first commit

Necronomicon/Mac OS/Dylib Hijack.md

@@ -0,0 +1,17 @@
+- Mach-O Library Load Commands
+	- `LC_LOAD_DYLIB` specifies a dynamic library to be loaded at runtime and the dylib must be loaded when the binary or library is executed.
+	- `LC_LOAD_WEAK_DYLIB` specifies a weakly linked dynamic library. If the dylib is not found, the binary or library will still be executed without interruption.
+	- `LC_REEXPORT_DYLIB` specifies a dynamic library to be reexported by the binary or library.
+- Install names specify the path to the dylib at runtime
+	- `@executable_path` **–** This variable is replaced with the path to the directory containing the main executable for the process, for example, _/Applications/Dummy.app/Contents/MacOS._
+	- `@loader_path` **–** This variable is replaced with the path to the directory containing the mach-o binary, which contains the load command.
+	- `@rpath` – is a variable that will be replaced with one or more paths specified by the LC_RPATH command at runtime.
+- Requirements for dylib hijacking:
+	- The app is not restricted with a hardened runtime or having the com.apple.security.cs.disable-library-validation entitlement.
+	- One of the files in the application path `app/Contents` is not properly signed (Figure 3). We can run the `codesign –verify –verbose <app_name>` command. If we see an error message in the output, it indicates that the signature is invalid.
+- Identify weak dylibs:
+	- `otool -l <app_name> | grep LC_LOAD_WEAK_DYLIB -A5`
+	- Look for a weak library from a writeable directory
+- Check if any dylibs are loaded from `@rpath`:
+	- ` otool -l <app_name> | grep LC_LOAD_DYLIB -A5`
+	- If any libs have `@rpath`, see if directory is writeable. If multiple `LC_RPATH` load commands are present and the library is not found in primary run-path, a malicious dylib can be placed in the primary path.

Necronomicon/Mac OS/Gatekeeper & XProtect.md

@@ -0,0 +1,9 @@
+- Check for quarantine attribute (`com.apple.quarantine`), which triggers Gatekeeper upon execution:
+	- `xattr -l <executable_file>`
+- XProtect's Yara rules can be inspected:
+	- `locate XProtect.yara`
+	- Generally useless in default settings
+- XProtect requires three conditions to even scan a file:
+	- Being run for the first time
+	- File hash has changed
+	- Yara rules have been updated

Necronomicon/Mac OS/Hardened Runtime.md

@@ -0,0 +1,16 @@
+- Protects apps against code injection via library hijacking, env vars, and task port injection. 
+- List app entitlements:
+	- `codesign -d --entitlements :- <file>`
+	- Poseidon: `list_entitlements`
+	- Look for any of the following:
+		- `com.apple.security.cs.disable-library-validation`
+			- Allows any dynlib to be loaded into the process
+		- `com.apple.security.cs.allow-dyld-environment-variables`
+			- Allows dynlibs to be loaded from `DYLD_INSERT_LIBRARIES` env var.
+			- Code signing requirements still apply unless the previous setting is also applied.
+			- Injection:
+				- `DYLD_INSERT_LIBRARIES=malicious.dylib ./app`
+		- `com.apple.security.get-task-allow`
+			- Allows other apps to get task port; similar to a handle on Windows. Accessing a task port requires root.
+			- Enables classic create thread process injection
+	- 

Necronomicon/Mac OS/Resources.md

@@ -0,0 +1 @@
+[Red Teaming Mac OS 101](https://frischkorn-nicholas.medium.com/red-teaming-macos-101-33b5a1834a2e)