
really accidentally
and I couldn't believe it worked it's
it's a part of mechanism that I think
all of my friends researchers knew about
that behavior and even even I knew about
this behavior for maybe two years and
you know one night I I was I was asleep
and I was like hmm
the idea stumbled across my mind I said
wow but that shouldn't be working right
there and I went to the computer and it
worked so that's really obvious bypass
but
I can't I'm sorry uh disclose it today
foreign
does anyone else have any questions okay
[Music]
amazing talk uh actually uh in your
sandbox escape the technique you discuss
about the persist launch I missed that
point like how it works
I the the Sun Bug escape the question
was about the Mythic uh persist launch
the purse is launched
um that
that technique that was presented that
required reboot uh was the login items
but my sandbox Escape
uh
you know that's not what I can when I
can disclose I have all the details
regarding this technique but yes there
is something with lunch D but
I'm not saying anymore okay anything
more
thank you
foreign
box escaping technique right so were you
also able to do anything interesting
without sandbox Escape
um so with sandbox turned on you could
be able to access only those resources
that are available to word so it's not
really much you can make connections you
can establish a shell with uh with with
the machine but it's not really uh it's
not really worthy you know
if word has access to some resources uh
like I don't know camera but it's a rare
case that would be maybe worth something
but mostly you in most cases you will
need to have an unsung box code
execution
and another follow-up so
have you also seen similar attacks in
production like in the wild being
exploited once again have you seen
similar attacks being exploited in the
wild or is this something such such
experts before it right uh yes
okay thanks
[Music]
any other questions from the back
okay
first of all thanks for the talk it's
really fantastic so I have a doubt
related to disabling the Sip is it
possible to disable the sap through the
tool you shown
and in order to disable sip uh you have
to reboot your Mac so no not from the
maybe if you have a zero day yes but
there is no standard technique to do is
without having a vulnerability you have
to reboot your Mac to this okay thank
you
any other questions
[Music]
so in the organization some part I have
seen uh when you have to connect
critical environments so they do allowed
the developers will be still be using
Mac machine but when they have to
connect to the
to the production environment they were
using some sort of vdi uh to connect
back to the corporate environment so
that's where I see that there is a gap
like
[Music]
metrical security controls are not
deployed on those Mac devices because
they are not directly connecting to the
corporate or to the production
environment
so is that something you see reasonable
or you think okay there are bypass over
the vdis that can lead to uh compromise
or like someone can get into your uh
franuals or your production environment
um it really depends but the answer
would be really long for that question
so maybe let's do it after okay
sure
uh any other questions
okay thank you so the uh thanks again
watch it thanks a lot so the lunch break
is going to start in one minute from 12
45 to 2 PM and we'll see you again thank
you
foreign